Payments Glossary

3DS2 authenticates cardholders online; eligible transactions may receive a fraud-liability shift under card-network rules.

Account takeover is fraud where an attacker gains control of a legitimate customer account and exploits the stored payment credentials or account value within it.

Account Updater can supply stored-card updates or status information; coverage and approval outcomes depend on the issuer and provider.

ACH is the US interbank network for batch bank transfers — ACH debit is the pull payment mechanism for US bank-account recurring billing, governed by Nacha's Operating Rules.

The acquirer is the network-facing institution responsible for accepting a merchant's card transactions; a PSP may be the merchant's direct contact.

AML is the legal framework requiring payment businesses to detect, monitor, and report transactions that may represent money laundering or financial crime.

Authorization is the real-time request sent to the card issuer to verify funds availability and approve a transaction before capture.

Authorization rate measures issuer-approved authorization requests as a share of requests sent to issuers.

An authorization reversal requests release of an uncaptured card hold; a refund returns a captured payment.

Bacs Direct Debit is the dominant UK bank-account pull payment mechanism — a mandate-based recurring collection scheme governed by Pay.UK with a fixed three-day settlement cycle.

A BIN is the first 6–8 digits of a payment card number, identifying the issuing bank, card network, card type, and country of issue.

BNPL is a point-of-sale installment credit product — typically 3–6 payments — offering deferred payment with no interest if paid on time.

Capture submits an authorized payment for processing; it does not guarantee settlement or payout.

Card on file is a stored payment credential or token used for later authorised payments, with separate storage and transaction-permission requirements.

A card scheme is an organization such as Visa or Mastercard that sets the rules, interchange rates, and technical standards governing card payments globally.

Card testing is a fraud attack using automated scripts to validate stolen card numbers via small test transactions before exploiting them for larger fraud.

CNP (Card Not Present) describes transactions — primarily e-commerce — where the physical card is absent, carrying higher fraud rates and interchange than card-present.

CBPR+ is SWIFT's ISO 20022 usage guideline set for cross-border payments on the SWIFT network — narrowing the standard to an interoperable profile; MT coexistence ended 22 November 2025.

Chain analysis is the forensic tracing and risk-scoring of blockchain transactions using graph analysis and address clustering to identify entities and flag illicit fund flows.

A chargeback is an issuer-raised card-payment reversal that a merchant may be able to contest with evidence through its acquirer.

A chargeback ratio compares disputes with transactions over specified periods; scheme programme formulas can include different events and denominators.

Representment contests a chargeback with relevant evidence through the acquirer or PSP; it is distinct from arbitration.

CE 3.0 lets merchants contest eligible Visa card-absent fraud disputes with matching data from two qualifying prior transactions.

CoP is the UK's Pay.UK name-check on Faster Payments and CHAPS — Match, Close Match, No Match, or Unavailable — covering ~99% of volume since October 2024 and feeding the APP-fraud liability framework.

A seller account a platform creates and manages inside its payment provider to receive funds and be paid out.

Correspondent banking is an arrangement where one bank holds accounts for another to execute cross-border payments in markets or currencies it doesn't directly access.

Cross-border payments are transactions between parties in different countries, involving currency conversion, correspondent banking, and additional compliance overhead.

CVV/CVC is the 3–4 digit security code on a payment card used to verify physical card possession in CNP transactions — prohibited from storage under PCI DSS.

Decline codes are the issuer's response codes indicating why a transaction was rejected and whether a retry is appropriate — meaning varies by network, and some are deliberate catch-alls.

A digital wallet stores tokenized payment credentials for card or account-based transactions, eliminating the need to present a physical card or enter card details manually.

Direct debit is a pull payment where the operator initiates a bank account debit against a pre-authorized mandate, without requiring customer action per collection.

A dispute is a cardholder's challenge to a transaction with their issuer, which escalates to a chargeback if the merchant doesn't respond or loses the review.

DCC lets cardholders pay in their home currency at point of sale, with conversion applied by the acquirer at a marked-up rate that generates a rebate to the merchant.

