Opening a new market: the payments playbook. 6 chapters and a final quiz.
The complete playbook for a head of payments who has to launch a country they don't know. Build the market's payments profile: regulator, operator, rails, domestic scheme, and foreign exchange regime. Pick local methods based on actual usage, not on a provider's catalog. Choose between cross-border acquiring, a local entity, and a merchant of record. Nail down licensing, safeguarding, and repatriation, plan ahead for mandatory e-invoicing, and avoid the six mistakes that cost a quarter.
Build a country's payments profile from five questions: who regulates, who operates, which rails, which domestic scheme, and which foreign exchange regime
Select the local methods to enable based on measured usage, not on the provider's catalog
Choose between cross-border acquiring, a local entity, and a merchant of record, and quantify what each setup opens up and closes off
Settle the regulatory status, the safeguarding of funds, and the repatriation route before signing any contract
Chapter 1. A country's payments profile.
A country's payments profile is a one-page document, written, sourced, and dated, that answers five questions. You draft it at the start of the project, before choosing a provider and before the first technical meeting. Launches that fail start from somewhere else: the list of methods offered by the incumbent provider, which describes a commercial offering, not a market. Each of the five answers opens or closes contractual options. A wrong answer costs weeks.
The five questions, in this order
Who regulates, and who operates? They are not always the same body. The regulator writes the rules; the operator runs the rail and publishes the technical documentation your teams will work from.
Which rails actually exist? Cards, bulk credit transfers, instant payments, interoperable QR, mobile money, and cash vouchers. A rail that has been announced is not necessarily in use, and a rail in use is not necessarily open to a foreign company.
Is there a domestic card scheme, and is its use mandatory? A domestic scheme changes interchange, routing, and sometimes whether your international cards are accepted at all.
Which currency, and which foreign exchange regime? This determines how long it takes and how much it costs to bring the money home, and sometimes whether you can do it at all without a local entity.
Who needs a license? The question is never “Am I a fintech?” but “Who takes possession of the funds?” The answer determines whether your launch takes 3 months or 18.
Market
Regulator
Dominant instant rail and its operator
Domestic card scheme
What surprises newcomers
Brazil
Banco Central do Brasil
Pix, operated by the central bank itself through the SPI infrastructure
Elo
The regulator is also the operator, and imposes its feature set and membership on all participants
India
Reserve Bank of India
Unified Payments Interface (UPI), operated by the National Payments Corporation of India under an RBI mandate
RuPay
Direct access to the rail is limited to banks: a merchant goes through an authorized aggregator
Indonesia
Bank Indonesia / OJK
BI-FAST, plus the national QR standard QRIS, mandated by the central bank
GPN (Gerbang Pembayaran Nasional)
The central bank sets the merchant fee schedule and the API standard (SNAP)
United States
Federal Reserve / OCC / CFPB
RTP network (The Clearing House) and FedNow Service (Federal Reserve), which are not interoperable
None
Two competing instant rails, and more than 8,500 depository institutions to reach
UK
Bank of England / FCA / Payment Systems Regulator
Faster Payments Service, a scheme owned by Pay.UK, with technical operations by Vocalink/Mastercard
None
The economic regulator for payment systems is separate from the prudential supervisor
Five markets, read through exactly the same framework
🔑
The operator is not the regulator, and it's the operator your teams will call
Governance of a payment rail splits into two functions, writing the rules and running the system, and three models combine them differently. In Brazil, the Banco Central do Brasil owns and runs Pix, under the operating central bank model. In India, under the mandated company model, the National Payments Corporation of India runs UPI under a mandate from the Reserve Bank of India. In the UK, under the supervised private consortium model, Pay.UK owns the Faster Payments scheme and Vocalink handles technical operations. In Malaysia, Payments Network Malaysia (PayNet) is even majority-owned by the central bank, which has said it intends to reduce its stake. The operator publishes the rail's technical documentation and participation rules. Your integration teams deal with the operator, and finding the right contact in the first week saves a month spent writing to the wrong one.
