Most enterprise CFOs make a reasonable assumption when selecting a payment provider: the company they are contracting with holds the regulatory licences it advertises. In most cases, that assumption is wrong. Not because providers are dishonest, but because the payment industry uses words like 'regulated' and 'licensed' interchangeably, when they describe very different legal and operational realities.

The distinction matters far more than most finance teams realise, and the consequences of getting it wrong range from operational disruption to shared liability for compliance failures you had no visibility over.

This article unpacks the three models that dominate the payment provider market, the specific risks attached to each, and the five questions any CFO should ask before signing with a new payment partner. It also explains what a genuinely direct licence structure looks like, and why it changes the risk calculus for enterprise merchants operating across borders.

The word 'regulated' appears in almost every payment provider's marketing materials. What it usually means is that the provider operates within a regulated framework. What it does not necessarily mean is that the provider holds the licence in its own legal name.

Three models currently exist in the market:

Model 1 - Direct licence holder: The provider's own legal entity holds the FCA, MAS, MSB, or equivalent licence. The provider is directly accountable to the regulator. Its compliance obligations, capital requirements, and reporting duties sit entirely within its own structure.

Model 2 - Authorised representative: The provider operates under another firm's licence as an appointed agent. This is a common and entirely legal arrangement, but it means the provider's ability to operate depends entirely on the continuation of its relationship with the sponsoring firm.

Model 3 - Unlicensed intermediary: Common in less-regulated jurisdictions, these providers often describe themselves as 'technology companies' that facilitate payments. They operate without formal authorisation from a recognised financial regulator.

For enterprise businesses processing significant transaction volumes across multiple markets, only Model 1 provides the institutional protection that matches the scale of exposure. Models 2 and 3 transfer risk back to the merchant in ways that are rarely explained clearly at the contract stage.

The agent-of-agent structure is not widely discussed in commercial payment sales conversations. That absence is itself a risk signal. Here is what it means in practice.

When a provider operates as an authorised representative under a sponsoring institution's licence, its right to process payments can be withdrawn at any time. The trigger may be a regulatory action against the sponsor, a commercial disagreement, or the sponsor's insolvency.

The result is immediate. Your transactions do not fail gracefully or migrate automatically. They stop. Customers cannot pay. Settlements do not arrive. Refunds queue behind a dispute you have no standing to resolve. The operational impact is uncontrollable from the merchant's side, and it can materialise with no advance notice.

This is not a theoretical scenario. Regulatory actions against payment institutions have disrupted thousands of merchants simultaneously when sponsoring firms have lost their authorisations or had them suspended.

Authorised representatives do not hold principal membership of Visa or Mastercard. They process through the licence holder's membership, at the licence holder's negotiated interchange rates, and subject to the licence holder's standing with the schemes.

This creates a two-step removal from the infrastructure you are paying to use. It limits your ability to negotiate rates directly, access new payment methods as they are introduced by the schemes, or escalate disputes to scheme level without going through an intermediary that may not prioritise your case.

For enterprise businesses processing at scale, the commercial cost of indirect scheme access compounds across every basis point of interchange, every disputed transaction, and every new market where your provider's scheme relationships do not extend cleanly.

In agent arrangements, AML and KYC obligations are formally shared between the licence holder and the agent. In practice, enforcement liability often flows back to the merchant for how its own customers transact.

Enterprise businesses in regulated sectors face additional layers of exposure here. Financial services firms, gaming operators, and travel companies all carry their own regulatory obligations around customer due diligence. An agent-level provider may not have the compliance depth, the documented processes, or the dedicated compliance resource to support your own regulatory position when a regulator looks at your payment chain.

The question is not just whether your provider is compliant. It is whether your provider can demonstrate, under examination, that it has the same compliance standards you would apply to your own operations.

A sophisticated CFO evaluating payment providers should be able to get clear answers to the following five questions. A provider that holds direct licences will answer all five without hesitation. A provider operating at agent level will struggle with at least two of them.

