That ambiguity causes real problems for UK platforms, marketplaces and software companies trying to launch embedded payments. The questions that matter are practical ones: Do you need FCA authorisation? Can you onboard sub-merchants without one? Who actually carries the financial and compliance risk if something goes wrong? And could a regulated partner get you to market faster than building everything yourself?
This guide walks through the PayFac model, the UK regulatory framework that applies to it, the practical steps to prepare and apply, and the alternatives worth considering before you commit to becoming a full payment facilitator.
Key Takeaways
- "PayFac licence" is shorthand, not a UK regulatory category — requirements turn on your funds flow and activities
- FCA authorisation and card-scheme PayFac registration are separate approvals, not substitutes
- Acquirers retain scheme responsibility even when they delegate merchant checks to a PayFac
- Alternatives like PayFac-as-a-Service can launch faster with less regulatory and operational burden
What is a payment facilitator and how does the model work?
A payment facilitator (PayFac) enables multiple merchants or platform users to accept payments under one centralised arrangement, rather than each merchant holding its own individual acquiring relationship. This typically works through a master merchant account, with individual sellers onboarded as sub-merchants underneath it.
Mastercard defines a PayFac as a service provider registered by an acquirer to facilitate transactions for sub-merchants. Visa's functional description is similar but broader: an entity that signs the seller's acceptance agreement on the acquirer's behalf, receives the seller's settlement proceeds, or does both.
The payment flow, step by step
- Acceptance – a customer pays a seller by card, using acceptance enabled through the sponsored-merchant agreement
- Acquiring and settlement – the acquirer processes the transaction; the PayFac may receive the resulting settlement proceeds on the seller's behalf
- Seller payout – the PayFac pays the sub-merchant, though the acquirer's obligation to that merchant isn't discharged until payment actually lands
- Fees and disputes – platform fees are deducted, refunds and chargebacks are processed, and cardholders retain their dispute rights throughout
The acquirer delegates certain functions to the PayFac, but never eliminates its own responsibility. If a PayFac's merchant agreement is missing required provisions, Mastercard's rules still hold the acquirer accountable.
How a PayFac differs from similar-sounding models
| Model | Contracts with seller? | Holds seller's funds? | Who carries risk |
|---|---|---|---|
| Payment facilitator | Yes, on acquirer's behalf | Often, yes | Shared — acquirer retains scheme responsibility |
| Payment gateway | No | No | Processes transaction data only |
| Payment processor | No | No | Handles authorisation/clearing messages |
| ISO (reseller) | No | No | Sells or services merchant accounts |
| Merchant of record | Yes, as legal seller | Yes, for the sale itself | Carries tax/legal responsibility for the sale |
The confusion between these terms is common, and it matters. A platform calling itself an "embedded payments provider" or "merchant of record" hasn't told you who actually contracts with the end seller or who controls the money. Map the actual contract and funds-flow diagram before assuming any label applies.
UK payment facilitator licensing and regulatory framework
"PayFac" is not a UK authorisation category in its own right. The Payment Services Regulations 2017 (PSRs 2017) define regulated payment services, including operating payment accounts, executing card transactions, acquiring payment transactions and money remittance.
Providing any of these regularly in the UK, without an applicable exclusion, generally requires FCA authorisation or registration as a payment institution.
Three separate approvals, not one
Most PayFac models need three separate approvals. Founders often treat them as one:
- FCA authorisation — covers the regulated payment service itself (as an authorised or small payment institution, or an e-money institution if you issue e-money)
- Card-scheme PayFac registration — Mastercard and Visa each require their sponsoring acquirer to register the PayFac with them
- Acquiring-bank sponsorship — the commercial relationship that actually lets sub-merchants accept cards
Satisfying one does not automatically satisfy the others. A platform can be registered with Mastercard through its acquirer and still need separate FCA authorisation if it's performing a regulated payment service in its own right.
Mapping your funds flow to the rules
Your regulatory analysis should follow the money:
- Do you receive or control customer funds at any point?
- Do you execute payment transactions, or merely initiate instructions?
- Do you provide anything resembling a payment account to sub-merchants?
- Do you facilitate payouts directly, or route everything through a regulated partner who remains legally responsible?