79.8B
Pix transactions in 2025; 54.7% of Brazilian retail transactions in the second half of 2025
Banco Central do Brasil, 2026
241.62B
UPI transactions in India's 2025–26 fiscal year, up 30.0% by volume
NPCI, 2026
5.55B
Faster Payments transactions in the UK in 2025, worth £4,838 billion
Pay.UK, Annual Summary of Payment Statistics 2025
⚠️
A dominant rail is not necessarily an accessible one
A rail's accessibility is whether a given company can connect its payments to it. That is different from the rail's market share. A rail can carry half a country's payments and still be closed to a foreign company. In India, the actual chain is merchant → payment aggregator or acquiring bank → PSP bank → NPCI → payer's bank. The link that matters legally is the aggregator, whose status is governed by the Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025, published on September 15, 2025. When you assess a market, then, look at the authorized intermediary that opens up access to the rail, and at the regulatory status that intermediary holds.
🎯 Quick question
You need the technical documentation and participation rules for Brazil's instant payment rail. Who do you contact?
Chapter 2. Choosing local methods: usage, not the catalog.
Selecting a market's payment methods means choosing a subset of the available catalog, with measured usage in the country as the filter. Large international providers list catalogs of several dozen methods, and each one you enable is a separate decision. Every method you enable costs an integration, a round of testing, a reconciliation line, a refund flow, and support training. A launch therefore keeps the two or three methods that carry most of the usage, plus the one that unlocks a segment you would otherwise lose.
Three sources, three truths, and only one that applies to you
The provider's catalog tells you what it can technically route. It says nothing about usage, and it inherently overstates the methods the provider integrated most recently.
National statistics (central bank, rail operator) show actual usage in the country across all channels. They are the best source available, but they describe the population, not your customers.
Your own data, once you are live, tells the truth: the actual mix, the first-attempt authorization rate by method, and the checkout abandonment rate. It is the only source that settles the question, and it only exists after launch. Hence the rule: launch small, measure, then expand the catalog.
The taxonomy trap: market studies often classify as “wallets” apps that are merely an interface to a public rail. In India, apps that run on UPI are counted as wallets, so the country's “wallets” line is mostly UPI. Always read the definition before the number.
Market
Cards
Wallets
Bank transfer / A2A
Cash and vouchers
What the mix means for checkout
Brazil
42 %
9 %
40 %
2 %
Native Pix and credit cards with local installments (parcelado): both, not one or the other
India
15 %
68 %
5 %
4 %
UPI via QR code or alias; the “wallets” line is overwhelmingly UPI
Indonesia
15 %
35 %
25 %
10 %
QRIS and bank virtual accounts (a unique transfer reference per order)
Mexico
40 %
25 %
15 %
12 %
SPEI plus a cash payment option at convenience stores, which is still essential
United States
47 %
39 %
6 %
–
Wallets are tokenized cards: the underlying rail is still the card
Brazil (Pix), India (UPI), and Colombia (Bre-B, more than 617 million transactions in its first six months of operation, according to Banco de la República, April 2026). Pricing is regulated, participation is often mandatory, and the product evolves by regulatory decision, not on a commercial roadmap.
🔲
Mandated national QR
Indonesia (QRIS), Malaysia (DuitNow QR), and Vietnam (VietQR). A single code accepted by every issuer and wallet. The question is no longer “which QR code to integrate” but “static or dynamic,” and that is a reconciliation question.
💳
Cards backed by local credit
In Brazil, credit cards hold their ground against the instant rail because they carry parcelado, the interest-free installment payment deeply embedded in consumer habits. A card can survive a free rail if it sells something other than payment. What it sells is credit.