These questions are not a compliance audit. They are the baseline level of due diligence that any finance leader with cross-border payment exposure should apply before committing to a payment relationship. If your current provider cannot answer them clearly, that is information worth having before your next contract renewal.

ONERWAY holds its licences in its own legal name, across multiple jurisdictions, without relying on a sponsoring institution. This is not a marketing claim. The licences are publicly verifiable with the relevant regulators.

Beyond the licence structure, ONERWAY holds principal membership of both Visa and Mastercard. That means direct scheme relationships, direct rate access, and direct accountability for scheme compliance without any intermediary layer between the merchant and the network.

Enterprise clients also have direct access to ONERWAY's compliance team. Not a ticket queue or a help centre article. A compliance team that can engage with the specifics of a merchant's own regulatory obligations and provide the documentary evidence that enterprise risk functions require.

The position ONERWAY takes with enterprise clients is straightforward: we are infrastructure, not middleware. The licences are ONERWAY's. The scheme relationships are ONERWAY's. The accountability is ONERWAY's. That structure does not change depending on which market a merchant operates in or how transaction volumes shift.

For CFOs evaluating payment infrastructure, the question is not which provider has the best rate sheet or the most payment methods listed in a product brochure. The question is which provider's licence structure you would be comfortable explaining to your own board, your own compliance team, and - if it comes to it - your own regulator.

For more detail on ONERWAY's cross-border payment infrastructure, see ONERWAY Solutions and About ONERWAY.

The payment industry has a terminology problem. 'Regulated' and 'licensed' are used interchangeably in sales materials, but they describe fundamentally different risk positions for the merchants who rely on that infrastructure every day.

A provider that holds direct licences, principal scheme membership, and in-house compliance capability is not just a better commercial choice. It is a structurally different partner. The licences are not contingent on a third party. The rate access is not filtered through an intermediary. The compliance support is not outsourced to a ticketing system.

ONERWAY's approach to enterprise payment infrastructure is built on that direct model. If any of the risks described in this article reflect a question your business is currently navigating, our team welcomes a direct conversation.

An authorised representative arrangement means a payment provider operates under another firm's regulatory licence as an appointed agent rather than holding its own licence. While this is a legal structure, it creates a dependency: if the sponsoring firm loses or suspends its licence, the agent's ability to process payments stops immediately. For enterprise merchants, this represents an operational and continuity risk that a direct licence structure avoids entirely.

You can search the FCA Financial Services Register at register.fca.org.uk using the provider's legal entity name or their stated FCA reference number. A direct licence holder will appear as the authorised firm itself. If your provider appears only as an appointed representative under another firm's entry, they are operating under that firm's licence, not their own.

'Regulated' means a provider operates within a regulated framework, but not necessarily that it holds the relevant licence in its own name. 'Licensed' in the context of a direct payment service provider licence means the provider's own legal entity is the authorised firm on the regulator's register. The distinction matters because only the direct licence holder carries the full accountability, capital requirements, and compliance obligations that come with authorisation.

In agent-level arrangements, AML and KYC obligations are formally shared, but enforcement liability for how transactions are processed can extend to the merchant, particularly in regulated sectors. If your payment provider's compliance framework is insufficient and a regulator examines your transaction chain, your business may be required to demonstrate due diligence over the providers you selected. Choosing a direct licence holder with documented compliance processes materially reduces this exposure.

Principal membership of Visa and Mastercard means the provider holds a direct contractual relationship with the schemes, processes under its own BIN, and negotiates rates at the scheme level. Providers without principal membership process through a third party's membership, at that third party's rates, and without independent standing to escalate disputes. For enterprise merchants, this affects rate transparency, scheme-level dispute resolution, and the provider's ability to access new payment methods as they are rolled out by the schemes.

ONERWAY holds direct regulatory licences in 12+ jurisdictions and principal Visa and Mastercard membership, giving enterprise businesses the institutional foundation they should expect from a payment partner. Request a platform compliance review to see how your current provider's credentials compare.