Payments glossary

Authorization is the real-time check that confirms a payment can proceed — the issuer approves or declines the request and, on approval, sets aside the funds. No money moves at this step; it only reserves the amount and returns an approval code. A successful authorization is a promise to pay, not the payment itself.

Capture is the step that turns an approved authorization into an actual charge, telling the issuer to move the reserved funds. It can happen immediately after authorization or later — for example when goods ship — up to the authorization's expiry. Capturing less than the authorized amount (a partial capture) releases the remainder back to the cardholder.

Clearing is the exchange of transaction records between the acquirer and the issuer that determines who owes whom, before any money moves. It nets the day's captured transactions into the amounts each party will settle. Clearing establishes the obligation; settlement discharges it.

Settlement is the movement of funds that discharges the obligations established during clearing — the point at which money actually changes hands between banks. For card payments this usually lands a day or more after the purchase; on instant rails and on-chain it can be near real time. Until settlement completes, a captured payment is a receivable, not cash.

Interchange is the fee the acquirer pays the issuer on every card transaction, set by the card networks and typically passed on to the merchant. It is the largest component of most card-acceptance costs and varies by card type, region, and how the transaction is presented. Interchange rewards the issuer for taking on the cardholder relationship and credit risk.

Reconciliation is the process of matching what you expected to be paid against what actually settled, line by line, so every cent is accounted for. It compares your own records to processor reports, bank statements, and scheme files, flagging fees, timing gaps, and mismatches. Without reconciliation, fees and failed payouts hide in the gap between authorization and cash.

A payout is the transfer of settled funds out to a merchant, seller, or end user — the outbound leg of a payments platform. Payouts can be scheduled (a daily or weekly sweep) or on-demand, and each carries its own rail, timing, and fees. The payout is where a collected payment finally becomes usable money in someone's account.

A batch is a group of transactions submitted or settled together rather than one at a time, usually closed at the end of a business day. Merchants batch captures for clearing; banks batch payouts and direct debits into scheduled runs. Batching trades immediacy for efficiency and predictable settlement windows.

An acquirer is the bank or licensed institution that lets a merchant accept card payments and receives the funds on their behalf. It connects the merchant to the card networks, takes on settlement risk, and is ultimately liable for chargebacks. The acquirer sits on the merchant side of every card transaction, opposite the issuer.

An issuer is the bank or institution that gives a cardholder their card and account, and that approves or declines each transaction. It funds the purchase at authorization, bills the cardholder, and pays the acquirer through the network. Every card transaction runs between an issuer and an acquirer.

A payment gateway is the software layer that captures payment details at checkout and routes them securely to the processor and card networks. It handles the customer-facing moment — the payment page, encryption, and the authorization request — then returns an approval or decline. A gateway moves the message; it does not itself hold or move the money.

A payment processor is the service that carries a transaction between the merchant's acquirer and the customer's issuer, handling authorization, clearing, and settlement. It translates the merchant's request into network messages and relays the response back. The gateway is the front door; the processor is the machinery behind it.

A payment service provider (PSP) bundles the gateway, processing, and often acquiring into one service so a merchant can accept payments without contracting each piece separately. PSPs typically onboard merchants under their own acquiring relationship and settle funds on to them. The trade is convenience for a share of control over routing and settlement.

The merchant of record (MoR) is the legal entity responsible for a sale — it appears on the customer's statement, collects the payment, remits tax, and owns the liability for refunds and chargebacks. Using a merchant-of-record provider lets a business sell in markets where it holds no local entity. The MoR carries the compliance and financial responsibility for each transaction.

A chargeback is a forced reversal of a card payment initiated by the cardholder's issuer, usually after a dispute over fraud, non-delivery, or a billing error. The funds are pulled back from the merchant and returned to the cardholder while the claim is examined. Chargebacks carry fees and, at volume, network penalties, which is why prevention beats defense.

A refund is a new transaction that returns funds to the customer after a payment has settled, appearing separately on their statement. A reversal cancels an authorization or capture before it settles, so the original charge never fully lands. Reverse when you can (it's faster and cheaper); refund when the money has already moved.

3-D Secure (3DS) is the protocol that adds an authentication step — a bank prompt, biometric, or one-time code — between a card entry and its authorization to prove the shopper is the genuine cardholder. It is the common way to satisfy Strong Customer Authentication (SCA), the two-factor requirement for many online payments in Europe. Passing 3DS also shifts fraud liability from the merchant to the issuer.