🏪
Persistent cash and cash on delivery
Cash on delivery is still widely used in Southeast Asia, but it is declining fast. In Vietnam, it accounts for about 16% of online spending, while national QR payments grew 61.6% by volume and 150.7% by value in the first nine months of 2025 (SBV). A business plan that ignores it is wrong, and so is one that assumes it will stay put.
⚠️
Recurring payments don't follow the instant rail: they're a separate project
Recurring payments rely on a mandate, the payer's authorization for future debits, and everywhere they form a separate system from one-off payments. These systems arrived late, and adoption remains slow, even on rails that dominate one-off payments. Pix Automático has been mandatory for all institutions offering transaction accounts since June 16, 2025, yet it remains marginal compared with débito automático. Adoption is slow because the payer must give explicit consent and have funds available on the due date, not because of any technical hurdle. PayTo (Australia, 2022) is explicitly designed to replace BECS direct debit, while DuitNow AutoDebit (Malaysia) complements a rail that only the payer can initiate. The UK addresses the issue through Variable Recurring Payments. These four approaches follow four different authorization and revocation regimes, each of which has to be examined method by method.
🔑
Static or dynamic QR: a reconciliation decision, not a design choice
A static QR code, the printed sticker, encodes only the payee's identifier and leaves the customer to enter the amount, so nothing links the payment received to an order. The merchant reconciles by eye, on amount and time, which leaves it exposed to customers showing a forged transfer confirmation. A dynamic QR code encodes the amount and a reference, so reconciliation becomes automatic. Manual reconciliation remains workable as long as daily payment volume stays within what one person can check. Beyond that, only a dynamic QR code can match each incoming payment to an order.
🎯 Quick question
A market study puts “wallets” at 68% of Indian e-commerce. What should you conclude for your integration?
Chapter 3. Acquirer, MID, and authorization rate.
Collecting from a consumer in a given country relies on one of three setups. Your choice determines which methods you can offer, your authorization rate, your costs, your tax treatment, and how long repatriation takes. Cross-border acquiring means collecting from abroad under an international acquiring agreement. It is the simplest and fastest setup to put in place, and also the weakest performer of the three. The local entity with domestic acquiring setup requires you to register a company locally and sign a local acquiring agreement. Using a merchant of record hands the sale to a third party, which sells in its own name in the market and remits the sales proceeds to the merchant.
Capability
Cross-border acquiring
Local entity
Merchant of record
Local rails and methods (A2A, QR, voucher)
Rarely, and through a third party
Yes, directly
Yes, in the third party's name
Credit or local installment plans
No
Yes
Depends on the third party's contract
Card authorization rate
Lower: the local issuer sees a foreign transaction
Domestic
Domestic
Time to first sale
Short
Long: registration, contract, possibly a license
Short
Local compliance and tax burden
Low
High and ongoing
Shifted to the third party
Repatriation of funds
Immediate, in foreign currency
Regulated FX transaction
Handled by the third party
Control of the customer relationship
Full
Full
Shared: the third party is the legal seller
What each setup actually allows
Setting up domestic acquiring: the order of dependencies
Entity
Register the company and obtain a local tax ID
The acquiring agreement, local method onboarding, and invoicing all require this number. Nothing can be signed before you have it.
➜
Acquirer
Sign a domestic acquiring agreement
Know your business (KYB), beneficial owners, dispute and chargeback history: the file is long, so prepare it in parallel with registration.
➜
Schemes
Obtain a merchant ID for each accepted scheme
Merchant category code, statement descriptor, limits, any reserve. A merchant ID from another country cannot be reused.
➜
Local methods
Join the country's rails one at a time
Instant rail, national QR, cash vouchers: each has its own onboarding, its own testing, and its own refund flow.
➜
Settlement
Set the settlement currency, frequency, and account
The settlement currency determines who bears the FX risk; the frequency determines your working capital needs.
➜
Measure
Set up tracking by BIN and by method before the switch
Without a baseline taken beforehand, you cannot prove any gain from domestic acquiring afterward.
