How to check if a payment processor is licensed: the acquiring bank, the Visa registry and what a directory shows

I went looking for the acquirers in the wrong drawer. A public directory of financial companies has a category called card acquirers and processors, I opened it expecting the names that appear on merchant statements, and it held 2 companies, Balance Payments and Diners Club International, both in the United States. Neither is a name I would expect on a typical online store's settlement report.

The acquirers were there all along. Elavon, Fiserv, TSYS, Shift4, Square and Finix sit in the next drawer, filed as e-money and payment institutions. That filing choice is a small thing on its own. It also turned out to be a fair picture of how to check if a payment processor is licensed, because the word licensed is doing less work than most merchants think.

In the US, a processor may not need a licence at all

The federal definition of a money transmitter sits in 31 CFR 1010.100, and it carves processors out in plain words. The term “shall not include a person that only” acts “as a payment processor to facilitate the purchase of, or payment of a bill for, a good or service through a clearance and settlement system by agreement with the creditor or seller”.

The list of exclusions runs from A to F, 6 cases in all, and the processor one is B. So a company that only processes your card sales, under a contract with you, can sit outside that definition entirely. Whether it does is, in the regulation's own phrase, “a matter of facts and circumstances”. Nothing on a pricing page settles it, and you should not read much into a missing licence number on its own.

I had assumed that every serious processor carried some federal registration I could look up, and I was wrong about the federal layer at least. It does not have to. A sales rep who cannot produce a licence number may simply be telling the truth.

The useful question moves to 2 places. Which bank is the acquiring bank behind the contract. And is the company you are talking to registered with the card schemes as an agent of that bank.

The registry the card scheme keeps

Visa keeps a Global Registry of Service Providers, and its front page is unusually direct about who should use it. Merchants “should only use service providers that are listed on the Registry for outsourcing their payment-related services”, it says, and a merchant who picks one from the list “must notify their acquiring bank prior to using the service provider”.

On 23 September 2026 the registry showed a last update of 21 September and 9,145 records, spread over 305 pages of results. Each listing carries the company name, its website, the country of its headquarters, the regions it covers, the services it offers and the date its security validation runs until. That date is the part I would read first. A listing whose valid through date has already passed tells you something the sales deck will not.

The obligations run upstream too. The page cites Visa Rules ID 0025895: before registering an agent, a member bank must complete the applicable regional due diligence, and it must review every registered third party agent once a year. Somebody at a bank has signed off on your processor, and the registry is the visible end of that paperwork.

I searched it for Elavon, since the directory had already told me who owns it. The search returns 2 records for that name. Elavon, Inc., of Georgia, is listed as a VisaNet processor and a merchant servicer, validated against PCI DSS through 30 June 2027 by Verizon Business Services, with global and US regions of operation. A second record, US Bank/Elavon Merchant Processing System in North Dakota, carries the same validation date and assessor.

That second name is the one I had missed. The bank is in the entry itself, joined to the processor by a slash, which is about as plain as an answer to the acquiring bank question can get.

I find it slightly annoying that a page this plain has to be found by searching for it. It is free, it is public, and it answers a question most merchant contracts leave to the small print.

Europe publishes the licence, and says who is to blame for errors

For a store that takes payments through a European entity the answer is more formal. Article 15(1) of the second Payment Services Directive requires a central register of payment and electronic money institutions, and the European Banking Authority operates it under Implementing Regulation (EU) 2019/410 and Delegated Regulation (EU) 2019/411.

National regulators feed it and update it “at least once per day”. Searching is free and the whole register can be downloaded. The delegated regulation behind it is dated 29 November 2018, and the technical standards it rests on were published by the EBA in December 2017.

The disclaimer is worth reading slowly. The EBA says it is responsible only for accurate reproduction of what it receives, “while responsibility for the accuracy of that information lies with the competent authorities at national level”. If the EBA entry and the national register disagree, the national one wins. Read that one first, every time. I would still check both before signing anything that runs to several years.

In the UK the equivalent is the Financial Conduct Authority's register. Checkout Ltd is an example that is easy to follow: registered in England as company 08037323, incorporated on 19 April 2012, shown as active by Companies House, and listed with the FCA as its regulator. Its next accounts, for the year to 31 December 2025, are due by 30 September 2026, which is 1 week after I looked.

What the directory adds

The directory I started in is Bank Index, a public listing built from regulators' registers and each company's own pages. It counts the e-money and payment institutions it lists across 78 countries at 2,672 on 23 September 2026. The United Kingdom has 408 of them, France 221, Brazil 158, Poland 151, Lithuania 134, the Netherlands 124 and the United States 144.

