🏦 Cross-border acquiring around the world

Where the contract is signed: what “local” really means

A card transaction is domestic when the issuer and the acquirer are in the same country under network rules, and cross-border in every other case. The classification rests on a single comparison: the country of the entity that signed the acceptance contract versus the country of the bank that issued the card. The customer’s nationality, the website’s language, and the server’s location play no part. A London-based merchant selling to Jakarta under a UK contract generates cross-border volume on every Indonesian sale. The same catalog, run through an Indonesian entity and contract, generates domestic volume. Switching from one classification to the other moves the transaction into a different interchange category, a different network fee schedule, and a different decisioning segment at the issuer.

An international setup stacks three locations, and they often diverge. The country of the legal selling entity determines indirect taxes and the name on the invoice. The country of the acquiring contract determines interchange, network fees, and the transaction category. The country where the provider is licensed determines which activities it may carry out and which customers it may serve. The authorization message carries a merchant country code and a point-of-sale address, both populated from the acquiring contract. The issuer bases its decision on that data alone. It never sees how the selling group is organized, where the technical request originates, or the cardholder’s nationality.

The European Union has its own regime, set out in secondary legislation. Article 6 of Regulation (EU) 2015/751 bans any territorial restriction within the EU in licensing agreements and scheme rules, as well as any requirement for a country-by-country license to operate across borders. An acquirer licensed in one member state can therefore sign up a merchant established in another without having an establishment there itself. This provision made centralized European acquiring possible, and with it the large pan-European platforms.

That regime stops at the EU’s borders. Elsewhere, network rules generally require the merchant to have a permanent establishment in its acquirer’s country, and several jurisdictions add their own conditions: routing through a national infrastructure, a local license, or both. When an Indian or Indonesian issuer declines a transaction submitted by a foreign acquirer, the cause lies in these access requirements, not in how a scoring engine is tuned.

When the law requires local acquiring

A domestication mandate is a national rule that brings all or part of a market’s payments under the country’s own law and infrastructure, where international network rules would leave the merchant free to choose its setup. Some 20 markets now constrain a transaction’s path through regulation, using four levers, alone or in combination. Mandatory domestic routing requires payments to be switched through a licensed national infrastructure. Local licensing restricts collecting funds on behalf of third parties to entities incorporated in the country. Data localization bans storing payment data outside the country. Price caps set by regulators limit what an acquirer may charge. All four levers are matters of national law, and none of them can be negotiated with a provider.

These measures reflect a deliberate policy of sovereignty over payment rails, and they draw explicit trade objections. The Office of the US Trade Representative lists GPN and the QRIS standard among market-access barriers in its 2025 report. The trend is reaching markets that had imposed nothing until now: Australia is preparing to bring cards issued outside the country under its interchange cap. The direction of travel is toward more of these rules. Market-entry plans that count on their eventual removal rest on a fragile assumption.

India, Turkey, Indonesia: three doors, three locks

India, Turkey, and Indonesia regulate merchant acquiring through three distinct mechanisms, each targeting a different link in the payment chain. The three markets tend to appear together in international expansion plans, where they are often treated as a single bloc. India restricts access through the status of the intermediary, which must hold a payment aggregator authorization from the central bank. Turkey restricts it through licensing and pricing, requiring non-bank providers to hold a local license and apply a capped fee schedule. Indonesia restricts it through the technical path, requiring domestic transactions to be switched through licensed operators. The upfront legal analysis therefore focuses on the entity in India, on licensing and pricing in Turkey, and on the technical connection in Indonesia.

India: the intermediary’s status drives everything

In India, the processing chain runs from the merchant to a licensed aggregator, then to a PSP bank, and finally to NPCI. The aggregator is the link that carries the authorization requirement. The Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025, published on September 15, 2025, split the activity into three authorizations that a provider can hold separately: PA-O for online, PA-P for in-person, and PA-CB for cross-border. The applicant must be a company incorporated in India under the Companies Act, 2013. Its net worth must reach ₹15 crore when it applies, then ₹25 crore by the end of the third financial year after authorization. Collected funds are held in an escrow account with a scheduled commercial bank. The PA-CB regime adds separate collection accounts for inbound and outbound flows, with no netting between them, and caps each transaction at ₹25 lakh. Without an Indian entity, a merchant can collect only through a third party holding a PA-CB authorization, and that per-transaction cap then applies to the merchant’s sales. On top of this, tokenization has been mandatory since October 1, 2022. Then, from October 1, 2026, Indian issuers must authenticate cross-border card-not-present transactions.