What you actually negotiate in an acquiring agreement
Settlement currency: being settled in local currency or in your reporting currency does not change the cost. It changes who bears the currency conversion, and at what rate.
Settlement frequency and timing, and above all how they behave on local public holidays. An unfamiliar market calendar always reveals itself at the worst possible moment.
Rolling reserve: its rate, its duration, and above all the event that triggers it and the event that releases it.
Cardholder statement descriptor: the leading cause of avoidable disputes. It must make sense to someone who lives in the country, not to you.
Merchant category code: it determines interchange, eligibility for certain methods, and sometimes the authorization decision itself.
Routing: which networks, in what order, and which local requirements apply. As the next section shows, those are not negotiable.
Exit terms: card token portability, export of mandates and subscribers, notice period. The cost of leaving is negotiated on the way in, never on the way out.
⚠️
Mandatory domestic routing is not a contract option
Mandatory domestic routing is a regulatory rule that sets the path a transaction must take within a country. No acquirer can exempt a merchant from it. In Indonesia, the Gerbang Pembayaran Nasional (2017) requires card transactions to be routed domestically through four licensed switches (Artajasa, Rintis, Alto, and Jalin). In Malaysia, MyDebit, PayNet's debit scheme, which migrated to the NextSwitch platform in 2025, requires debit transactions to be routed domestically first. In Vietnam, NAPAS imposes its VCCS chip standard and its 9704 BIN. In the US, Regulation II (12 CFR Part 235), which stems from the Durbin Amendment to the Dodd-Frank Act of 2010, requires every debit card to carry at least two unaffiliated networks. The merchant chooses the routing. Checking an acquirer's compliance on this point is part of provider selection, not testing.
ℹ️
Passing costs on to customers: two markets, two opposite rules
A surcharge is an extra amount a merchant adds to the price to cover the cost of accepting a payment method. In Indonesia, Bank Indonesia makes the merchant pay the QRIS merchant fee, and that fee cannot be passed on to the consumer. Charging customers a QRIS surcharge is a violation. The check also applies to the provider, which may add such a surcharge on the merchant's behalf. In the US, by contrast, surcharging is allowed on credit cards up to the merchant's actual cost. Visa has capped it at 3% since April 15, 2023, and Mastercard at 4%. It is prohibited on debit and prepaid cards, and requires 30 days' notice to the acquirer as well as disclosure both in store and online. State rules add another layer: some jurisdictions ban it (Connecticut, Massachusetts, and the territory of Puerto Rico), while others cap it (Colorado at 2%). The same question, who bears the cost of acceptance, gets two opposite answers from one market to the next.
The authorization rate measures the share of transactions the issuer approves out of those submitted to it. The useful measure is taken on the first attempt, by issuer BIN, and by method, against a baseline recorded before switching from one acquiring setup to another. A measure taken at the end of the flow includes retries, and a country-wide aggregate hides the gap specific to each issuer. In a market where cross-border transactions were being declined at scale, a one-point gain in authorization rate is often worth more than the entire fee renegotiation, which will have tied up the team for two months.
🎯 Quick question
You see a very low authorization rate on local cards in a new market, even though your PSP and your 3-D Secure flow are the same as in your other countries. Which hypothesis should you test first?
Chapter 4. Entity, license, safeguarding, and repatriation.
Taking possession of funds means holding, even briefly, money that belongs to someone else. This criterion alone determines the regulatory status you need at launch, whatever name the country gives that status. A company that sells its own products, with money going straight from the buyer to an account in its own name, remains a merchant. As soon as it collects on behalf of a third party, such as a marketplace seller, a publisher, a service provider, or a subsidiary of another group, it falls within the scope of licensing. The project timeline then shifts to a different scale.
Three thresholds, in the order they kick in
Purely technical provider: you move data, never funds. No payment license is needed, but security requirements apply, and often data localization rules too.
