The payments company that never touches the money
Most payment chains include firms that move data rather than money. A gateway passes card details to an acquirer, a processor routes authorization messages and a vendor runs the terminals. EU law gives these firms a name and takes them out of payment licensing, provided they never hold the funds.
The test sits in Article 3(j) of the EU’s second Payment Services Directive, PSD2. It excludes “services provided by technical service providers, which support the provision of payment services, without them entering at any time into possession of the funds to be transferred”.
The article lists examples, including processing and storage of data, trust and privacy protection services, data and entity authentication, IT and communication network provision, and the provision and maintenance of terminals and devices used for payment services.
Two services the exclusion never covers
The same sentence ends with an exception. Payment initiation services and account information services are left out of the exclusion, even though neither needs to hold money. A company that initiates payments from a customer’s bank account, or pulls account data for a budgeting app, is providing a payment service listed in the directive’s Annex I (points 7 and 8), however technical its role looks.
The UK and US versions
Britain copied the wording. Schedule 1, Part 2 of the Payment Services Regulations 2017 excludes “technical service providers, which support the provision of payment services, without the provider entering at any time into possession of the funds to be transferred”, with the same carve-out for payment initiation and account information.
The US has no term with the same name, but federal anti-money-laundering rules draw a similar line. A person who “acts as a payment processor to facilitate the purchase of, or payment of a bill for, a good or service through a clearance and settlement system by agreement with the creditor or seller” is excluded from the definition of a money transmitter under 31 CFR 1010.100(ff)(5)(ii)(B).
The exclusion may narrow
The EU is replacing part of PSD2 with a directly applicable Payment Services Regulation. When Parliament and Council negotiators struck the deal in November 2025, the Parliament’s press release said the regulation “applies to payment services provided by banks, post-office giro and payment institutions, as well as technical service providers supporting payment services”.
Which duties fall on technical providers depends on the final text, so a gateway that relies on the exclusion today should check it again once the regulation is published.
Possession is the test, not the label
The common mistake is to treat the exclusion as a status a company can claim because it builds software. It turns on what happens to the money. A gateway that receives card payments into its own account and pays merchants later is in possession of funds, whatever it calls itself, and falls back into payment licensing, usually through an acquiring bank partner or a payment institution license of its own.
The exclusion doesn’t reach card security rules either. A technical provider that stores, processes or transmits card data is still covered by PCI DSS, whatever its licensing position.
If you run or buy a gateway, trace where the money sits between the customer’s payment and the merchant’s payout. If at any point it sits in an account your company controls, the technical service provider exclusion does not apply to that flow.