Gulf · EU · US
Payments Atlas covers payment gateways, banking APIs and fintech regulation across the Gulf, the European Union and the United States. The focus is practical: how these systems behave in code, what the documentation leaves out, and what the underlying rules actually require.
Guides are written from sandbox work and runnable examples. Analysis is sourced to the regulator, framework or published pricing document itself.
Why this site exists
Most English-language coverage is either vendor documentation or marketing. Payments Atlas exists to fill the gap with narrower, more technical and more heavily sourced material than a general fintech publication.
How the work is checked
Technical claims are checked against public documentation and, where possible, against test integrations. Regulatory claims are traced to the original publication rather than to summaries. Pricing figures are attributed and dated, because provider pages change without notice.
Newest across both sections
Guide
Authentication is not a capture. Which states your API has to persist, why the shopper return and the webhook will race, and what not to infer from a redirect.
GuideHTTP
How to make a charge endpoint safe to retry: key scope, hashing the raw body, the 409 on a mismatched payload, and the race a unique index has to close.
Guide
Payment webhooks do not arrive in causal order. How to apply them with a state machine and an event id, instead of trusting which HTTP request landed first.
Guide
Which payment HTTP failures are safe to retry, why a timeout is not one of them, and how backoff without an idempotency key charges the customer twice.
Guide
A captured payment is not settled money. How to match a settlement file to your ledger on the provider reference, and which mismatches need a person.
Guide
A sandbox proves your request is well formed. It does not prove settlement timing, issuer behaviour, or failures that show up only with real cards.
AnalysisGulf
Under the CBUAE regulation, cross-border fund transfer is a named service and is absent from the lower licence category. Remittances are defined separately.
AnalysisGulf
Licence categories and capital floors in the SAMA and CBUAE payment regulations, and where the two regimes do not line up.
AnalysisGlobal
SAQ A still means the merchant never touches the card number. The January 2025 change is an eligibility rule for pages that embed the payment form.
AnalysisGulf
What SAMA and the Central Bank of the UAE have published about sarie and Aani: launch dates, who participates, and the customer fee cap sarie put in a circular.
GuideCheckout.com
How Checkout.com signs webhooks, why the raw body matters in .NET, and how to verify Cko-Signature without breaking model binding.
AnalysisBahrain
Bahrain’s rules are unusually explicit about what banks owe AISPs and PISPs: a dedicated interface, a testing facility, uptime parity and core data access.
AnalysisGulf
What the public signup paths of Gulf payment providers required, where they blocked a foreign evaluator, and which routes were self-serve versus sales-led.
AnalysisGulf
How the three Gulf frameworks differ on architecture, licensing, scope and operational burden, and what that means for teams building across them.
AnalysisSaudi Arabia
SAMA moved open banking from sandbox supervision into licensing in March 2026. What the official announcements establish, and what they still leave unsaid.
AnalysisUAE
What the AlTareq FAPI profile actually mandates — and the six places it narrows FAPI 2.0 into a single permitted option.
AnalysisUAE
Certificates, roles and certification — what a TPP has to clear before it can make its first production API call in the UAE.
Guide
The raw-body trap that breaks HMAC verification in .NET, why == is a vulnerability, and how three real providers sign — including one that does not.
AnalysisGlobal
The MUST-level requirements of the FAPI 2.0 Security Profile, and which of your existing OAuth assumptions each one breaks.
AnalysisUAE
The published UAE fee schedule, the page allowances on data sharing, and the pricing rules that quietly constrain how you build.