Hosted & Embedded
Platform and operating services on the agreed acquiring foundation. The table below describes this allocation.
The foundation beneath
every proposition.
The regulated, operational and security foundations that support the propositions partners build.
Understand who operates what, which permissions apply and what evidence is available. Your arrangement may use the agreed acquiring foundation or your organisation’s own permissions.
The questions partners need answered.
Start with the arrangement, then the controls and supporting evidence. Expand a question for its scope and programme-specific qualifications.
Entities & responsibilities
Who is the regulated entity?
Regulatory position
Verofy® Acquiring is authorised and regulated by the Financial Conduct Authority under the Payment Service Regulations 2017, a trading name of Verofy Ltd. PayFacLite® is a Verofy Group company and is not itself the regulated entity.
Financial Conduct Authority firm reference 785762
This identifies the Verofy acquiring foundation, not the regulated entity for every partner arrangement. A partner may operate under its own permissions or an agreed acquiring programme. The relevant entities and their roles are confirmed for each arrangement.
What does PayFacLite® operate?
Responsibility
PayFacLite® provides the agreed platform, integration infrastructure and operating services. In Hosted and Embedded arrangements, these support onboarding, payment processing, risk controls, settlement and reconciliation on the agreed acquiring foundation.
Platform delivery is distinct from regulatory accountability. The relevant regulated entity retains its applicable obligations; the partner may be that entity where it operates under its own permissions.
What remains with the partner?
Responsibility
The proposition and the customer experience: product, journeys, packaging and pricing within agreed parameters, merchant communication and support, within the programme and risk parameters agreed with PayFacLite®.
Under the licensed models, responsibilities follow the acquiring and programme structure or the organisation’s own permissions.
How do responsibilities change by model?
Responsibility
Hosted and Embedded use the agreed operated platform and acquiring foundation. In a PayFac arrangement, the responsibility split follows the acquiring programme. In an Acquirer arrangement, the partner can use the platform under its own permissions and operating structure. A partner’s existing permissions are considered when any arrangement is designed.
Licensing the platform never confers regulated status, and the arrangement for each programme is confirmed in writing.
Controls & operations
How are payment and card data handled?
Operational control
Card payments handled on the agreed acquiring foundation are subject to its PCI DSS Level 1 scope. Your own obligations depend on where card data is captured, transmitted and stored, and the integration and operating arrangement. Personal data responsibilities are confirmed for the programme.
Your own PCI scope is confirmed against the integration method you choose.
How are relevant funds treated?
Regulatory position
Relevant funds are safeguarded in line with the requirements applicable to the responsible regulated entity. In an operated arrangement, settlement and safeguarding follow the agreed acquiring foundation. Where a partner operates under its own permissions, its applicable responsibilities remain with it.
The funds flow, responsible entities and safeguarding arrangements are confirmed for the programme; using the platform does not transfer regulatory obligations.
How are access and environment controls governed?
Operational control
Environment separation, scoped and revocable credentials, signed webhook events and permissioned tools support controlled access. Agent and playground access is limited to permitted tools and documented capabilities.
Environment configuration, access controls and production approval responsibilities are agreed for the integration.
How are incidents handled?
Operational control
Incidents affecting partners are communicated directly, with a post-incident summary. Platform status is made available to partners under the operating model agreed with each partner.
Notification routes and timings are agreed for the programme.
Evidence & diligence
What resilience is available?
Due diligence
The resilience arrangements that apply to a programme, and the operational commitments that go with them, are established for that programme rather than stated as one universal position. What is published here today is the incident-communication position and the platform-status arrangement above.
Resilience arrangements, dependencies and any operational commitments are confirmed in writing for the programme.
What evidence is available?
Due diligence
The regulated entity record, the PCI DSS Level 1 standard and the safeguarding position are stated on this page. The PCI attestation, the sub-processor list and supporting documentation are provided during diligence, through the partner team and under the appropriate agreement.
What requires programme-specific confirmation?
Due diligence
The operating model, the responsibility split, the risk parameters, the support model, incident communication, territorial availability and the eligibility of additional products such as lending.
Each is confirmed in writing for the programme before anything is built.
How does deeper diligence begin?
Due diligence
Through the partner team after the first conversation, with your risk, compliance and security functions included.
Clear roles. Defined responsibilities.
The platform arrangement and the regulatory position are considered together. Responsibilities follow the actual permissions, contracts and operating roles—not simply the model name.
PayFac
Responsibilities follow the agreed acquiring programme and the roles of each party.