Receiving funds for executing a payment transaction also triggers safeguarding obligations under the PSRs for what's termed "relevant funds." The FCA's strengthened safeguarding regime takes effect on 7 May 2026, requiring affected firms to reconcile safeguarded funds and submit monthly reports to the regulator.
Related obligations that usually apply
Beyond the core authorisation question, most PayFac-style models need:
- Anti-money laundering and counter-terrorist financing controls
- KYC and ongoing customer due diligence, including beneficial ownership checks
- Sanctions screening
- Strong customer authentication under PSRs regulation 100
- UK GDPR and data protection compliance for cardholder and merchant data
This is a case-by-case analysis. Map your model against the FCA's Financial Services Register and card-scheme rules, and get advice on your exact structure before you build — a generic answer is expensive to get wrong.
How to become a payment facilitator in the UK
Becoming a PayFac follows a strict sequence of steps, not a single application. Rushing the order, for example building technology before confirming your regulatory position, is the most common and costly mistake.
1. Run a regulatory perimeter assessment
Document your business model in detail: customer types, jurisdictions, payment methods, funds flow, settlement timing, the sub-merchant relationship, and the intended role of any acquirer or regulated payment partner. This document becomes the foundation for every decision that follows.
2. Build the business and governance case
Whichever route you take, direct FCA authorisation or a partnership model, you'll need:
- Ownership and management information
- A governance structure with clear compliance oversight
- Evidence of adequate financial resources
- Outsourcing arrangements, documented
- A credible, specific business plan (not a generic template)
3. Build the control framework before launch
This is where most timelines slip. You need working systems for:
- Sub-merchant onboarding and underwriting
- KYC, AML and sanctions screening procedures
- Risk scoring and prohibited-business rules
- Transaction monitoring and fraud controls
- Complaints handling and incident response
- Suspicious-activity escalation
4. Establish payments infrastructure and partnerships
You'll need several pieces of infrastructure working together before a single sub-merchant goes live:
- An acquiring bank or regulated payment institution
- Card-network arrangements
- A gateway or processor integration
- Ledger and reconciliation systems
- Payout controls, refund workflows and chargeback management
5. Apply, test and launch in stages
Engage specialist legal and regulatory counsel early. Submit the relevant FCA or partner documentation, respond to regulator and acquirer due diligence requests, complete technical and compliance testing, establish safeguarding and reporting processes, and onboard sub-merchants gradually once approved, not all at once.
These steps apply whether you pursue direct FCA authorisation or operate under a partner's licence, though direct authorisation carries its own corporate test. An Authorised Payment Institution (API) applicant must be a UK body corporate with its head office and registered office in the UK, and must conduct at least part of its payment services business within the country.
Mastercard's own rules make clear that even where merchant checks are delegated to the PayFac, the acquirer retains responsibility if those checks aren't properly carried out. Securing explicit agreement with your acquirer on underwriting, disputes, reserves and reconciliation needs to happen before launch, as part of the commercial contract.
Ongoing compliance, risk and operational responsibilities
Approval is the start of the project, not the end of it. A PayFac's compliance obligations run continuously, and they scale with transaction volume and sub-merchant risk.
Sub-merchant lifecycle management
Every sub-merchant needs a full lifecycle process, not a one-off check:
- Verification of the business and its beneficial owners
- Assessment of the business model and expected transaction activity
- Risk-based approval decisions before go-live
- Continuous monitoring with periodic due-diligence refreshes as risk profiles change
A framework that scrutinises business models and viability before onboarding, rather than a tick-box form, catches problems earlier and cuts costly remediation later.
Financial operations and PCI DSS
Financial operations need to run like clockwork:
- Daily reconciliation
- Safeguarding or settlement controls
- Reserves or delayed payouts where justified
- Accurate fee calculations and clear sub-merchant statements
On the technology side, PCI DSS applies to any entity that stores, processes or transmits cardholder data, or that could affect the security of the cardholder data environment. That scope often covers more of a platform stack than founders expect, so plan for encryption, access controls, vulnerability management and secure software development.
Oversight that doesn't stop at launch
- Complaints and dispute handling, with attention to vulnerable customers
- Fair and transparent sub-merchant terms
- Data retention policies aligned with UK GDPR
- Regulatory returns and audit trails
- Ongoing engagement with the FCA and your acquiring bank
A practical warning: getting authorised or registered isn't the finish line. You need clear ownership across compliance, risk, finance, legal, operations and engineering, with documented monitoring and periodic control testing in day-to-day running.