Tokenization replaces a sensitive card number with a surrogate value — a token — that is useless if stolen and can be safely stored or reused. The real number stays in a secured vault; the token stands in for it during future charges. It shrinks the systems that touch raw card data, cutting both breach exposure and compliance scope.

Card issuing is the business of creating and running payment cards — virtual or physical — tied to accounts you control, and approving the transactions made on them. A modern issuing platform lets a company spin up cards by API, set spend rules, and authorize in real time against its own ledger. Issuing turns a balance into a card someone can actually spend.

A prepaid card spends a balance loaded onto the card itself, independent of any bank account, while a debit card draws directly from a linked account. Prepaid caps spending at the loaded amount and is easy to issue without a full banking relationship; debit ties every transaction to an underlying account balance. Both authorize against available funds rather than a credit line.

The BIN (Bank Identification Number) is the first six to eight digits of a card number, identifying the issuer, card network, country, and product type. Networks and acquirers use the BIN to route a transaction to the right issuer and to apply the correct rules and fees. It is how a payment knows which bank to ask for approval.

The PAN (Primary Account Number) is the full card number embossed or printed on a card — typically 16 digits — that identifies the account to the network. It is the sensitive value tokenization and encryption exist to protect, and its exposure defines much of PCI scope. The PAN's leading digits are the BIN; the last digit is a checksum.

EMV is the global chip-card standard that authenticates a card cryptographically at the point of sale, replacing the easily-cloned magnetic stripe. Each transaction generates a unique cryptogram the issuer can verify, making counterfeit cards far harder to use. EMV also governs contactless and mobile-wallet card presentment.

Contactless payment lets a card or phone pay by tapping near a terminal, using NFC (Near Field Communication) to exchange an EMV cryptogram over a few centimeters. It carries the same chip-level security as an inserted card, with the transaction authorized in the same way. Phones add device biometrics on top, which is why tap-to-pay often skips a PIN.

The point of sale (PoS) is where a customer completes a purchase in person — the terminal or software that reads the card, builds the transaction, and requests authorization. Modern PoS ranges from a countertop terminal to a phone accepting taps directly. It is the physical-world entry point into the same authorization-to-settlement flow as an online checkout.

An IBAN (International Bank Account Number) is the standardized account identifier used to route bank transfers across Europe and much of the world. It encodes the country, bank, and account in a single string with a checksum that catches typos before a payment is sent. An IBAN names where money should land; it does not by itself say who owns the account.

A virtual IBAN (vIBAN) is a real, routable IBAN issued on top of a single underlying account so that funds can be received and automatically attributed to a specific customer, order, or purpose. Incoming transfers to a vIBAN reconcile themselves — you know who paid the moment the money lands, without matching by reference. Virtual IBANs give a platform per-user account numbers without opening a bank account for each user.

A BIC (Bank Identifier Code), also called a SWIFT code, identifies a specific bank in international transfers — the counterpart to the IBAN that names the account. Where the IBAN says which account, the BIC says which institution and, over the SWIFT network, how to reach it. Within SEPA the IBAN alone is usually enough, so the BIC is often optional.

SEPA (the Single Euro Payments Area) is the scheme that makes euro bank transfers between participating countries work like domestic ones — same format, same rules, no premium for crossing a border. It covers standard credit transfers and direct debits, settled in batches over a day or more. SEPA is why an IBAN-to-IBAN euro payment across Europe is routine and cheap.

SEPA Instant (SCT Inst) is the real-time version of a SEPA credit transfer, moving euros between accounts in seconds, any hour of any day. The funds are final and available immediately, unlike standard SEPA which settles in batches. It brings account-to-account payments close to the speed of a card tap, without a card network in the middle.

An on-ramp is the path from conventional money into crypto — a user pays with a card or bank transfer and receives digital assets in a wallet. It handles the fiat collection, the identity checks, and the conversion in one flow. The on-ramp is where a payments problem (accepting money) meets a blockchain problem (delivering an asset).

An off-ramp is the reverse path — converting crypto back into conventional money and paying it out to a bank account. It sells or redeems the asset, runs the compliance checks on the withdrawal, and settles the resulting funds over a normal payment rail. Together, on- and off-ramps let a product move value in and out of crypto without the user touching an exchange.

A stablecoin is a crypto token designed to hold a steady value by tracking a reference such as a national currency, typically backed by reserves held against it. Because its value is stable, it can act as a settlement medium — moving value on-chain without the price swings of other crypto assets. Stablecoins let money settle with blockchain speed while staying denominated in familiar units.