Taking possession of funds: you hold, even briefly, money that isn't yours. This is the universal trigger for licensing, whatever the country calls it.
Ownership or nationality requirements: some markets don't stop at a license; they require the capital or voting rights to be majority-local. You don't meet that threshold with an application. You meet it with an ownership structure, so it has to be addressed very early.
Market
Required status
Most restrictive condition
Where merchant funds are held
India
Payment Aggregator: PA-O for online, PA-P for in-person, PA-CB for cross-border (RBI Directions of September 15, 2025)
Net worth of ₹15 crore when applying, ₹25 crore by the end of the third fiscal year, maintained thereafter
Escrow account with a Scheduled Commercial Bank in India; dedicated InCA and OCA accounts for cross-border flows
Singapore
Standard Payment Institution or Major Payment Institution, under the Payment Services Act 2019 (Monetary Authority of Singapore)
Base capital of S$100,000 for an SPI, capped at S$3 million in monthly transactions per service; the license lists the services covered
Trust account with a safeguarding institution, never commingled with the licensee's own funds
Indonesia
PJP (payment service provider) or PIP (infrastructure provider), under PBI No. 22/23/PBI/2020, in force since July 1, 2021
51% of voting rights held by Indonesian individuals or entities for a PJP, 80% for a PIP
National regime; on the technical side, APIs are built against the mandatory SNAP standard before being built against any provider
Vietnam
Payment intermediary license issued by name by the State Bank of Vietnam
Named license listing each service, e.g., ZaloPay's license No. 04/GP-NHNN of January 19, 2026, covering gateway, collection and disbursement, and e-wallet services
Scope strictly limited to the services listed on the license: an unlisted service cannot be offered
What four regulators require of anyone collecting on behalf of others
⚠️
A contract clause cannot solve data localization
Data localization is the requirement to keep certain data solely within the country that imposes it. In India, Reserve Bank of India circular DPSS.CO.OD No. 2785/06.08.005/2017-2018 of April 6, 2018 requires all payment system data to be stored only in India. The goal is unfettered supervisory access. For a cross-border transaction, a copy of the domestic leg may be kept abroad. The requirement applies to the storage location itself, and it comes with direct supervisory powers. An adequacy framework or standard contractual clauses, by contrast, permit transfers subject to conditions. A provider that hosts Indian data on a shared regional platform in Singapore or Frankfurt therefore does not comply, whatever its data processing agreement says. Check the physical storage location before pricing, as early as provider selection.
Repatriation is the transfer of funds collected in a foreign market back to the headquarters country. It is the item launch plans most consistently underestimate. Each country has its own foreign exchange regime for it, with its own reporting formalities and authorized intermediaries. In Brazil, foreign exchange is governed by Lei nº 14.286 of December 29, 2021 and Resolução BCB nº 277 of December 31, 2022. The purpose of the transaction must be declared up to a threshold of $50,000, with the reporting responsibility shifting to the authorized institution. The regime explicitly recognizes eFX providers. These firms are not authorized to conduct foreign exchange themselves; they operate under a contract with an institution that is. In India, cross-border business has its own dedicated status, PA-CB, with inbound and outbound collection accounts kept separate from the domestic escrow account. In both cases, the time between local collection and funds becoming available at headquarters is a parameter of the funding plan.
🔑
Five questions to ask before signing with a provider, an acquirer, or a merchant of record
1. The license held, the authority that issued it, its date, and the entity that holds it. The commercial brand and the licensed entity are rarely the same legal entity. 2. Where the merchant's funds are safeguarded while the provider holds them, and what happens to those funds if the provider fails. 3. The physical location where payment data is stored and processed. 4. The vehicle through which funds flow back to the merchant, the applicable foreign exchange regime, and how many days it takes. 5. What the merchant takes along on exit: card tokens, mandates, transaction history, and customer data. Settle these five points before signing, never after. A vague answer on any one of them is reason enough not to sign.
