Fund Flow
How money moves from A to B. From COBO and POBO to cross-border clearing, this is the skeleton of payments.
COBO + POBO — collection and payment on behalf of others
COBO · Collection On Behalf Of
Company A collects money for Company B. Customer funds enter A's account, while the platform records the balance under B and transfers it periodically.
POBO · Payment On Behalf Of
Company A pays suppliers for Company B. Funds leave A's account, but the payment is made in B's business context.
Example: European retail treasury pool
German, French, and Polish subsidiaries collect customer payments into the UK headquarters account (COBO), while supplier payments are paid centrally by HQ (POBO). Benefits: lower bank fees, centralized FX hedging, and real-time group cash visibility.Crypto analogy: an exchange omnibus wallet receives many users' deposits into one on-chain address. Users see virtual balances, but the operating logic is COBO.
Clearing vs Settlement vs Netting
Transaction
->
Clearing
reconcile data and net positions
reconcile data and net positions
->
Settlement
money actually moves
money actually moves
->
T+0 / T+1 / T+2 arrival
Netting: if Bank A owes Bank B $10M and Bank B owes Bank A $8M, only $2M moves. Netting dramatically reduces system liquidity needs.
Float: funds that have been initiated but not yet arrived. Early PayPal earned interest from user float.
Escrow: a neutral third party holds funds and releases them when conditions are met. Smart contracts are the on-chain, trust-minimized version of escrow.
Crypto comparison
On-chain block production is settlement. There is no separate clearing layer and finality can be T+0. This is the strongest attack point for stablecoin payments: traditional cross-border transfers charge fees at each correspondent bank and create one to two days of float; stablecoins compress that into one chain transaction.Cross-border settlement systems quick reference
SWIFT
Society for Worldwide Interbank Financial Telecommunication
A cross-border bank messaging system using BIC identifiers. T+1 to T+5; each intermediary may charge fees.
RTGS
Real-Time Gross Settlement
Large-value payments settled one by one in real time, such as Fedwire or China's large-value payment system.
ACH
Automated Clearing House
US batch electronic transfers, usually T+1, suited for payroll and bill payments.
SEPA
Single Euro Payments Area
EU euro transfers use a common format and should not cost more than domestic euro transfers. Usually T+1.
FPS
Faster Payment System
The UK and Hong Kong both use this name for instant payment systems with second-level arrival.
BACS
Bankers' Automated Clearing Services
UK batch clearing for direct debit and payroll, typically T+3.
IBAN
International Bank Account Number
Standardized account number used in Europe and the Middle East, up to 34 characters.
Wire / TT
Wire Transfer / Telegraphic Transfer
Mostly synonymous. TT is more common in Asia and usually arrives same day or next day.
Nostro / Vostro
Correspondent bank accounts
Nostro is our account at another bank; Vostro is another bank's account with us.
Card Acquiring
There are at least five roles behind one card payment. Understanding this relationship map is the prerequisite for understanding the payments business model.
Complete card-payment chain, step by step
Example: a customer buys a $100 product on a Shopify independent store with a Visa credit card.
1
The user enters card number / CVV and clicks Pay. The browser sends encrypted card data to the gateway.
2
The gateway performs tokenization. It replaces the real card number with a token and routes the authorization request to the acquirer. It is a data pipe and does not touch funds.
3
The acquirer routes through the Visa network. The authorization request goes to the issuer through Visa's IP network, not SWIFT.
4
The issuer verifies the card. It checks balance, CVV, and fraud models, then freezes a $100 authorization hold. This is not a final debit. It takes about 1-3 seconds.
5
The authorization code returns along the same route. The user sees payment success, but funds are only reserved.
6
Capture: after fulfillment, the merchant formally submits the charge. If canceled before this point, the merchant sends a void.
7
Clearing: that night, Visa aggregates captures and nets what banks owe each other.
8
Settlement T+2: the issuer transfers net funds to the acquirer. After MDR, the merchant receives about $97-$98.
