Gulf · EU · US
Payments Atlas covers payment gateways, banking APIs and fintech regulation across the Gulf, the European Union and the United States. The focus is practical: how these systems behave in code, what the documentation leaves out, and what the underlying rules actually require.
Guides are written from sandbox work and runnable examples. Analysis is sourced to the regulator, framework or published pricing document itself.
Why this site exists
Most English-language coverage is either vendor documentation or marketing. Payments Atlas exists to fill the gap with narrower, more technical and more heavily sourced material than a general fintech publication.
How the work is checked
Technical claims are checked against public documentation and, where possible, against test integrations. Regulatory claims are traced to the original publication rather than to summaries. Pricing figures are attributed and dated, because provider pages change without notice.
Newest across both sections
GuideCheckout.com
How Checkout.com signs webhooks, why the raw body matters in .NET, and how to verify Cko-Signature without breaking model binding.
AnalysisBahrain
Bahrain’s rules are unusually explicit about what banks owe AISPs and PISPs: a dedicated interface, a testing facility, uptime parity and core data access.
AnalysisGulf
What the public signup paths of Gulf payment providers required, where they blocked a foreign evaluator, and which routes were self-serve versus sales-led.
AnalysisGulf
How the three Gulf frameworks differ on architecture, licensing, scope and operational burden, and what that means for teams building across them.
AnalysisSaudi Arabia
SAMA moved open banking from sandbox supervision into licensing in March 2026. What the official announcements establish, and what they still leave unsaid.
AnalysisUAE
What the AlTareq FAPI profile actually mandates — and the six places it narrows FAPI 2.0 into a single permitted option.
AnalysisUAE
Certificates, roles and certification — what a TPP has to clear before it can make its first production API call in the UAE.
Guide
The raw-body trap that breaks HMAC verification in .NET, why == is a vulnerability, and how three real providers sign — including one that does not.
AnalysisGlobal
The MUST-level requirements of the FAPI 2.0 Security Profile, and which of your existing OAuth assumptions each one breaks.
AnalysisUAE
The published UAE fee schedule, the page allowances on data sharing, and the pricing rules that quietly constrain how you build.