Who checks that an acquirer holds the right local licenses?

The operator, before opening the market. Every country adds its own rules on licensing, data and security, and the acquirer must comply with them along with the operator. The checks cover the licenses required to process locally, data protection rules such as the GDPR, LGPD or PIPEDA, and PCI DSS for card data.

The operator, before opening the market

An acquirer may be licensed in its home country and able to acquire cross-border under scheme rules, but each market adds its own requirements: local licensing for domestic acquiring, data residency, consumer protection, tax reporting. The operator entering the market is responsible for checking that the acquirer it uses there complies, because the operator's merchants and its own obligations depend on it.

What to check

• Licenses required to process locally, and whether the acquirer holds them or relies on cross-border passporting.
• Data protection rules: GDPR in the EU, LGPD in Brazil, PIPEDA in Canada, and local equivalents.
• PCI DSS validation of the acquirer and its processors.
• Scheme membership for the local schemes the market uses.

How to do it

Ask the acquirer for its licenses and attestations per market, and keep them on file with expiry dates. Confirm with local counsel where the answer is unclear, especially for domestic acquiring models. Record the result in the provider's profile on the platform, so the market activation is traceable. Operators expanding fast often skip this step and discover a gap when a merchant or a regulator asks; the check takes days, the gap can take months.