Fee structure: MDR = IC + Scheme fee + Markup
Core formula
MDR (Merchant Discount Rate) = IC (Interchange Fee) + Scheme fee + Acquirer Markup.Markup: the acquirer charges a margin above IC and scheme fees to cover operations, chargeback reserve, and sales commission.
Blended Rate
A packaged price such as Stripe 2.9% + $0.30. It is easy to understand, but actual cost varies by card type.
IC++
Actual interchange + scheme fees + a fixed markup. It is transparent and usually better for high-volume merchants.
Security and authentication
Tokenization
Card number -> random token
Merchants store tokens rather than raw PAN. Apple Pay and Google Pay are built on this logic.
3DS2
3-D Secure 2.0
Low-risk transactions pass frictionlessly; high-risk ones trigger SMS, app, or biometric challenge.
SCA
Strong Customer Authentication
PSD2 requires two factors from knowledge, possession, and inherence.
BIN / IIN
Issuer identification number
The first 6-8 digits identify issuer, card type, tier, and country.
AVS
Address Verification System
Checks billing address against issuer records. Common in US e-commerce.
CVV / CVC
Card security code
The three digits on the back of a card, or four digits on the front of Amex.
PCI DSS
Payment Card Industry Data Security Standard
Mandatory security standard for systems that touch cardholder data.
Chargeback flow
Cardholder complaint -> issuer freezes dispute -> acquirer notifies merchant -> merchant submits evidence within about 30 days -> scheme arbitration -> funds pulled back plus fees. If CBR exceeds 1%, card networks warn the merchant; above 2%, merchant eligibility can be terminated. RDR can refund before escalation so CBR does not rise.Trade Payments
Payment tools in international trade. Each tool is a different allocation of risk between buyer, seller, and bank.
LC / D/P / D/A comparison
| Tool | Full name | Payment timing | Risk owner | Best fit |
|---|---|---|---|---|
| LC | Letter of Credit | Bank pays when documents match | Bank guarantee, lowest risk | Large first deal where buyer credit is unknown |
| D/P | Documents against Payment | Buyer pays before receiving documents | Seller is relatively protected | Medium trust; seller wants faster cash recovery |
| D/A | Documents against Acceptance | Buyer accepts a bill, takes documents, pays later | Seller takes buyer credit risk | Powerful buyer or long-term relationship |
Why choose D/A?
D/A means the seller trades balance-sheet risk for market access. Buyers may demand D/A when they are large customers, goods are durable industrial products, FX controls require goods before payment, or long relationships rely on credit terms. D/A is a commercial strategy, not simply a fallback from D/P.Complete LC process, 7 steps
Key point: LC must be opened before shipment
The bank guarantees payment first, then the factory ships. It is not something requested after goods have shipped.1
Buyer and seller sign a contract and agree to settle by LC.
2
The buyer asks the issuing bank to open an LC. The bank reviews buyer credit and issues the LC.
3
The issuing bank sends the LC to the advising bank. The advising bank notifies the factory that the LC is in place.
4
The factory ships goods and obtains documents such as bill of lading, packing list, and invoice. It may also finance against the LC.
5
The factory submits documents to the advising bank for review against LC terms.
6
The advising bank claims from the issuing bank. The issuing bank pays if documents comply.
7
The buyer reimburses the issuing bank and uses the documents to take delivery.
Crypto RWA direction
If LC moves on-chain, a smart contract can arbitrate. Customs API data such as "goods cleared" can trigger automatic USDC release with T+0 settlement.Additional trade terms
Beneficiary
Payee
The final receiver of funds. In LC context, usually the exporter or seller.
Remitter
Sender
The sender of funds. Remitter data is core to AML screening in SWIFT messages.
Escrow
Third-party custody
Funds are held by a neutral party and released when contract conditions are met.
Remittance
Cross-border personal transfer
Often used for migrant worker transfers. Wise and Western Union focus on this market.
FX & Cross-Border
Understanding FX cost is central to cross-border payments. Many "zero fee" products hide profit inside the exchange-rate spread.
Mid-market Rate vs Spread: who has pricing power?