🎯 Quick question
Your marketplace wants to collect payments in Indonesia and pay out to local sellers. The provider you picked does hold an Indonesian license, but your local subsidiary would be 100% owned by the European parent company. What's the problem?
Chapter 5. Tax and invoicing: what blocks go-live.
Payment and invoicing meet two separate requirements: one transfers the funds, the other provides tax evidence of the transaction. Mandatory e-invoicing is a regime in which an invoice legally exists only once it has been validated by the tax authority or an approved third party, sometimes before the sale. A growing number of markets apply such a regime, and the seller loses control over issuing the document. A launch that is technically ready, with acquiring signed and rails connected, stays blocked if the invoicing module does not produce a valid document. Along with licensing, this is one of the two most common reasons a launch slips by a quarter.
Three architectures for invoice control
Market
Framework
Control architecture
Trigger and timeline
Italy
Sistema di Interscambio (SdI), Agenzia delle Entrate
Mandatory clearance: an invoice that has not gone through the SdI is deemed never to have been issued
All invoices between taxable persons resident or established in Italy, since January 1, 2019; also covers sales to end consumers
Brazil
Nota Fiscal Eletrônica (NF-e), established by Ajuste SINIEF 07/05
Prior authorization, transaction by transaction: the issuer's digital signature, then an authorization of use from the state tax authority (SEFAZ)
Authorization must be obtained before the taxable transaction takes place
Mexico
CFDI, stamped by the SAT (Mexico's tax authority) or a Proveedor Autorizado de Certificación (PAC)
Certification by an approved third party: an unstamped invoice does not exist for tax purposes
CFDI 4.0, in force since January 1, 2022, and the only valid version since coexistence with 3.3 ended on March 31, 2023
India
Invoice Registration Portal (IRP), GST regime
Registration: the IRP returns an Invoice Reference Number and a QR code to be printed on the invoice
Aggregate annual turnover of ₹5 crore or more, since August 1, 2023 (GST notification 10/2023)
Poland
Krajowy System e-Faktur (KSeF)
Public platform for issuing and receiving invoices
Receiving mandatory for all on February 1, 2026; issuing mandatory on February 1, 2026 above PLN 200 million in 2024 sales (tax included), and on April 1, 2026 for everyone else
Five mandatory e-invoicing regimes and what each requires of your systems
You no longer control numbering: the tax authority or the approved third party validates it, and a rejection blocks the sale, not just the bookkeeping.
The data you collect at checkout changes: the customer's tax ID, tax address, and the nature of the transaction. A checkout flow designed for another market doesn't ask for them.
Invoice status becomes a state to track, exactly like payment status, with its rejections, retries, and monitoring.
Archiving has its own retention period and format, separate from your payment logs, and it carries legal weight.
The timeline is set by regulation: it can't be negotiated or postponed, and missing a go-live date is not a project delay but an inability to invoice.
⚠️
In Brazil, the invoice comes before the transaction, not after
The Nota Fiscal Eletrônica has legal validity only after the issuer's digital signature and an authorization of use granted by the state SEFAZ before the taxable transaction takes place. The issuer must then send the recipient the NF-e file and its authorization protocol as soon as it is received. The call to SEFAZ therefore becomes a blocking step in the order flow: until the authorization comes back, the taxable transaction cannot take place. A module that produces a PDF invoice once payment has been collected does not satisfy the regime in force in Brazil. This is an application architecture constraint. It must be addressed when the project is scoped, before testing.