An e-mandate is a digital recurring-payment authorisation; India's RBI framework covers cards, prepaid payment instruments and UPI.

eGIRO is Singapore's API-based digital mandate system for recurring SGD bank account debits — the modern replacement for paper GIRO forms, live since 2021.

Embedded finance is the integration of financial products (payments, lending, insurance) directly into non-financial platforms via BaaS and payment facilitator infrastructure.

EMV is the global chip card standard that generates a unique cryptographic code per transaction, making card cloning at point of sale effectively impossible.

The FATF Travel Rule requires VASPs to transmit originator and beneficiary identity data alongside virtual asset transfers above defined thresholds.

Friendly fraud is when a cardholder disputes a legitimate transaction they made and received, either deliberately or because they didn't recognise the charge.

FX markup is the margin a PSP charges above the interbank exchange rate when converting currencies in cross-border transactions, on top of any stated FX fee.

An IBAN is a standardized account identifier used across Europe and parts of APAC to route bank transfers precisely and reduce payment failures.

Incremental authorization requests a higher authorized amount on an existing uncaptured payment; issuer approval and provider support are required.

Interchange is the per-transaction fee paid by the acquirer to the card issuer, set by card networks and the largest single component of MDR.

Interchange-plus separates interchange from provider markup; check how scheme fees and additional charges are treated in the actual quote.

ISO 20022 provides financial message models and definitions; each payment scheme or bank specifies how to implement them.

An issuer provides the payment card and manages the cardholder account; the acquirer serves the merchant side.

KYB is the regulatory due diligence process payment providers use to verify a merchant's identity, ownership structure, and business legitimacy before onboarding.

KYC is the regulatory requirement for payment businesses to verify the identity of individuals before providing financial services or processing payments.

Least-cost routing automatically selects the lowest-cost network path for debit transactions — typically routing via a domestic network instead of Visa or Mastercard.

MiCA regulates in-scope EU crypto-asset offers, issuers and services; token classification and issuer or service-provider status require separate checks.

The acquiring account a payment facilitator holds and boards its sub-merchants under, through which all their transactions flow.

MDR is the total percentage fee a merchant pays per card transaction, comprising interchange paid to the issuer, scheme fees, and the acquirer's margin.

An MCC is a four-digit code assigned by card networks to classify a merchant's business type, directly determining interchange rates and card acceptance rules.

A Merchant of Record is the entity legally responsible for a sale — owning tax collection, refund liability, compliance, and the card network relationship.

A Merchant-Initiated Transaction is a charge triggered by the merchant against stored card credentials without the cardholder present — used for subscriptions, instalments, and usage billing.

MPC splits a private key into distributed shares that sign transactions cooperatively, so the full key is never assembled in any single location.

Multi-sig requires M of N designated key-holders to sign a transaction on-chain before it executes, enforced by smart contract logic.

Netting offsets payment obligations into net positions; confirm the settlement arrangement and finality separately.

A network token is a substitute card credential with defined usage restrictions and lifecycle management.

The OFAC SDN List is the US Treasury sanctions list of blocked persons and entities, including crypto wallet addresses, against which US persons cannot transact.

Open banking is a regulatory framework requiring banks to share customer account data and payment initiation access with licensed third parties via secure APIs.

A PAN is the full card number on a payment card — classified as sensitive data under PCI DSS and replaced by tokens in most modern payment flows.

A partial authorization approves less than requested; verify the amount and supported next steps in the provider response.

A payment facilitator supports sub-merchant acceptance under an acquiring arrangement, with onboarding, risk and funding responsibilities defined by the applicable rules and agreements.

A payment gateway connects checkout to payment processing; the acquiring and payout roles depend on the provider arrangement.

Payment orchestration intelligently routes transactions across multiple PSPs, acquirers, and payment methods to optimize authorization rates and reduce acceptance cost.

PCI DSS is the card-industry security standard mandating specific controls for any entity that stores, processes, or transmits cardholder data.

Pix Automático is Brazil's bank-native recurring debit feature on the Pix rail — enabling scheduled pulls from customer accounts with near-zero MDR and no card expiry risk.