Core formula
User exchange rate = Mid-market Rate +/- SpreadInstitutional profit = Spread x FX amount
1
Traditional banks (0.5%-3%): Nostro account management and hedging cost matter, but the real reason is information opacity. Users do not know the true mid-market rate.
2
Wise / Airwallex (0.2%-0.6%): local matching lowers cost by maintaining local accounts and minimizing true cross-border fund movement.
3
CEX (0.1%-0.5%): deep order books and market makers reduce matching cost. Large OTC trades can negotiate lower spreads.
4
Stablecoins (near zero): cross-border "FX" becomes receiving USDC and off-ramping locally. If off-ramp markets are competitive, total cost can approach zero.
Source of pricing power: liquidity scale, information transparency, local fund matching, and regulatory compliance cost.
Virtual Account / Multi-currency / SAFE
Virtual Account
Sub-account under a bank master account
Each customer receives a local-looking account number; funds auto-reconcile into the master account. Crypto analogy: unique deposit addresses.
Multi-currency
One account with multiple currency balances
Balances can be held and converted internally. Crypto analogy: a CEX account holding BTC, ETH, and USDC.
SAFE
State Administration of Foreign Exchange
China's foreign-exchange regulator. SAFE compliance is the first gate for foreign companies collecting in China.
Crypto Payments
This is familiar territory for crypto operators, but payment context reveals different dimensions of the same terms.
On-ramp & Off-ramp and related licenses
On-ramp: fiat -> crypto
Buying USDC by card or bank transfer. Providers must handle payment routing, fraud, FX, and MDR cost.
Off-ramp: crypto -> fiat
A merchant receives USDC and converts it to local currency. This requires local bank accounts, KYC, AML, and clearing access.
Why does off-ramp require a license?
Off-ramp legally performs accepting crypto, exchanging it into fiat, and transferring fiat to a user account. That triggers MSB/MTL in the US, EMI/PI in Europe, or VASP rules in many jurisdictions.| License | Full name | Jurisdiction | Difficulty | Timeline |
|---|---|---|---|---|
| MTL | Money Transmitter License | US states | Very hard | 2-3 years, state by state |
| MSB | Money Services Business | US FinCEN | Relatively easy | 14-day registration; still needs MTL |
| VASP | Virtual Asset Service Provider | FATF framework | Medium | 3-12 months |
| MPI+DPT | Major Payment Institution + Digital Payment Token | Singapore MAS | Medium-high | 12-18 months |
| VATP | Virtual Asset Trading Platform | Hong Kong SFC | High | 12-24 months |
| EMI | Electronic Money Institution | EU central banks | Medium | 6-18 months |
Omnibus Wallet implementation logic
1
On-chain structure: the platform holds all user funds in one main address.
2
Off-chain ledger: the internal database records user balances. Internal transfers update the database and cost zero gas.
3
Deposit recognition: each user receives a unique deposit address, then funds are swept to the omnibus address.
4
Withdrawal: the platform sends an on-chain transaction from the omnibus wallet and deducts the internal balance.
!
Regulatory risk: MiCA and Hong Kong VATP emphasize client-asset segregation. Moving from omnibus to per-user addresses can multiply gas cost.
Cost comparison
For one million users with ten transfers each: omnibus may need about one million on-chain operations, while per-user addresses may need ten million. On Ethereum mainnet, the cost gap can be 10-100x.Travel Rule
FATF requires that when VASPs transfer above a threshold, usually around $1,000 in many countries, the sending VASP passes identity information to the receiving VASP. The challenge: on-chain transfers are address-to-address and do not naturally carry identity data.
| Protocol | Implementation logic | Main users |
|---|---|---|
| Notabene | VASP directory plus encrypted API; identity package is shared off-chain before broadcast. | Kraken, Bitfinex |
| Sygna Bridge | IVMS101 standard format and white-label SDK, strong APAC coverage. | APAC VASPs |
| OpenVASP | Open protocol using Ethereum ENS addressing and P2P connectivity. | European projects |
| VerifyVASP | Korea-led network integrated with Korean, Japanese, and Singaporean exchanges. | Upbit, Bithumb |
Crypto terms quick reference
OTC
Over The Counter
Large bilateral trades outside exchanges, often above $100k, without moving public order books.
