What is a payment gateway (PSP)?
payment gateway（Payment Service Provider, PSP) is a connecting merchant、acquirer、card organization、Clearing Network Vs.bank accountSystem payment infrastructure。For B2B companies，PSP is not only a "payment channel"，It’s also financial security、Transaction success rate、Core system for compliance capabilities and global expansion efficiency。
In Hong Kong business scenario，If you are involved in "collecting payments on behalf of customers"、Hold or transfer funds、Currency exchange or cross-border remittance" and other activities，It is often necessary to conduct regulatory characterization and assess whether licensing requirements such as MSOs are triggered.。If your model is more "technical" and does not access customer funds，regulatory obligationswill be different，but still need to satisfyData protection、Anti-Money Laundering Cooperation andRisk control auditRequire。Can be combined financial risk assessment system and Personal information protection Make an integrated implementation。
Hong Kong Xintong PSP Compliance Implementation Framework
Split account opening according to business chain、Acquiring、Share accounts、Settlement、Refund and Chargeback Process，Form an auditable regulatory matrix。
KYC/KYB、EDD、Sanctions Screening、Report suspicious transactions、record keeping、Unified modeling of documents such as outsourcing management。
Continuously iterate threshold strategies through transaction monitoring and case library，Reduce manual review costs and false positive rates。
Reserved for US MSB/MTL、Singapore payment license、EU EMI and other multi-jurisdictional expansion interfaces。
Complete product boundaries、Funding path、Merchant type and country risk stratification。
Determine the division of labor between Hong Kong entities and overseas entities，Clarify licensing obligations and application pace。
Simultaneous implementation of AML policies、Transaction monitoring、Sanctions Screening、Audit log and training system。
Prepare regulatory Q&A drafts，Processing of replacement parts、Interview and eligibility check。
Quarterly review、Model tuning、Compliance reporting and annual review closed-loop management。
Cost and Budget Reference
The service fees are subject to applicable jurisdiction、Business scope、Main structure、Data complexity and delivery schedule assessment；Involving government fees，The latest fees announced by the corresponding regulatory agency shall prevail.。
If your business plan extends overseas，Can be evaluated simultaneously US MSB license、U.S. state MTL license、Singapore MAS payment license or Lithuania EMI License combination route。
Risk control、Data and continuous compliance capabilities
PSP project with high pass rate，The core is not “stack of materials”，And in "Institutional and System Consistency"。Hong Kong Information Communication recommends the construction of a four-layer model of "policy-process-system-evidence"：
- policy level：Anti-Money Laundering Policy、sanctions policy、Data classification and cross-border transmission specifications；
- process layer：Account opening review、Transaction Alert、manual review、Report suspicious transactions、Customer hierarchical review；
- System layer：List screening、Device fingerprint、Abnormal behavior identification、Chargeback management、Alarm dispatch；
- evidence layer：Audit log、training records、meeting minutes、Model version and parameter change records。
Can be docked eDon TM Transaction Monitoring System、Hong Kong Xintong AML/CRM Compliance System and Customized compliance documents Form an end-to-end closed loop。
Regulatory Boundaries for Payment Gateways and PSPs
payment gateway、Technical service provider、Merchant Acquirer、The regulatory attributes of aggregating payments and handling client funds may be different。Calling the contract "technical services" does not change the actual financial control and service functions。
- Make it clear who is signing the client、who receives instructions、who controls the funds、Who is responsible for refunds and chargebacks?。
- Check merchant KYB、beneficial owner、Industries prohibited from sale、Sanctions and Transaction Monitoring Process。
- Create client funds、Settlement、Reconciliation、reserves、Complaint and service interruption handling mechanism。
- Check payment licenses by service country、agent、Outsourcing and cross-border marketing requirements。
Official verification：BIS/CPMI Cross-Border Payment Scheme。The bank or service provider will decide according to the customer's、industry、Independent approval of regional and risk policies，Cannot promise to open a fixed account、Access or online results。
by IndustryMCC、Regional risk、Three-dimensional stratification of trading behavior，Improve the accuracy of risk control and interception。
Establish multiple acquirer backups and intelligent routing，Reduce the failure rate caused by single channel fluctuations。
All key nodes leave traces，Meet regulatory spot checks and cooperative bank due diligence requirements。
FAQ：The issues that companies are most concerned about
uncertain。The key is whether it handles or controls client funds、Whether to participate in fund transfer instructions、Whether it constitutes a monetary service activity。It is recommended to prepare a qualitative supervisory report first。
