Payments glossary

Short definitions of the terms used across Payments30. Where a term has its own guide or explainer, we link to it.

A to C

3-D Secure (3DS). A protocol that lets the card issuer check that the person paying online is the cardholder, usually through an app or one-time code. It is the main tool for strong customer authentication on card payments in Europe.

Account-to-account (A2A) payment. A payment that moves money directly from the payer's bank account to the payee's, without a card network. Open banking payment initiation is one common way to start one. See open banking payments explained.

Account information service provider (AISP). A regulated firm that, with the customer's consent, reads data from their payment accounts at other providers.

Acquirer. The bank or licensed institution that contracts with a merchant to accept card payments and settles the money into the merchant's account. See payment gateway vs PSP vs acquirer.

Alternative payment method (APM). Any way to pay that is not a traditional card payment, for example digital wallets, bank transfer schemes, buy now pay later and local methods such as iDEAL, Pix or BLIK. See alternative payment methods explained.

Authorisation. The real-time step in which the issuer approves or declines a card transaction and reserves the funds.

Buy now, pay later (BNPL). Short-term credit at the checkout that lets a shopper split a purchase into instalments.

CASP. Crypto-asset service provider: a firm authorised under the EU's MiCA regulation to provide services such as custody, exchange or transfer of crypto-assets. See MiCA explained.

CFD (contract for difference). A leveraged derivative that pays the difference in an asset's price between opening and closing a position, without owning the asset. Most retail CFD accounts lose money.

Chargeback. A reversal of a card payment initiated by the cardholder's issuer under card scheme rules, usually after a dispute.

Clearing. The exchange of transaction details between acquirer and issuer through the card scheme, so that each side knows what it owes. It comes before settlement.

Clone firm. A fraudulent operation that copies the name, address or registration details of a genuinely authorised firm. Regulators publish warnings about them. See how to check a financial licence.

CySEC. The Cyprus Securities and Exchange Commission, which authorises and supervises investment firms in Cyprus, including many retail brokers. See CySEC explained.

D to I

DORA. The EU Digital Operational Resilience Act, which sets rules on ICT risk management, incident reporting, testing and third-party risk for financial entities. See DORA explained.

E-money institution (EMI). A firm authorised to issue electronic money and provide payment services, without being a bank. Customer funds must be safeguarded rather than lent out.

Gateway (payment gateway). The technology that securely passes payment details from a website or app to the acquirer or processor and returns the result.

Interchange fee. A fee paid by the acquirer to the issuer on each card transaction. In the EU, consumer card interchange is capped by the Interchange Fee Regulation.

Issuer. The bank or licensed institution that provides the card to the cardholder and approves or declines transactions.

L to P

Leverage. Borrowed exposure that magnifies both gains and losses on a trading position. Retail leverage on CFDs is capped in the EU and UK.

Merchant account. An account with an acquirer that lets a business accept card payments.

Merchant category code (MCC). A four-digit code that classifies a merchant's type of business for card scheme rules, pricing and risk.

MiCA. The EU Markets in Crypto-Assets Regulation, which sets authorisation and conduct rules for crypto-asset service providers and issuers of stablecoins. See MiCA explained.

Negative balance protection. A rule that stops a retail CFD client from losing more than the money in their trading account.

Open banking. Regulated access, with the customer's consent, to bank account data and payment initiation through secure interfaces. See open banking payments explained.

Passporting. Using an authorisation from one EU or EEA country to provide services in others.

Payment initiation service provider (PISP). A regulated firm that starts a payment from a customer's bank account at another provider, with the customer's consent.

Payment institution (PI). A firm authorised to provide payment services, such as money remittance or merchant acquiring, without issuing e-money or taking deposits.

Payment orchestration. Software that routes transactions across several PSPs and acquirers from one integration.

Payment service provider (PSP). A company that lets merchants accept payments, often bundling gateway, processing, acquiring and payment methods in one contract.

PSD2, PSD3 and PSR. The EU's second Payment Services Directive, and its proposed successors: a third directive and a directly applicable Payment Services Regulation. See PSD3 and the PSR.

R to Z

Retail investor account loss figure. The percentage of a broker's retail CFD accounts that lost money over a recent period. EU and UK rules require brokers to publish it in their risk warning.

Rolling reserve. A share of a merchant's settlements that an acquirer or PSP holds back for a period to cover chargebacks and refunds.

Safeguarding. The legal duty of payment and e-money institutions to keep customer funds separate from their own and protect them if the firm fails.

Settlement. The actual transfer of funds between issuer, scheme, acquirer and merchant after clearing.

Stablecoin. A crypto-asset designed to hold a stable value against a currency or asset. MiCA calls them e-money tokens or asset-referenced tokens.

Strong customer authentication (SCA). The EU and UK requirement to verify a payer using at least two independent factors: something you know, have or are.

Tokenisation. Replacing a card number with a substitute value (a token) so the real number is not exposed when payments are stored or processed.

VARA. Dubai's Virtual Assets Regulatory Authority, which licenses virtual asset service providers in Dubai outside the DIFC.

Warning list. A regulator's public list of firms that are not authorised, or that it has concerns about. Check it before dealing with any firm. See how to check a financial licence.