DEX / CEX
Decentralized / Centralized exchange
DEX uses on-chain AMM and no custody; CEX requires KYC, custody, and regulation.
MPC
Multi-Party Computation
Private-key shares are split among parties and sign jointly. Preferred for institutional wallets.
TVL
Total Value Locked
Total assets locked in a DeFi protocol. In payments, high TVL means stronger settlement capacity.
RWA
Real World Assets
Tokenized traditional assets such as treasuries or letters of credit.
Bridge / Gas
Cross-chain bridge / network fee
Bridge moves assets across chains; gas cost determines small-payment feasibility.
Mint / Burn
Stablecoin issuance and redemption
$1 deposited -> 1 USDC minted; redemption burns 1 USDC and returns $1.
Crypto Cards
A product that inserts crypto assets into the traditional card-payment shell. The technology is mature; the bottleneck is compliance.
Essence and swipe moment, within roughly 200ms
A crypto card is a real-time off-ramp plus card-network product. The user holds crypto assets, while the merchant sees an ordinary Visa or Mastercard payment.
1
The user spends $5 at Starbucks. The POS sends an authorization request through Visa to the crypto card issuer.
2
The issuer system immediately deducts equivalent USDC or BTC from the user's crypto account.
3
The internal off-ramp engine converts USDC to USD and books it into the custodial fiat account.
4
The issuer returns approval to Visa. Starbucks receives a normal USD card payment and never sees crypto.
Pre-conversion vs real-time conversion
Pre-conversion model
Crypto is converted to fiat at top-up and stored in a custodial account.
Pros: fixed FX and simple UX.
Cons: user gives up upside while holding fiat.
Example: Crypto.com Card.
Pros: fixed FX and simple UX.
Cons: user gives up upside while holding fiat.
Example: Crypto.com Card.
Real-time conversion model
Assets remain crypto until the spend moment.
Pros: flexible exposure.
Cons: slippage and high technical complexity within 200ms.
Example: Wirex Card.
Pros: flexible exposure.
Cons: slippage and high technical complexity within 200ms.
Example: Wirex Card.
Three-layer compliance architecture
1
Card-network access through BIN sponsor: Visa/MC usually work through a licensed bank or EMI. Compliance responsibility ultimately sits with the sponsor bank.
2
Off-ramp license: real-time exchange plus remittance requires MSB/MTL in the US, EMI/PI in Europe, or equivalent VASP permissions.
3
Dual KYC/AML and tax risk: one KYC journey must satisfy both card/bank rules and VASP rules. Each crypto-to-fiat spend may be a taxable event in some jurisdictions.
Core bottleneck
The hard parts are BIN sponsor banking relationships, license acquisition time and cost, continuous on-chain AML monitoring, and jurisdiction-specific tax treatment.Main crypto card project license paths
| Project | BIN sponsor | Core licenses | Market coverage |
|---|---|---|---|
| Crypto.com Visa | Sutton Bank in the US | Lithuania EMI, Singapore MPI | US, EU, Singapore, Australia |
| Wirex | Partner licensed banks | UK FCA EMI, EU passporting | UK, EU, some US states |
| Binance Card | Moorwand licensed EMI | Europe through BIN sponsor; US restricted | Mainly Europe |
| Coinbase Card | Sutton Bank in the US | BitLicense, state MTLs | US, UK |
Compliance
These acronyms are familiar to crypto operators, but payments context adds important differences.
KYC / KYB / KYT three-layer verification system
KYC
Know Your Customer
Personal verification: passport, selfie, address proof. Higher tiers require stronger checks.
KYB
Know Your Business
Company verification: registration, UBO look-through, bank statement, sanctions checks.
KYT
Know Your Transaction
Real-time transaction monitoring using tools such as Chainalysis or Elliptic.