not all。MSO is more suitable for activities involving currency exchange and remittance/transfer.。If the business is electronic currency issuance、Stored value、Acquiring clearing or cross-border multilateral settlement，May need to be combined with license planning in other jurisdictions。
Regulation should be characterized、Channel due diligence、System joint debugging and production acceptance are scheduled separately。different jurisdictions、Funding paths and requirements of partner institutions vary greatly.，The fixed period of 3 to 9 months cannot be regarded as a general approval or launch commitment.。
Prepare proof of business substance in advance、Funding source link、Merchant tiering strategy、Anti-fraud rules and suspicious transaction handling SOP，and ensure that the system is consistent with the。
no。The gateway may only transmit payment information；Acquiring、Account、Responsibility for remittance and fund settlement may be borne by different entities。The parties to the contract should be listed item by item、Fund control rights and the market where the customer is located，Re-judge the scope of permission。 SeeBIS cross-border payments improvement framework。
cannot。The license area should also be checked、Service type、Cross-border solicitation restrictions and destination regulatory requirements；The willingness of cooperative institutions to join does not mean that they are granted local operating qualifications.。
Requires signing authority with actual account、Transfer authority、system key、Settlement instructions and proof of contractual liability。Only write technical services in the contract，and actually be able to allocate or freeze funds，Not enough to complete the qualitative。
If stored、deal with、Transfer cardholder data，Or can affect the security of cardholder data environment，PCI DSS scope should be evaluated；Specific compliance verification requirements are determined by the card organization、Acquirer and other decisions，PCI DSS is not a government-issued payment license。 SeePCI Security Standards Council PCI DSS Notes。
Not exempt of course。The scope of third-party services should be checked、Embed method、Website security and division of responsibilities，and confirm applicable verification requirements with the acquirer。Do not judge that there is no security obligation simply because the complete card number is not saved.。 SeePCI Security Standards Council PCI DSS Notes。
It is recommended to check registration and operating information、actual controller、Products and delivery methods、sales area、Refund rules and expected transaction volume，And compare it with industry policies on channel bans and restrictions；The depth of due diligence required is determined by the specific role and risk。
Personal accounts should not be considered a one-size-fits-all alternative。Account name should be verified、Fund ownership、Channel Agreement and Applicable Rules；Third-party collection must have legal business basis and clear authorization，The real merchant cannot be concealed。
The complete flow of funds from payment to refund should be mapped，Indicate each account and fund owner；If customer fund protection rules apply，Re-establish isolation、Reconciliation and deficiency remediation，Standards from the same jurisdiction cannot be applied。
no。Reserves typically fall under the risk arrangement of channel contracts，Regulatory capital is subject to applicable licensing rules。The two cannot be substituted for each other，Release conditions should also be clarified、Fees and settlement deduction sequence。
Handling fees should be stated separately、exchange rate、settlement time、Chargeback and chargeback fees and possible intermediary bank charges，Distinguish between estimates and determined amounts。Cost transparency is an important direction for improving cross-border payments。 SeeBIS cross-border payments improvement framework。
Can't。A distinction should be made between retryable and non-retryable errors，Set idempotent flag、Frequency and time limits，and check the original transaction status；Repeated payments and refunds should enter the manual exception handling process。
Signature should be tested、Permissions、Callback duplication and disorder、time out、Refund、partial settlement、Reconciliation and disaster recovery，Use test data and form reproducible acceptance records；Production switches are approved by authorized personnel。
The scope of the license should be checked、Merchant and country restrictions、settlement arrangements、reserves、Data Responsibility、Audit right、Dispute handling and exit mechanisms，Avoid misleading channel cooperation as licensing authorization。
Add a new wallet or withdraw your balance、Account control、exchange currency、money transfer、Credit products and new country markets，may change the nature of supervision；Should be reviewed before going online，Conclusion that old technical interfaces cannot be used。
cannot。Open an account、Ongoing monitoring and account limits are determined by the financial institution by rule。Can assist in providing consistent information and rectification evidence，But third-party results should not be guaranteed。
Product demos are recommended、contract、Fund flow diagram、Account and permission list、target market、Merchant type and existing licensing information，technology integration、Channel due diligence and permit application work。
