A forex payment gateway is the first place a broker's client money touches. In the EU the rules on where that money must land are stricter than the rules on how it is collected. Most gateway guides skip this part. It is the part a supervisor checks.
Choosing a payment gateway for forex brokers starts with following the money from deposit to withdrawal. Below: where a gateway may settle client funds, why card schemes treat brokers as high risk, how withdrawals should work, and what changes when clients deposit stablecoins. Each rule is traced to the law, the regulator or the card scheme that wrote it.
In short
- Client funds must end up in a separate client account at a bank or a qualifying money market fund (Delegated Directive (EU) 2017/593, Art. 4). A gateway merchant account is only a pass-through, and in Cyprus the money must move on immediately after settlement (CySEC Circular C418, November 2020).
- Visa lists MCC 6211 as "High Integrity Risk Financial Trading Platforms" in its Merchant Data Standards Manual (October 2026), so a broker that relies on cards alone is fragile.
- Instant SEPA transfers arrive within 10 seconds and, at euro area banks since 9 October 2025, come with a free payee name check, which makes them a strong rail for withdrawals.
- Choose a gateway by where it settles, how it returns funds to the source and how it reconciles each day, not by how many payment methods it lists.
What does a forex payment gateway do for a broker?#
A forex payment gateway takes client deposits by card, bank transfer, e-wallet or crypto, pays out withdrawals and reports every movement to the broker's back office and trading platform. The difference from e-commerce is ownership. A shop's revenue belongs to the shop. A broker's deposits belong to its clients.
MiFID II, the EU law for investment firms, states the duty plainly in Art. 16(9): a firm holding client funds must "make adequate arrangements to safeguard the rights of clients and, except in the case of credit institutions, prevent the use of client funds for its own account."
That one sentence changes what a broker needs from its gateway. A gateway built for retail sales settles net of fees into one operating account. A broker needs one that settles gross, into the right account, with a record that ties every euro to a client. The card side of the problem, with reserves and chargeback limits, overlaps with any high risk merchant account. The client money side is specific to brokers.
Where must a forex payment gateway settle client money?#
Client money must end up in a client account at a central bank, an authorised credit institution, a third-country bank or a qualifying money market fund. A payment institution or e-money institution is not on that list. A gateway's merchant account can carry the money for clearing, but it is a stop on the way, not a place to keep it.
What EU law requires#
Commission Delegated Directive (EU) 2017/593 sets out the details. Art. 4(1) says a firm must "promptly" place client funds with one of the four kinds of institution above. Payment and e-money institutions are not among them; that is our reading of the list, as the Directive does not mention them by name. Art. 2(1) adds that client funds must sit in accounts identified separately from the firm's own money, with regular reconciliation against third parties that hold them.
Art. 4(3) limits group exposure: funds deposited with a bank in the broker's own group must not exceed 20% of all client funds, unless the firm shows the limit is not proportionate for a small balance.
What CySEC adds for merchant accounts#
Cyprus hosts many EU forex and CFD brokers, and its supervisor wrote the gateway part down. CySEC Circular C418 (27 November 2020) allows Cyprus investment firms to keep merchant accounts with payment and e-money institutions for clearing client payments in both directions. The conditions are strict:
- client funds must be transferred to the client account at an eligible bank "immediately after the clearing/settlement of the payment transactions";
- if the broker credits a trading account before the deposit settles, it must first move the same amount from its own funds into the client account;
- if the payment provider holds a rolling reserve, the broker tops up the client account from its own money by the same amount;
- the provider must be regulated in an EU Member State or an equivalent third country, and brokers are asked to list their providers on their website.
The circular also closes a common shortcut: "Merchant accounts must be used only and exclusively by CIFs." A broker cannot lend its merchant account to an affiliate or an introducing partner. In the UK, the FCA reaches a similar result through CASS 7.13, which expects client money to be paid directly into a client bank account.
For a gateway buyer this gives one test question: on the day a client deposits €1,000, in whose name is the account where the €1,000 arrives, and how fast does it move to the client account?