CDD / EDD
Due diligence levels
CDD is standard review; EDD is deeper review for PEPs, high-risk countries, or large values.
PEP
Politically Exposed Person
Important public officials and close associates. Often triggers EDD or rejection.
UBO
Ultimate Beneficial Owner
Natural person who controls the company or owns 25%+ equity.
SOF / SOW
Source of Funds / Wealth
SOF asks where this money came from; SOW asks how the total wealth was built.
AML / CTF
Anti-Money Laundering / Counter-Terrorism Financing
The core compliance operating obligation for payment institutions.
STR / SAR
Suspicious Transaction / Activity Report
Suspicious activity is reported to regulators, and customers cannot be tipped off.
FATF
Financial Action Task Force
Global AML/CFT standard setter; grey-listing creates financial isolation pressure.
Sanctions screening
OFAC / EU / UN list screening
Checks whether counterparties or addresses appear on sanctions lists.
Major regulators
| Agency | Full name | Jurisdiction | Role |
|---|---|---|---|
| FinCEN | Financial Crimes Enforcement Network | US | MSB registration, SAR collection, AML oversight |
| OFAC | Office of Foreign Assets Control | US | SDN sanctions list and economic sanctions enforcement |
| MAS | Monetary Authority of Singapore | Singapore | Central bank and financial regulator; MPI/DPT licenses |
| SFC | Securities and Futures Commission | Hong Kong | VATP license and securities/futures supervision |
| HKMA | Hong Kong Monetary Authority | Hong Kong | Banking, SVF license, stablecoin issuance |
| SAFE | State Administration of Foreign Exchange | China | FX control and cross-border RMB settlement |
License Map
Different markets require different licenses for payment operations. Use the map and tables to understand regional license stacks.
US / Canada
Latin America
Europe
APAC
Middle East
Africa
Click a country or legend area to review regional license details
License quick tables
Americas
| License | Full name | Authority | Key point |
|---|---|---|---|
| MTL | Money Transmitter License | US states | 48 states + DC, 2-3 years, multi-million cost |
| MSB | Money Services Business | FinCEN | 14-day registration, still requires state MTL |
| BitLicense | - | NYDFS | Strictest US crypto license, 2-3 year approval |
| Brazil PSP | Payment Service Provider | BCB | Open banking and Pix real-time payments |
| Mexico PSSP | Payment Service Provider / Institution | CNBV | 2018 Fintech Law framework |
Europe
| License | Full name | Authority | Key point |
|---|---|---|---|
| EMI | Electronic Money Institution | National central banks / EBA | Passport to 27 EU states, EUR350k capital |
| PI | Payment Institution | National central banks | Payment services only, EUR125k capital |
| AISP/PISP | Account / Payment Initiation Service Provider | PSD2 | Lowest threshold for account info and payment initiation |
| MiCA CASP | Crypto-Asset Service Provider | EU MiCA | Unified EU crypto regulation with passporting |
APAC
| License | Full name | Authority | Key point |
|---|---|---|---|
| MPI+DPT | Major Payment Institution + Digital Payment Token | Singapore MAS | No payment-volume cap; Asian benchmark |
| VATP | Virtual Asset Trading Platform | Hong Kong SFC | Effective June 2023; HK$5M capital |
| SVF | Stored Value Facility | Hong Kong HKMA | Octopus / Alipay HK license type; stablecoin prerequisite |
| SEA PSP | Payment Service Provider | Local central banks | Indonesia OJK, Philippines BSP, Thailand BOT; often foreign ownership limits |
Middle East & Africa
| License | Full name | Authority | Key point |
|---|---|---|---|
| Dubai VASP | Virtual Asset Service Provider License | VARA | Founded in 2022, relatively friendly approval |
| ADGM FSRA | Financial Services Regulatory Authority | ADGM | Institutional business and Web3 funds |
| Nigeria PSO | Payment Service Operator | CBN | Core market for Flutterwave and Paystack |
| Kenya PSP | Payment Service Provider | CBK | M-Pesa birthplace and advanced mobile payments |
Stablecoin Project Licenses
Licenses are the core compliance moat for stablecoin payment projects. More jurisdictions mean broader market access.