Acquirer
A partner can operate under its own permissions, with PayFacLite® providing the agreed technology and services.
Operated-model allocation
Who does what.
Hosted and Embedded, the operated arrangements.
Not a universal allocation for every partner.
Scroll across to compare all three roles →
| Activity | Your businessPartner | Platform & operationsPayFacLite® | Regulatory accountabilityRegulated entity |
|---|---|---|---|
| Proposition & customer experience | |||
| Proposition and brand | Primary | — | — |
| Customer relationship | Primary | — | — |
| Merchant relationship and support | Primary | Supports | Retains responsibility |
| Product configuration | Primary | Supports | — |
| Payments & regulated operations | |||
| Merchant onboarding | Supports | Primary | Retains responsibility |
| Acquiring and payment processing | — | Primary | Retains responsibility |
| Risk policy and decision controls | Defined by the applicable programme | Primary | Retains responsibility |
| Settlement and reconciliation | — | Primary | Retains responsibility |
| Safeguarding responsibilities | — | Supports | Retains responsibility |
| Oversight & assurance | |||
| Incident coordination | Supports | Primary | Defined by the applicable programme |
| Regulatory reporting and returns | Defined by the applicable programme | Supports | Retains responsibility |
| Security controls and evidence | Supports | Primary | Defined by the applicable programme |
| Audit and due diligence | Defined by the applicable programme | Supports | Defined by the applicable programme |
This table describes Hosted and Embedded arrangements only. It does not allocate responsibilities for partners operating under their own permissions. For every programme, the entities, permissions, funds flow and operating responsibilities are confirmed in writing. A dash means no role is allocated in this overview, not an exemption from applicable obligations.
Standards, scope and evidence.
The regulatory, security and operational standards relevant to the PayFacLite® foundation. Scope and applicability should always be understood in the context of the relevant programme.
Regulatory entity and permissions
Verofy® Acquiring, authorised and regulated by the Financial Conduct Authority under the Payment Service Regulations 2017
- Scope
- The Verofy acquiring foundation used in the applicable operated arrangement. PayFacLite® is not itself the regulated entity. Partners using their own permissions have their own regulatory scope.
- Evidence
- Firm reference 785762, on the Financial Conduct Authority register
Card data
PCI DSS Level 1
- Scope
- The relevant card-payment environment. Partner PCI obligations depend on the integration, data flow and operating arrangement; they are not automatically removed by using the platform.
- Evidence
- Attestation provided during diligence, under the appropriate agreement
Safeguarding
Relevant funds are safeguarded in line with regulatory requirements
- Scope
- The responsible regulated entity and funds flow for the programme, including the partner where it operates under its own permissions.
- Evidence
- Confirmed for the programme during diligence
Information security controls
Signed events, scoped and revocable credentials, environment separation, permissioned tools
- Scope
- The platform and its integration surfaces, across sandbox, test, staging and production.
- Evidence
- Documented in the reference issued with developer access
Incident management
Direct communication to affected partners, with a post-incident summary
- Scope
- Incidents affecting partners. Platform status is made available under the operating model agreed with each partner.
- Evidence
- Notification routes and timings confirmed for the programme
Due-diligence material
Provided through the partner team under the appropriate agreement
- Scope
- The PCI attestation, the sub-processor list and supporting documentation.
- Evidence
- Requested through the partner team
Recorded source review: 5 November 2025. Current scope and supporting evidence are confirmed during programme diligence.
Some answers need the context of your programme.
Bring your existing permissions, acquiring relationships and proposed funds flow into the conversation. We work through the responsibility split, territorial and product scope, controls and supporting evidence with your commercial, risk, compliance and technical teams.
Acquiring infrastructure for international platforms.
Build and operate across the UK, Europe and the United States from a single governed PayFacLite® operating foundation.
United Kingdom
Regulated acquiring foundation
Europe
Infrastructure for multi-market propositions
United States
Infrastructure for international growth
Market availability depends on programme structure, product scope and applicable regulatory requirements.
- Verofy Ltd (trading as Verofy® Acquiring) — FCA Authorised Payment Institution
- PCI DSS Level 1
- Safeguarding in line with regulatory requirements
- United Kingdom
What will you build?
Keep control of the customer relationship, shape a proposition that’s yours, and create more value in your business. We’ll help map the right operating model.
A clear view of your platform route.
- Your proposition
- Who it serves and what it offers.
- The operating model
- Where the regulatory boundary sits.
- Delivery and integration
- How your team connects and goes live.