A pre-authorization is a temporary hold placed on cardholder funds before the final transaction amount is confirmed, common in hotels, car rentals, and fuel.

PSD2 is the EU directive that mandates Strong Customer Authentication for online payments and requires banks to grant API access to licensed third-party providers.

PSD3 is the EU's update to PSD2, sharpening open banking, adjusting SCA rules, and improving non-bank payment access — provisionally agreed in late 2025 and not yet in force, with application expected around 2028.

A PSP is a company that provides merchants with the technology and banking connections needed to accept electronic payments across cards, wallets, and bank transfers.

Qualified custodian is a regime-specific legal classification; verify the entity, custody authority, asset scope and applicable protections.

A real-time rail is a national payment infrastructure settling bank transfers instantly and 24/7 — such as UPI in India, PIX in Brazil, or Faster Payments in the UK.

Reconciliation is the process of matching payment records across a merchant's internal systems, PSP statements, and bank settlements to identify and resolve discrepancies.

A recurring payment repeats under customer authority; consent, authentication, failures and protections differ by rail and provider.

A rolling reserve is a percentage of merchant settlements withheld by a PSP for a defined period as a buffer against chargebacks and financial exposure.

Scheme fees relate to card-network services; their basis and merchant pass-through depend on the applicable schedule and contract, not a universal percentage.

SEPA standardises euro credit transfers and direct debits across 41 countries and territories, including jurisdictions outside the EU.

Settlement discharges payment obligations; merchant payout and usable bank funds can occur at different times.

A soft decline is an authorization failure where the issuer signals the transaction can be retried — typically due to insufficient funds, a temporary flag, or SCA required.

A single buyer payment divided across multiple recipients — platform and sellers — at settlement.

A stablecoin is a cryptocurrency pegged to a fiat currency — typically USD — designed to hold price stability, used increasingly for cross-border B2B settlement.

SCA is the EU regulatory requirement for two-factor authentication on electronic payments, implemented primarily via 3DS2 for card-not-present transactions.

A business that accepts card payments under a payment facilitator's master merchant account instead of holding its own merchant account.

Surcharging is adding a fee to card transactions to recover acceptance costs, subject to card network rules and local regulations that vary significantly by market.

A SAR is a mandatory confidential regulatory filing submitted to a financial intelligence unit when suspicious transactions suggest money laundering or financial crime.

SWIFT is the global interbank messaging network used to transmit cross-border payment instructions — it moves messages, not money, across 11,000+ institutions in 200+ countries.

Synthetic identity fraud combines a real SSN with fabricated personal data to create a fictitious consumer identity used to bust out credit lines.

A TPP is a licensed entity under PSD2 that accesses bank accounts via open banking APIs to initiate payments (PISP) or retrieve account information (AISP).

A tokenised deposit is a bank deposit represented as a blockchain token, issued directly by the chartered bank and retaining deposit insurance and regulatory protections.

Tokenization substitutes a token for card data; security, PCI scope and portability depend on how it is implemented.

UETR is a 36-character UUID carried through in-scope Swift payment messages and useful when asking a bank to trace a payment.

UPI AutoPay supports mandate-based recurring bank-account collections; authentication, notification and execution conditions depend on the applicable rules and provider.

VAMP is Visa's monitoring framework for card-not-present fraud and disputes, using a defined count-based ratio and region-specific volume criteria.

VRP uses customer consent with defined limits to support repeated bank-account payments; sweeping and commercial collection have different availability and terms.

A velocity check is a fraud control that flags or blocks a card or account when transaction frequency or volume exceeds a defined threshold within a time window.

VoP is the EU's EPC scheme checking a payee's name against the IBAN before a SEPA credit transfer — Match, Close Match, No Match, or Verification Not Possible — mandatory in the euro area since 9 Oct 2025.

A virtual IBAN is a unique account number mapped to a master account, used to reconcile incoming payments by giving each payer a dedicated reference.

A void requests cancellation of an uncaptured card payment; confirm the final provider state and do not assume the hold has already cleared.