| Project | Core licenses | Key timeline | Core edge |
|---|---|---|---|
| Circle (USDC) | US state MTLs, MSB, France ACPR EMI, Singapore MPI | MTLs 2015-2021; EU EMI 2023 | Most compliance-forward USDC issuer with treasury reserves and monthly attestations |
| Tether (USDT) | El Salvador digital asset service provider; avoids US MSB posture | El Salvador 2024 | Deepest liquidity, but reserve-transparency concerns remain |
| Stripe / Bridge | US MSB + MTL stack, Ireland EMI, Bridge MTLs | EU EMI 2022 | Strongest distribution through Stripe's merchant ecosystem |
| Ripple (RLUSD) | NYDFS BitLicense, Singapore MPI, UAE ADGM FSRA, UK FCA | BitLicense Dec 2023 | Institutional signal from NYDFS and XRP clearing network |
| PayPal (PYUSD) | NYDFS BitLicense plus PayPal US MTL stack | BitLicense Aug 2023 | 400M user base and large financial institution trust |
| Paxos | NYDFS BitLicense and trust charter, Singapore MPI, UAE ADGM | BitLicense 2015 | Earliest BitLicense; shifted toward institutional white-label business |
| Coinbase | BitLicense, state MTLs + MSB, Singapore MPI + DPT | BitLicense 2017 | Circle partner and listed-company institutional entry point |
| Alchemy Pay | US MSB, Lithuania EMI, Canada FINTRAC MSB, Australia AUSTRAC | Lithuania EMI 2023 | Focused on on/off-ramp with fiat rails across 200+ countries |
License competitiveness
Full US MTL coverage ($10M+ cost) creates a high barrier. EU EMI passports to 27 countries and is highly cost-effective. NYDFS BitLicense is globally strict and trusted by institutions. MAS MPI + DPT is the Asian benchmark and a signal for Hong Kong and Japan.Institutional Role Map
At least five roles participate behind one card transaction, each with a clear profit model and risk boundary.
Hierarchy diagram
Main role path: solid lines show the core card-payment path; dashed lines show ISO sales and processor support relationships.
Issuer earns interchange; Scheme earns network fees; Acquirer / PSP earns markup.
Complete role descriptions
Cardholder
Payment initiator
Can initiate chargeback through issuer; comparable to a private-key holder, but with bank protection.
Gateway
Data pipe
Encrypts card data, tokenizes, and routes authorization requests. It does not touch funds.
PSP / PayFac
One-stop payment access
Combines gateway and acquiring access. PayFac can onboard submerchants quickly and takes more risk.
MoR
Merchant of Record
The legal seller responsible for tax, refunds, and PCI obligations. Examples: Paddle, FastSpring.
Acquirer
Acquiring bank
Signs the merchant agreement, submits auth, joins clearing, and settles to merchant.
Scheme
Card network
Sets rules, routes authorization, calculates clearing net positions, and manages brand trust.
Issuer
Issuing bank
Issues cards, approves authorization, owns cardholder relationship, and earns interchange.
ISO
Independent Sales Organization
Sells merchant accounts for acquirers and earns residual revenue without taking fund risk.
Processor
Technical processing operator
Handles authorization, clearing files, settlement files, and reporting.
VASP
Virtual Asset Service Provider
CEX, OTC desk, custodian, or stablecoin payment provider under FATF framework.
POS / mPOS
Point of Sale / Mobile POS
Physical terminal, phone reader, or SoftPOS accepting NFC or card-present payments.
Fee ownership summary
Every card payment's MDR splits into interchange for the issuer, scheme fee for the network, and markup for the acquirer / PSP. The merchant pays all MDR, and consumers usually experience it only through product pricing.Transaction Lifecycle
From authorization to settlement, each phase happens at a different point in time, and processing cost plus reversal difficulty increases along the path.