Why do card schemes treat forex brokers as high risk?#
Card schemes classify brokers by merchant category code (MCC), and the codes for trading platforms sit in the highest risk groups. Visa's Merchant Data Standards Manual (October 2026) lists MCC 6211 as "High Integrity Risk Financial Trading Platforms" when the card is not present, Under Visa's separate Integrity Risk Program, acquirers must register such merchants before onboarding them.
The same manual places crypto exchanges and on-ramps under MCC 6051 and 6012. It requires a merchant that sells quasi-cash to use one of those codes even when it is not the main business. A broker that lets clients fund an account with crypto bought by card can end up under two high-risk codes at once.
In practice cards carry two risks for a broker. Issuers tend to decline more often on trading platform codes, so deposit success falls. And clients who lose money sometimes dispute the deposit as an unauthorised payment, which pushes up dispute ratios and reserve demands. Brokers usually answer with several acquirers and payment orchestration to route each card to the provider most likely to approve it. Routing raises approval rates, but the dispute risk stays with the card.
How should forex broker withdrawals work?#
Withdrawals should go back to the account or card the money came from, in the client's own name, and profits above the deposit should go to a verified bank account in that name. This "return to source" rule is industry practice and AML defence, not a single article of EU law, so the gateway has to build it with clear exceptions.
The legal basis is broader. The new EU Anti-Money Laundering Regulation (EU) 2024/1624, which applies from 10 July 2027, requires obliged entities, including investment firms, to obtain, where necessary, information on the source and the destination of a client's funds. CySEC's AML inspections, as summarised by a Cyprus law firm in 2018, listed returning funds to the same account they came from, in the client's own name, as good practice.
The hard cases decide whether withdrawals run smoothly:
- Profit above the deposit: a card refund cannot exceed what was paid, so the gateway refunds up to the deposit and sends the rest by bank transfer or, where the card supports it, as a card payout.
- An expired or closed card: the refund fails, and the gateway needs a fallback to a verified bank account in the same name.
- Several deposit methods: withdrawals are split pro rata across sources, or returned in the order the deposits came in, and the rule must be written down.
- Crypto deposits: funds go back to an address the client controls, with travel rule data attached.
Instant SEPA transfers make the bank leg simpler. Under Regulation (EU) 2024/886, euro area banks had to receive instant transfers from 9 January 2025 and send them from 9 October 2025; payment and e-money institutions have until 9 April 2027. Funds must reach the payee within 10 seconds, and instant transfers may not cost more than standard ones. Since 9 October 2025 euro area banks must also check, free of charge, whether the payee's name matches the IBAN and warn the payer if it does not. For a broker that is a useful name check on payouts, though a firm sending payouts in bulk may switch it off.
Which payment methods should a forex broker offer?#
Offer cards for reach, instant SEPA for euro clients and withdrawals, and MiCA-compliant stablecoins for clients who already hold crypto. Each rail fails in a different way, so a broker that depends on one of them is exposed when that one breaks.
| Method | Deposits | Withdrawals | Main risk | Verdict |
|---|---|---|---|---|
| Visa and Mastercard | Instant, familiar to clients | Refund up to the deposit only | High-risk MCC, disputes, reserves | Depends |
| Instant SEPA | Within 10 seconds, euro only | Fast, with payee name check | Euro area banks only | Works |
| Standard SEPA or SWIFT | Slow, one or more days | Fallback for profits | Speed, fees on SWIFT | Depends |
| E-wallets | Fast in some markets | Back to the same wallet | Provider policy on trading | Depends |
| MiCA-compliant stablecoins (USDC, EURC) | Minutes, no chargebacks | Back to a verified address | Travel rule, wallet checks | Works |
| Stablecoins without MiCA authorisation | Possible offshore | Hard to support in the EU | ESMA expects services to stop | No |
Stablecoins work for a broker only if someone converts them to euros and settles to the right account. A crypto to fiat payment gateway does that conversion, but the client money rules from the section above still apply to the euros it pays out.