Turkey: a local license, then an administered price schedule

The regime for non-bank providers rests on Law No. 6493 of 2013. Since January 1, 2020, licensing and supervision have been handled by the central bank rather than the BDDK, a change that much of the English-language documentation still overlooks. The TCMB’s public registers listed 20 licensed payment institutions and 55 licensed e-money institutions, against 14 revoked e-money licenses and 10 revoked payment institution licenses (registers checked in September 2026). Those revocations show that licenses do get withdrawn in practice. Pricing, in turn, is set by an administrative cap rather than commercial negotiation. The TCMB publishes maximum merchant fee rates every month. For August 1–31, 2026, a card issued abroad is capped at 1.90%, a Turkish debit card at 1.04%, and a single-payment credit card transaction at 3.56%. Installment payments carry a maximum surcharge of 1.780% per additional installment. The banking transactions tax comes on top of these caps. Finally, an incoming acquirer must be certified for TROY, BKM’s domestic scheme, which held 25.3% of the market by value at the end of 2025, up from 18.3% a year earlier (BKM press release, January 23, 2026).

Indonesia: the technical path comes before the contract

Bank Indonesia Regulation No. 19/8/PBI/2017, in force since June 22, 2017, requires domestic payment transactions to be processed through the Gerbang Pembayaran Nasional (National Payment Gateway). Four switches are licensed: Artajasa, Rintis, Alto, and Jalin. Final settlement takes place at the central bank. The system gave rise to a domestic GPN debit card with lower interchange, and in 2022 the country launched a domestic credit card, Kartu Kredit Indonesia, initially limited to government procurement. Most retail payments, however, run on other instruments. The QRIS standard, backed since 2019 by Bank Indonesia together with the Asosiasi Sistem Pembayaran Indonesia, had 32.71 million merchants enrolled and 50.50 million users (Bank Indonesia, 2024 data). Card acceptance alone therefore covers only a fraction of the market. The rest goes through QRIS, super-app wallets, and bank virtual accounts, unique transfer references issued for each order.

Authorization rates: what the issuer sees

The authorization rate is the ratio of authorization requests approved by issuers to the requests submitted to them. The acquiring setup affects this ratio, and that effect is better documented than its effect on fees. A transaction acquired abroad reaches the issuer with a foreign acquirer ID, and the issuer’s decision engine places it in the matching segment. The cardholder, the card, and the balance are the same under either setup. The only difference is where the authorization message comes from. That segment applies stricter decline rules, so the same request is declined more readily.

• The acquirer ID is foreign. Issuer fraud models weight this signal heavily, because cross-border fraud really is more concentrated than domestic fraud.
• The merchant descriptor means nothing locally. A foreign entity name, with no recognizable city and no transliteration into the cardholder’s script, hurts both the issuer’s decision and the later dispute rate.
• Local authentication is missing. Where a national authentication scheme exists but the foreign acquirer doesn’t support it, the issuer loses the one element that would have let it approve.
• The country mandates a factor the acquirer doesn’t support. India is the clearest example, with the October 1, 2026, deadline for cross-border card-not-present transactions.
• Enriched data gets lost. Level 2 and Level 3 fields, local tax IDs, and standardized order references all improve the decision. They are often dropped in a layered setup.
• The currencies don’t match. A local card charged in a foreign currency adds a reason to decline and a reason to dispute, regardless of the amount.

Two diagnostic mistakes come up again and again. The first is treating a structural decline with retries. Piling up attempts on a decline caused by the setup hurts the acquirer’s ratios, invites network penalties, and recovers almost nothing. The second is turning off authentication to “unblock” the flow. The authorization rate climbs for a few days, then fraud and disputes follow, and the real cost exceeds the gain before the quarter is out. The fix that addresses the cause is to move the acceptance contract to the issuer’s country, through a local entity or a provider that already acquires there.

Merchant of record: selling by proxy

The merchant of record is the entity that legally sells to the end customer. It contracts with the customer, issues the invoice, collects indirect tax, appears on the bank statement, and handles disputes. In a resale setup, that entity is the provider, not the merchant behind the offering. The provider buys the merchant’s product, resells it in its own name, and then pays the merchant the net proceeds. What separates this from simple payment collection is the legal role of each party. A provider that collects on the merchant’s behalf acts as its agent, whereas a merchant of record buys in order to resell, which makes the merchant its supplier.

The main reason for choosing this setup is indirect tax. Selling a digital service to a consumer triggers an indirect tax obligation in the consumer’s country, with no threshold in a growing number of jurisdictions. In the EU, the deemed supplier regime shifts that obligation to the electronic interface that facilitates the sale. The Import One-Stop Shop (IOSS) has covered shipments of goods up to €150 per consignment since July 1, 2021. In the US, the marketplace facilitator laws that states adopted after the 2018 South Dakota v. Wayfair ruling have a comparable effect on sales tax. The merchant of record takes on these indirect tax obligations, including collection, in every market it covers. That, rather than access to acquiring, is the primary reason merchants adopt it.