The spread looks odd at first sight. Lithuania has almost as many entries as the United States, and my guess is that this says less about Lithuania than about which countries publish 1 national register of payment firms and which leave licensing to their states.

Its cards save time on the corporate chain, which is the part of this job that otherwise means opening a filing, finding the parent, opening the parent's filing and repeating the exercise until somebody at the top turns out to be a bank or a listed holding company you have heard of. The Elavon card names U.S. Bancorp as the group it is consolidated into, gives 1991 as the year it was established, and prints a Legal Entity Identifier, 254900P8XQ2KY5IN9780.

I checked that identifier against GLEIF, the foundation that runs the global LEI system. It returns ELAVON, INC., a Georgia jurisdiction, an issued status with renewal due on 11 February 2027, and U.S. Bancorp as both direct and ultimate parent. The record was first registered on 11 February 2025 and last updated on 29 January 2026. So the card and the primary source agree, and it took me about 2 minutes to confirm it. It was a small relief, honestly.

The Adyen card shows the other shape of the business. It says Adyen was granted a European banking licence in 2017, is supervised by De Nederlandsche Bank and the Dutch markets authority, and is therefore “an acquiring bank rather than a reseller of somebody else's acquiring”. That sentence is the whole distinction this piece is about, written by somebody else. The same card gives 2024 revenue of 1.996 billion euros, net income of 925 million and a published processing fee of 0.13 dollars per transaction plus the payment method fee.

Where the directory is thin

The first limit is the one I walked into. The acquirer category for the United States holds 2 names, so browsing by category will mislead anybody who trusts the label, and a merchant comparing acquirers by clicking through the obvious menu would come away thinking the country has 2 of them and that one of them is Diners Club. Search by company name instead, because the processors that matter sit among the 144 payment firms the same directory lists for the country.

The second is on the cards themselves. The Elavon card, for all its detail, reads “Licence confirmed not confirmed yet”, and 9 of its 11 score lines repeat the same generic sentence about the kind of institution rather than anything Elavon publishes. The list page above it says every entry is confirmed on a regulator's own list. Those 2 statements sit badly together. So which one do you believe here? I would trust the card's own caveat over the headline.

The third is small and a little comic. The joke, I think, is on some geocoder rather than on the firms. On the page of 144 US payment companies, a few names carry French towns beside them, Roubaix, Perpignan and Nantes among them. I suspect a geocoder matched a street name somewhere, and I would not use the city on any of those lines for anything. I cannot tell from the page which register each of the 144 was checked against, either. That one matters rather more to me.

None of that makes it useless. It makes it a map to the registers rather than a register. I think that is the honest way to use it.

The order I would check a processor in

The whole check is 5 lookups, done in order. Get the legal name of the entity on the merchant agreement, not the brand. Large processors often trade through a separate legal entity in each region, and the one that matters is the one that signed.

Ask in writing which acquiring bank sponsors the agreement, if the processor is not a bank itself, and keep the reply with the contract, because the person who answered will have moved on by the time you need it and the email will not. A processor that is registered as an agent will know the answer immediately, and the answer is a legal name you can look up in the same public registers as everything else in this piece, which is the reason to ask for it in writing rather than on a call.

Search the Visa registry for the processor and read the valid through date. Elavon's 2 entries both ran to 30 June 2027. Where the processor is not listed, ask why before you sign, because the registry page itself tells merchants not to outsource to unlisted providers.

For a European or UK entity, find it in the EBA register or on the FCA register and note the authorisation type. An electronic money institution, a payment institution and a bank are three different promises about where your settlement money sits overnight. Only 1 of the 3 takes deposits.

Use a directory to pull the parent company and the LEI, then run a free LEI lookup at GLEIF, which gives the direct and the ultimate parent in 1 record. That part takes minutes and catches the case where the entity on the contract is not the one on the website.

An aside about the LEI, because it keeps being useful in places nobody designed it for. It was built to identify the parties to financial transactions, and it now turns out to be the quickest way I know to see who owns a payments company, since the parent links are published for free and every record carries a renewal date.

Anyway, back to the check itself. That was the long version of something that takes perhaps 20 minutes in total, and my guess is that most merchants will only ever do it once, at signing, which is the right time.

What I could not settle

I do not know how often acquiring banks actually refuse a merchant's chosen processor after the notice the Visa page asks for. The registry pages do not publish that number, and I have not found anybody who does.

I also cannot say why the directory files Elavon, a subsidiary of a bank holding company, as an e-money institution rather than next to Balance Payments in the acquirer drawer. Both labels are defensible in some reading, and neither is wrong enough to complain about. I keep thinking about the 2 names in that drawer, and what a merchant would conclude from them if nobody told him to look next door.