Can a forex broker accept crypto deposits under MiCA?#
Yes, through one of two routes. Either the broker notifies its regulator and offers the crypto service itself under its MiFID authorisation, or an authorised CASP (crypto-asset service provider) takes the crypto, converts it and pays the broker in euros. Running crypto services in the EU without either route is not allowed.
MiCA, Regulation (EU) 2023/1114, Art. 59, reserves crypto-asset services for authorised CASPs and for certain already-regulated firms. Art. 60(3) lets an investment firm offer the crypto services that match its MiFID permissions, such as custody or exchange of crypto for funds, after notifying its home regulator at least 40 working days in advance. Anything beyond that needs a full MiCA CASP licence. The transition period for firms that operated before MiCA ended on 1 July 2026 at the latest.
Two more rules follow the deposit:
- The travel rule. The Transfer of Funds Regulation (EU) 2023/1113 has applied since 30 December 2024. Crypto transfers must carry originator and beneficiary data. For transfers above €1,000 from a self-hosted wallet, the receiving CASP must check whether the client owns or controls that address.
- The choice of stablecoin. ESMA asked CASPs in January 2025 to restrict services for stablecoins that are not MiCA-compliant. On 8 October 2026 it went further and said CASPs "should cease providing services related to non-MiCA-compliant stablecoins to clients in the European Union", with remaining exposures to be cleared within three months. Circle announced in July 2024 that it is authorised in France to issue USDC and EURC as e-money tokens. For any other token, check ESMA's interim MiCA register before accepting it.
The UK is different again. The FCA has banned the sale of crypto derivatives, including CFDs, to retail clients since 6 January 2021. Crypto as a deposit method is a separate question from crypto as a traded product.
Where does a forex payment gateway not help?#
Where a gateway does not help
- It does not change product rules. ESMA's 2018 limits for retail CFD clients, now national rules, stay in force: leverage of 30:1 on major currency pairs, close-out at 50% margin, negative balance protection and a risk warning.
- It does not make cross-border selling legal. ESMA said in July 2019 that firms outside the EU may serve EU clients only at the client's own exclusive initiative.
- It does not cover UK retail crypto derivatives, which the FCA has banned since January 2021.
- It does not replace your own KYC and AML duties as an investment firm, or a check on clone firms that copy a real broker's name.
How to choose a forex payment gateway: questions to ask#
Ask where the money lands, how withdrawals are routed and what the reports look like. The answers show quickly whether a provider has worked with regulated brokers before.
| Question | Why it matters | Good answer |
|---|---|---|
| In whose account does a deposit settle? | Client money rules | Client account, or pass-through moved on immediately after settlement |
| Is the provider regulated in the EU? | CySEC C418 and due diligence | Named licence and supervisor |
| How are reserves held and released? | You top up the client account | Written terms and a release schedule |
| Is return to source built in? | AML and dispute defence | Rules for profits, expired cards, several methods |
| Can you reconcile every business day? | CySEC expects daily checks | Per-transaction reports with client IDs |
| Does crypto come with travel rule data? | Transfer of Funds Regulation | Originator data and wallet checks above €1,000 |
| Are payouts checked against the payee name? | Wrong-account and fraud risk | Instant SEPA with payee verification |
Cyprus treats daily reconciliation as the norm: C418 expects firms that transact every day to reconcile client bank balances each business day and expects any differences to be timing gaps cleared within a few days. A forex payment gateway that sends one net settlement a week makes that work much harder; good forex payment processing gives you one line per client deposit.
If card acquirers keep declining or freezing you, stablecoins are a payment channel without chargebacks. ItisPay provides the API, invoicing and reconciliation: you accept USDC, BTC and other assets and settle to EUR on an IBAN, from where you move client money to your client bank account, with licensing, KYC and settlement run by our EU-licensed CASP + Payment Institution partner. We work with high-risk merchants; each business is reviewed individually, and onboarding depends on approval by our licensed partners. We do not take weapons, adult content or nutraceuticals.
This article is for informational purposes only and does not constitute legal or regulatory advice.