• You lose the billing relationship with the customer. The bank statement descriptor, payment reminders, and renewal notices all carry the provider’s name. For a subscription business, that is an asset you give away.
• Coverage is limited to the provider’s catalog. A merchant of record opens only the methods it already runs. A domestic rail missing from its offering will stay missing.
• The cost is a margin on revenue, usually well above an acquiring fee. Compare it with the full cost of the alternative, including legal structure and compliance.
• Reversibility must be written into the contract. Migrating to a local entity means taking back the billing history, the card tokens, and the recurring mandates. Without an explicit clause, none of the three comes with you.
• Concentration creates risk. A single seller of record for all markets means a single point of regulatory, contractual, and banking failure.

Dynamic currency conversion from the acceptance side

Dynamic currency conversion (DCC) is a currency exchange offered to a foreign cardholder at the point of payment, who then pays in the card’s currency rather than the merchant’s. A provider working with the acquirer sets the rate on the spot, margin included. For the cardholder, the rate is almost always unfavorable. For the merchant, DCC creates a revenue line, because part of the conversion margin is shared back. That revenue share explains why DCC persists. It also explains why reviewing it mixes a revenue question with a customer treatment question, two considerations that management rarely separates. DCC is therefore a margin-sharing arrangement, proposed by the conversion provider and decided by the merchant, not a payment service.

The business case for DCC often stops at the rebate, which is certain and immediate revenue. The costs are spread across less visible items: disputes over incorrect amounts, customer service contacts, lower review scores at tourist locations, and compliance risk if the way the choice is presented drifts. Across a store network where foreign customers are occasional, too few transactions get converted to cover those costs. Across an airport network, the share of foreign cards pushes revenue well above them. The trade-off therefore depends on the customer mix, which varies from one location to another within the same retail brand.

The hidden costs of multi-currency acceptance

Multi-currency acceptance is a setup in which one merchant sells in several currencies, and the settlement currency may or may not match the currency of sale. It stacks up charges that the monthly statement never shows side by side. Some are billed as a percentage, others per transaction, and others stay invisible because they are built into an exchange rate. The headline acceptance fee rate therefore says nothing about the true cost of accepting payments. A gap of two percentage points between the two is common on a poorly structured international flow.

Displayed sale ........................   100.00  customer currency
  - interregional CNP interchange .....    -x.xx  card category
  - cross-border network fees .........    -x.xx  ad valorem + fixed per transaction
  - acquirer margin ...................    -x.xx  only negotiable line
= net before FX .......................    xx.xx  currency of sale

  - conversion sale -> settlement .....    -x.xx  provider margin
= credited ............................    xx.xx  settlement currency

  - conversion settlement -> treasury .    -x.xx  bank margin
  - transfer fees per currency ........    -x.xx  flat fee
= available ...........................    xx.xx  treasury currency

Two conversions instead of one: the signature of a setup
in which nobody ever chose the settlement currency.

Declines are the last cost item, and they appear on no invoice. A declined sale generates no fee, so it never shows up in acceptance cost tables. On international flows, revenue lost to declines typically exceeds all the lines above combined. A six-week negotiation over two basis points of acquirer margin therefore targets a smaller item than declines, whose size stays unknown until the authorization rate has been measured by BIN. The resulting order of priority holds from one market to the next: fix declines first, unnecessary conversions next, and acquirer margin last.

Building multi-country acquiring

A global acquiring architecture is the set of acceptance setups chosen market by market, each with its own provider, settlement currency, and set of payment methods. It is built through a sequence of decisions whose order cannot be rearranged after the fact. The legal structure determines access to the rails, access to the rails determines checkout coverage, and checkout coverage determines actual revenue. Launching a provider tender first locks in the technical choices before the legal structure and the target coverage have been decided.

• Verify the provider’s exact license, not just its presence in the country. “We are licensed” doesn’t say by whom, for what activity, or since when.
• Get the interchange category written down for each market’s transactions: intraregional, interregional, or domestic. That line determines the cost.
• Require raw issuer response codes for every transaction. A provider’s aggregated labels can’t distinguish an insufficient-funds decline from a decline caused by the setup.
• Isolate the FX margin in basis points over a named reference rate, and audit it on a real sample rather than the contractual schedule.
• Separate merchant IDs by country, channel, and settlement currency. An incident in one scope must not spill over into the others, and any future multi-acquirer setup depends on it.
• Document the exit before you enter: card tokens, recurring mandates, billing history. Those three assets are what block a migration.