February 2025 Summaries

Global payment processing enables businesses to send or receive funds across national borders when the payer’s and recipient’s banks are in different countries, providing the infrastructure behind cross-border transactions. Global payment processors act as intermediaries among banks and other financial parties, commonly offering currency conversion, international fraud prevention, security, compliance support, and settlement in domestic currencies. Established providers such as Stripe, Worldpay, Adyen, and FIS Global coexist with specialized newer platforms that may differ substantially in geographic coverage, supported currencies, and service models. Businesses evaluating these providers should consider target markets, pricing and exchange rates, locally preferred payment methods, regulatory and security capabilities, and ease of integration. Accepting international payments can expand a merchant’s potential customer base, though successful implementation requires understanding regional payment preferences and the broader international payments landscape.

Data masking conceals portions of sensitive values while preserving enough context for legitimate users and systems, such as displaying only the last four digits of a payment card number. It can reduce exposure of plaintext data in activities including customer support, testing, training, demos, third-party sharing, and data migrations, particularly when combined with access controls, identity management, and privacy policies. Static data masking creates a separately masked copy of data for uses such as testing, while dynamic data masking applies permissions in real time so different users see different levels of detail. Common techniques include substitution, redaction with fixed characters, deletion or truncation, and, less securely, shuffling; organizations often combine methods according to security, usability, cost, and implementation needs. Unlike tokenization, which replaces sensitive data with a new token and stores the original in a separate secure environment, masking alters or limits presentation of the original value and does not remove the obligations associated with retaining it. Encryption also obscures data but generally differs from masking because encrypted output lacks human-readable context. Properly implemented masking supports least-privilege access, regulatory compliance efforts, reduced breach impact, and continued usability of data without broadly exposing sensitive information.

Omnichannel payments aim to provide customers with a consistent, low-friction checkout experience across physical stores, websites, mobile apps, telephone orders, QR codes, and messaging channels. As consumers increasingly expect recognition and reusable payment methods regardless of where they shop, inconsistent experiences can reduce conversions, with many customers willing to switch merchants or pay more for easier checkout. For merchants, unifying payment activity can improve customer data, support targeted upselling and cross-selling, and increase lifetime value through stored payment details. However, implementation requires securely sharing payment information across systems, supporting channel-specific preferences such as digital wallets or cards, maintaining multiple payment service providers, and using backend decisioning to route transactions effectively. A programmable payment vault can serve as a central secure repository for customer data, helping merchants avoid building their own high-level PCI-compliant storage while retaining flexibility to choose payment partners based on cost and transaction needs.

Payment facilitators (PayFacs) and independent sales organizations (ISOs) both help merchants enter the payments ecosystem, but they operate differently and suit different priorities. A PayFac allows businesses to process payments as sub-merchants under its main account, providing shared infrastructure, security, fraud monitoring, settlement, reporting, and rapid onboarding in exchange for ongoing transaction-based fees and significant control over risk decisions. An ISO instead connects merchants with banks, payment service providers, gateways, and other partners, helping arrange direct contractual relationships while typically being compensated by providers rather than through a share of merchant transactions. PayFacs can offer convenience and speed, particularly for new businesses, but may create dependence on one provider, limit control over customer data and pricing, and expose merchants to account restrictions based on risk assessments. ISOs may require more time and coordination initially, yet can help merchants build a diversified payment network with greater control over fees, geographic coverage, business continuity, and long-term processing economics.

January’s platform updates introduced new Search and List v2 endpoints that deliver roughly 10 times the performance of existing v1 endpoints and improve card-token creation speed by three times, with the v1 Search and List endpoints scheduled for deprecation on March 6, 2025. The company also released redesigned SDKs for Node.js, Java, .NET, Python, Go, Web Elements, Android Elements, and iOS Elements, adding capabilities such as automatic pagination and request retries while improving feature-delivery speed and API parity. Customers can now choose to present 3DS authentication challenges through a redirect to a separate page or window rather than only a modal, allowing more flexibility in checkout design. Additional fixes include React 19 peer-dependency support, improved network-error handling in React and Web Elements, onFocus and onBlur handlers for React Native, and a card property added to all API tokens.

Payment facilitators, or payfacs, enable businesses to process payments through a master merchant account, allowing vertical SaaS platforms to embed payment services for their customers rather than directing transaction revenue to third-party payment service providers. By becoming a payfac, platforms can potentially earn roughly 20 to 50 basis points per transaction, improve onboarding and payment experiences for merchants, and reduce the complexity and support risks associated with multiple bespoke payment integrations. The process involves securing an acquiring sponsor, completing rigorous underwriting and PCI-DSS Level One certification, registering with card networks such as Visa and Mastercard, meeting applicable European licensing requirements, building and testing a payment system, and establishing customer onboarding, monitoring, settlement, reporting, and risk-management procedures. Although upfront compliance, technology, and operational costs can be substantial, programmable payment vaults may reduce the burden of securely storing cardholder data and provide flexibility to change acquiring partners. Growing demand for embedded payments is positioning payfac services as a potential competitive advantage, with forecasts estimating more than $4 trillion in payfac-processed payments and approximately $16 billion in associated platform revenue in 2025.

Merchants increasingly use multi-PSP strategies to improve payment authorization rates, reduce customer churn, and add redundancy, but extending this flexibility to Apple Pay and Google Pay can be difficult because their encrypted tokens, device account numbers, and processor requirements differ from standard card payments. Apple Pay uses device-specific primary account numbers and encrypted payment tokens tied to merchant certificates and verified domains, while Google Pay can return either PAN-based or device-tokenized data through gateway or direct tokenization methods, with direct decryption requiring PCI DSS Level 1 compliance. Basis Theory presents its payment vault and tokenization tools as a way to simplify implementation and decouple these wallet payments from a single processor, allowing merchants to securely decrypt or manage payment data and route transactions among multiple PSPs.