On-chain settlement is the discharge of a payment obligation by moving value on a blockchain, where the transfer is recorded and final without a bank in the middle. It can settle in seconds, around the clock, and the ledger itself is the proof of payment. In practice it is most useful when the value can end back in a bank account — an on-chain transfer that resolves to an IBAN.

Custody means a third party holds the private keys to your crypto and is responsible for safeguarding it; self-custody means you hold your own keys and bear that responsibility yourself. Custody trades control for convenience and recourse; self-custody trades recourse for full control. The distinction decides who can move the assets and who is liable if keys are lost or stolen.

A hot wallet keeps its keys on an internet-connected system so funds can move instantly; a cold wallet keeps them offline, isolated from any network. Hot wallets serve day-to-day flow and accept the larger attack surface; cold wallets hold reserves that rarely move but must stay safe. Most operations split funds between the two — enough hot to transact, the bulk cold.

Wallet-as-a-service is infrastructure that lets a product create and manage crypto wallets for its users through an API, without building key management from scratch. It handles wallet creation, signing, and security so the app can focus on its own experience. It turns holding and moving on-chain assets into a feature you call rather than a system you operate.

KYC (Know Your Customer) is the process of verifying who a customer is before letting them transact — collecting and checking identity documents, and confirming they are who they claim. It is a baseline control against fraud, money laundering, and sanctions breaches. KYC establishes identity; ongoing monitoring watches what that identity then does.

KYC verifies an individual customer, while KYB (Know Your Business) verifies a company — its legal existence, ownership, and the people who ultimately control it. KYB adds steps KYC doesn't: registry checks, beneficial-owner identification, and confirming who is authorized to act. A platform onboarding businesses needs both — KYB for the company, KYC for the people behind it.

AML (Anti-Money Laundering) is the set of controls that detect and prevent the movement of illicit funds through a financial system — monitoring transactions, screening parties, and reporting suspicious activity. It combines identity checks at onboarding with ongoing surveillance of behavior. AML is a continuous program, not a one-time gate.

Sanctions screening checks customers, counterparties, and transactions against government and international watchlists to block dealings with prohibited people, entities, and places. It runs at onboarding and again on every relevant transaction, since lists change constantly. A single confirmed match can require freezing funds and filing a report rather than simply declining.

Embedded finance is the delivery of financial services — payments, accounts, cards, lending — inside a non-financial product, so the user never leaves the app to transact. It relies on infrastructure providers that supply the regulated plumbing through APIs. Done well, the finance disappears into the experience: the checkout, the payout, the card all just happen in place.

Banking-as-a-service (BaaS) lets a non-bank offer bank-like features — accounts, cards, payments — by building on a licensed provider's rails through an API. The provider holds the license and the regulatory responsibility; the platform builds the product and owns the customer. BaaS is how a software company can ship accounts and cards without becoming a bank.

An electronic money institution (EMI) is a company licensed to issue electronic money and hold customer funds without being a full bank, safeguarding those funds rather than lending them out. EMIs commonly power wallets, prepaid programs, and payment accounts. The label describes a regulated institution type — a building block platforms build on, not a claim any given platform holds the license.

Agentic payments are transactions initiated and completed by autonomous software agents acting on a user's behalf, within limits the user sets. The agent needs scoped authority, a spend mandate, and an audit trail — controls that answer what it may buy, up to how much, and on whose instruction. It reframes a payment's actor from a person at a checkout to a program with a budget.

Idempotency is the property that performing the same operation twice has the same effect as performing it once — the safeguard that stops a retried request from charging a customer twice. A client sends a unique idempotency key with a payment; the server records it and returns the original result on any repeat. It is what makes retrying a timed-out payment safe rather than dangerous.

A webhook is a message a payments system sends to your server the moment something happens — a payment settles, a payout fails, a dispute opens — so you learn about events without polling for them. Your endpoint receives the event, verifies its signature, and acts on it. Webhooks are how asynchronous money movement stays in sync with your own systems.

A ledger is the authoritative record of every balance and movement in a financial system — the source of truth about who holds what. In payments it tracks funds through each state, from authorized to settled to paid out, so any balance can be explained by the entries behind it. If the numbers ever disagree, the ledger is what you reconcile back to.

Double-entry is the accounting discipline where every movement is recorded as two matching entries — a debit and a credit — so the books always balance. In a payments ledger it guarantees money is never created or destroyed, only moved between accounts. It is the structural reason a correctly-kept ledger can always be reconciled to zero.