Overview
Auth
->
Capture
->
Clearing
->
Settlement
<->
Void
or
Refund
Auth — Authorization
The issuer verifies that the account can pay and reserves a hold. It is not a real debit. Validity is often seven days.
Pre-auth
Authorize an estimated amount first and adjust the final capture later. Hotels and gas stations are classic examples. Capture can be lower than auth, but not higher without a new authorization.
Capture — submit for payment
After goods ship or service completes, the merchant formally initiates fund movement. It normally must happen before the authorization expires.
Full Capture
The most common flow: capture the full authorized amount once.
Partial Capture
Capture only part of the authorized amount, often for split shipments; the remaining hold is released.
Void vs Refund
Void
Before capture: cancel the authorization, release funds, no fund movement, usually no fee, no CBR impact.
Refund
After settlement: initiate reverse fund movement. Original route, T+3 to T+5, plus per-transaction fee.
ARN: Acquirer Reference Number, a unique tracking number used by banks to locate a refund.
Recurring — subscription payments
The cardholder authorizes the merchant to charge periodically. The cardholder is the authorization subject; the merchant executes.
CIT · Cardholder-Initiated Transaction
Cardholder is present and triggers the payment; 3DS/SCA may apply.
MIT · Merchant-Initiated Transaction
Cardholder is absent; merchant charges using a mandate. More liability sits with merchant/acquirer.
1
Initial CIT: user starts the subscription, enters card details, triggers 3DS, and creates a mandate.
2
Subsequent MIT: monthly auto-charge attaches MIT flag and mandate ID, often skipping 3DS.
!
Chargeback risk: "I do not remember authorizing this." Merchants must preserve original mandate evidence.
Dunning: when MIT fails, retry strategy matters. Excessive retrying can trigger fraud signals; Stripe Billing and Chargebee include dunning engines.
Four PCI DSS compliance levels
Level 1over 6M transactions/year
Annual QSA onsite audit. Any business with a breach may be forced into Level 1.
Level 21M-6M
SAQ plus QSA/ISA sign-off and quarterly ASV scans.
Level 320k-1M e-commerce
SAQ and quarterly scans; no onsite audit.
Level 4under 20k
Simplest SAQ; hosted checkout can reduce scope close to zero.
Why Stripe Checkout can reduce PCI scope to SAQ-A
Card data goes directly from the cardholder browser to Stripe. The merchant server never sees card data, so compliance scope is dramatically reduced compared with storing cards in-house.Business Metrics
These metrics are common in payments and crypto, but payment context changes the details.
Core metric relationship
TPV
x
Take Rate
=
Net Revenue
GMV vs TPV: platform vs payment system
GMV · Gross Merchandise Volume
Total value of goods or services traded on a platform, including all payment methods.
TPV · Total Payment Volume
The portion processed by the platform's own payment system. Transactions outside the payment stack do not count.
Example: Shopify GMV vs TPV
Shopify's GMV is hundreds of billions of dollars, but TPV through Shopify Payments is only part of GMV. Many merchants use Stripe or PayPal, so Shopify does not capture payment revenue there. Investors use TPV for payment companies and GMV for commerce platforms. Typical take rate: Stripe around 2.9% blended; Adyen around 0.3%-0.5% IC++.Full metric quick reference
TPV
Total Payment Volume
Actual payment amount processed by the platform; core valuation base for payment companies.
GMV
Gross Merchandise Volume
Total commerce value on a platform, including all payment methods.
Take Rate
Revenue / TPV
Usually 0.5%-3%; higher means more pricing power or value-added services.
NRR
Net Revenue Retention
Above 100% means expansion; payment companies often have high NRR because migration cost is high.
LTV / CAC
Lifetime Value / Customer Acquisition Cost
LTV/CAC above 3 is generally healthy.
MRR / ARR
Monthly / Annual Recurring Revenue
ARR = MRR x 12. Fixed monthly fees count here; TPV-linked fees are variable.
ARPU
Average Revenue Per User
Total revenue divided by active users; common for consumer platforms.
PEPM
Per Employee Per Month
Pricing model for HR or corporate card products; revenue expands as the enterprise grows.