Payment terms are the time a business buyer has to pay an invoice. They fall under local law, separate from both payments and tax, and they apply as soon as a company sells to other businesses. They drive a launch's working capital needs far more reliably than the seller's own terms and conditions. In the EU, Directive 2011/7/EU caps agreed payment terms between businesses at 60 calendar days, unless expressly agreed otherwise and not grossly unfair, and at 30 days for public authorities. It also gives an automatic right to a minimum recovery fee of €40 for late payment. In the UK, no statutory cap limits agreed terms; the law works through the cost of paying late. The Late Payment of Commercial Debts (Interest) Act 1998 grants interest at 8 percentage points above the Bank of England base rate, plus fixed compensation of £40, £70, or £100 depending on the size of the debt. In India, the MSMED Act 2006 specifically protects micro and small enterprises, with a maximum term of 45 days (Section 15). Beyond that, interest is due, compounded monthly, at three times the bank rate notified by the Reserve Bank of India (Section 16). These three markets take three different approaches: a statutory cap on terms, a late-payment penalty, and protection for one category of business.
🔑
What to decide before writing the first line of checkout code
1. Whether the target country requires the invoice to be validated by a third party or the tax authority, and whether that happens before or after the transaction. 2. The additional data that validation requires you to collect at checkout, and whether it is available at that point in the flow. 3. How the obligation is split between a merchant of record selling in its own name and the merchant that entrusts it with the sale. 4. The statutory B2B payment term and its impact on cash flow at launch. These four points shape the technical scoping. None of them can be fixed during testing.
🎯 Quick question
Your platform automatically generates the invoice as a time-stamped PDF when payment is collected. Why doesn't this work in Brazil?
Chapter 6. A realistic timeline and the six mistakes that cost a quarter.
A country launch plan, worked backward from go-live, sequences the dependencies between workstreams, then assigns each one a duration taken from the timelines the authorities publish. Delays almost never come from the code. They come from waiting for a license, registering an entity, an incomplete KYB file, or an invoicing module that doesn't produce a valid document. Two regulatory windows give a sense of the lead times imposed. The Reserve Bank of India set December 31, 2025 as the deadline for filing aggregator authorization applications, with non-filers required to cease operations by February 28, 2026. Poland is phasing in the KSeF requirement on February 1, 2026, then April 1, 2026. A planning template imported from another country tells you nothing about these durations, which you have to get from the relevant regulator.
Milestone 1
Market payments profile
Regulator, rail operator, methods actually in use, domestic scheme, currency, foreign exchange regime, and required status. A written, sourced, and dated document, not a conversation.
Milestone 2
Choosing the setup
Cross-border acquiring, local entity, or merchant of record. This choice determines everything else, starting with whether you need a license.
Milestone 3
Entity and tax ID
This milestone blocks everything. The acquiring agreement, local method onboarding, and invoicing all depend on it.
Milestone 4
License application, if needed
The only milestone whose duration you don't control. Start it in parallel with everything else, never afterward, and get its timeline from the regulator.
Milestone 5
Contracts
Domestic acquirer, local methods one at a time, a merchant of record if needed. KYB, beneficial owners, reserves, and exit terms.
Milestone 6
Technical integration AND invoicing, in parallel
The two workstreams move forward together. Invoicing is more often the one that lags, because it depends on an approved third party or a government agency.
Milestone 7
Local compliance testing
Domestic routing, mandatory authentication, required disclosures, rules on passing costs on, and data to collect at checkout. This workstream is separate from functional testing.
Milestone 8
Phased rollout and measurement
A fraction of traffic, first-attempt authorization rate tracked by BIN and by method, settlement reconciliation, then full rollout.
🔑
The critical path is not technical
The critical path is the sequence of tasks whose combined duration sets the project's end date. For a country launch, it runs through the entity, the license, and invoicing: three workstreams whose duration depends on third parties and that block one another in that order. The provider integration is rarely on it. Its duration is bounded and controlled by the team doing the work. Sequencing therefore means starting those three workstreams first, even when the technical team is available, and accepting that the code will wait.
🧭
1. Copying a neighboring market
CoDi (Banco de México, 2019) checks every box on paper: interoperable QR and NFC, built on SPEI, and free for both merchants and customers. In 2024, it averaged about 9,900 transactions a day. Free pricing and interoperability don't create usage without distribution through banking apps and incentives for merchants. Ghana teaches the same lesson: the GhQR standard is technically deployed but commercially disappointing.