Specialist regulatory and legal advisers are essential for FCA authorisation and card-scheme registration. VJM Global doesn't operate in that space; we're not an FCA licensing provider.
Where we add value for UK businesses is the broader back office: multi-market accounting, tax compliance and financial reporting. Where a UK PayFac also has operations or investment flows connected to India, that includes FEMA, FDI and ROC-related compliance support. Getting books, tax position and cross-border reporting right alongside the regulatory build-out matters as much as the licence itself.
Should your business become a full PayFac?
This decision comes down to a genuine trade-off, not a default answer.
The case for going full PayFac
- Greater control over sub-merchant onboarding and the payment experience
- A new, payments-related revenue stream
- Clearer platform differentiation against competitors
- Closer, stickier merchant relationships
The cost of that control
- Ongoing regulatory responsibility (FCA authorisation where applicable, safeguarding obligations, reporting)
- Operational risk sitting on your own balance sheet
- Reserves and working capital tied up in the payment flow
- Significant technical investment in monitoring, reconciliation and security
- A permanent compliance and risk function, not a project team
FCA application fees alone run to £5,640 for the broader category of payment activities, or £2,820 for a narrower set, with periodic fees charged on top every year. That's before you've built a single control.
A full PayFac model only makes commercial sense when payments are strategically central to your platform. You need enough transaction scale to justify the investment, and a permanent compliance and risk operation you can staff indefinitely, not just at launch.
Alternatives worth comparing
| Option | Speed to launch | Control | Compliance burden |
|---|---|---|---|
| Full registered PayFac | Slowest | Highest | Highest, permanent |
| PayFac-as-a-Service | Fast | Moderate | Mostly sits with provider |
| Sponsored PayFac | Moderate | Moderate | Shared with acquirer |
| Direct PSP integration | Fastest | Lowest | Minimal |
PayFac-as-a-Service models have a registered provider handle underwriting, risk and sub-merchant funding while your platform supplies the branded integration layer. You still earn transaction revenue without building the risk infrastructure from scratch.
Direct PSP integration goes further the other way: minimal build effort, but less control and thinner margins. None of these labels is a shortcut around regulation on its own. What matters is who holds the FCA permission and who carries the risk in the actual contract.
Wrapping Up
"Getting a PayFac licence" isn't a simple registration exercise, and treating it as one is how UK platforms end up with expensive rework six months into a build. The real work is determining:
- Which regulated activities you're actually performing
- How funds flow through your platform
- What your card scheme and acquirer require
- Exactly where responsibility sits between you and your partners
Before you invest in technology or submit any application, complete a proper UK regulatory perimeter assessment and business case review. Then seek qualified legal and regulatory advice specific to your model — this is not an area where generic guidance is good enough.
Frequently Asked Questions
How do I become a payment facilitator in the UK?
Start with a regulatory perimeter analysis of your funds flow, then pursue the relevant FCA authorisation or registration alongside acquiring and card-scheme relationships. Build compliance systems and sub-merchant underwriting before launch, and keep risk management ongoing.
Does a payment facilitator need an FCA licence in the UK?
It depends entirely on the regulated activities being performed and how funds flow through the business. Card-scheme registration or acquiring-bank sponsorship is not automatically a substitute for FCA authorisation: they answer different questions.
Is there a specific payment facilitator licence in the UK?
No. "PayFac licence" is commonly used as shorthand, but the applicable UK permission is usually authorisation as a payment institution, an e-money institution, or another regulated arrangement depending on your activities.
What is the difference between a payment facilitator and a payment processor?
A payment facilitator onboards and takes on risk responsibility for sub-merchants under a master merchant arrangement. A payment processor simply provides the transaction-processing infrastructure, without contracting directly with those sub-merchants.
What compliance controls does a UK payment facilitator need?
KYC, AML and sanctions screening, sub-merchant underwriting, continuous transaction monitoring, fraud prevention, chargeback management, PCI DSS compliance, safeguarding where applicable, and regular regulatory reporting all apply.
Can a UK business offer embedded payments without becoming a full PayFac?
Yes, through regulated PSP partnerships, sponsored PayFac arrangements, or PayFac-as-a-Service models. Confirm the partner's FCA permissions, the responsibility split, pricing, and how customer funds are actually held before signing anything.