↩️
2. Assuming chargebacks exist
On a push credit transfer rail (PromptPay, BI-FAST, DuitNow, InstaPay, NAPAS 247), payment is final and irrevocable. A refund is a new transfer, initiated by you, with its own fees and timing. Any dispute, guarantee, or escrow logic has to be built into your own application, because it doesn't exist in the rail.
🗺️
3. Serving a country from a regional platform
The RBI circular of April 6, 2018 requires payment data to be stored exclusively in India. No data processing agreement or standard clause can replace that requirement. A provider that “covers India” from Singapore puts you in breach, not itself.
🏷️
4. Confusing the brand with the licensed entity
GrabPay's Major Payment Institution license in Singapore is held by Grablink Pte. Ltd.; the brand's presence in other Southeast Asian markets relies on separate entities and licenses, which must be checked country by country. In India, the Paytm brand (One97 Communications) survived the RBI-ordered shutdown of Paytm Payments Bank in 2024 by switching to a multi-bank model; the RBI then canceled the unit's banking license on April 24, 2026. Any due diligence distinguishes the entity behind the brand from the one holding the license, and checks for banking redundancy.
🔀
5. Ignoring mandatory domestic routing
Indonesia (GPN, four licensed switches), Malaysia (MyDebit, migrated to NextSwitch in 2025), Vietnam (NAPAS, VCCS standard and 9704 BIN), and the US (Regulation II, at least two unaffiliated networks on each debit card, with the merchant choosing the routing). Each of these rules is a condition the acquirer must meet to operate in that market, and no contract clause can override it.
💸
6. Passing on costs where it's prohibited
Bank Indonesia prohibits passing the QRIS merchant fee on to consumers. In the US, surcharging is allowed on credit cards but capped (3% at Visa since April 15, 2023, 4% at Mastercard), prohibited on debit and prepaid cards, subject to 30 days' notice to the acquirer, and banned in some states. Also check that your provider isn't doing it on your behalf.
The cardholder statement descriptor has been read and approved by someone who lives in the country, not by the team that entered it.
A real end-to-end payment has been completed: local currency, local account, valid invoice issued, refund tested, on every method enabled, including those without chargebacks.
The first-attempt authorization rate is instrumented by BIN and by method, with a baseline taken before the switch.
Local disclosure requirements (price, tax, surcharge, return policy, invoice details) have been approved by local counsel.
Exit terms are in writing before signing: card token portability, export of mandates and subscribers, notice period, and data return format.
The market calendar is loaded into your systems: local public holidays, settlement windows, year-end cutoffs. Launching the day before a holiday week is a scheduled incident.
⚠️
Never freeze a cost model around a tax rate you read in the press
Tax parameters for cross-border transactions sometimes change mid-year as a result of political decisions. In Brazil, the IOF-câmbio tax applies to foreign exchange transactions, with a reference rate of 3.5% on card purchases and withdrawals abroad and on cross-border arrangements since the May 2025 decrees. The executive branch, Congress, and the constitutional court fought over this rate throughout 2025. The professional rule allows no exceptions: any rate that goes into a cost model must be confirmed by local counsel as of the transaction date. The model then shows the date it was last checked.
Opening a market ends with the first decision made on the merchant's own data, not with the first successful transaction. Thirty days after launch, three metrics provide the basis for that decision. The actual mix compared with the forecast mix shows whether the methods you enabled are the ones customers use. The first-attempt authorization rate by BIN shows whether the acquiring setup is holding up. The reconciliation gap between settlements received and orders recorded shows whether the accounting chain is keeping up. Until these three metrics are instrumented, the country is connected but not open: transactions go through, but no decision can be based on numbers.
🎯 Quick question
Your technical team is available right away and suggests starting with the provider integration while the subsidiary's registration is pending. What do you say?