Payment processing chains in Iraq have become longer and more complex. A single card or QR payment at a merchant may involve the merchant’s acquiring bank, a payment gateway, a processor, the national switch, the card scheme, the issuing bank and one or more technology vendors. Each participant performs part of the transaction, holds some data and may hold funds at some point. When a payment fails, is duplicated or turns out to be fraudulent, the question of who bears the loss depends on how the chain was structured and documented.
For businesses participating in these chains, whether as banks, licensed payment providers, merchants or technology suppliers, understanding where outsourcing, settlement and liability intersect is essential. Regulatory responsibility, contractual liability and practical control may sit with different participants, and gaps between them are where losses and disputes arise.
The Central Bank of Iraq Law No. 56 of 2004 and the Electronic Payment Services for Funds Regulation No. 2 of 2024 govern payment service providers and the national payment system. Central Bank instructions on outsourcing, settlement, information security and card and electronic payments supplement this framework. The Banking Law No. 94 of 2004 governs banks’ participation. Card scheme rules, incorporated by contract, govern scheme transactions. The Iraqi Civil Code No. 40 of 1951 governs contractual and tortious liability between participants, and the Anti-Money Laundering and Counter-Terrorism Financing Law No. 39 of 2015 applies to those dealing with customers and funds.
Mapping the payment processing chain in Iraq
The starting point is a map of each participant and its role:
- Merchant. Sells goods or services and accepts payment.
- Acquirer. The licensed institution that contracts with the merchant and is responsible for settling funds to the merchant.
- Gateway or processor. Captures and routes transaction data, sometimes on behalf of the acquirer.
- Switch. Routes transactions between institutions.
- Scheme. Sets rules for card or other scheme transactions.
- Issuer. Holds the customer’s account or card and authorises the payment.
- Technology vendors. Provide software, hosting or security services to any of the above.
For each participant, the map should identify its regulatory status, the contracts it is party to, the data it handles and whether it holds funds.
Outsourcing within the chain
Licensed institutions often outsource significant functions to processors and vendors. Under Central Bank requirements, the licensed institution remains responsible for outsourced functions and must assess, contract with and monitor its providers. Outsourcing contracts should include service levels, security standards, audit rights, regulatory access, incident notification and exit provisions. Where a processor itself subcontracts, the licensed institution should know who the subcontractors are and ensure that obligations flow down.
Settlement risk
Settlement is where money actually moves, and where participants are exposed to each other’s failure. Key questions include:
- Who holds merchant funds between authorisation and settlement?
- How long are funds held, and in whose accounts?
- What happens if a participant in the middle of the chain becomes insolvent or has its licence suspended?
- How are settlement failures, duplicates and reversals identified and corrected?
Merchants should understand that if a gateway or aggregator holds their funds, they may be exposed to that entity’s credit risk. Acquirers should ensure that settlement arrangements with processors protect merchant funds and comply with safeguarding expectations.
Liability for failed and fraudulent transactions
Liability allocation depends on contracts, scheme rules and general law. Typical scenarios include:
- Unauthorised transactions. Usually resolved between issuer and customer first, then through scheme chargeback rules to the acquirer and merchant.
- Processing errors. A processor’s system error may cause duplicated or misrouted payments; liability depends on the processing agreement and the processor’s negligence.
- Data breaches. A breach at a gateway may lead to fraud losses across many institutions; liability depends on security obligations and causation.
- Settlement delays. A participant’s failure to settle on time may cause losses to merchants; contracts should specify cut-off times and remedies.
Each contract in the chain should be reviewed to confirm that liability flows to the participant in control of the relevant risk, and that limitations of liability do not leave others exposed without recourse. Commercial contract advice in Iraq can help align liability provisions across the chain.
Data, security and incident coordination
Payment chains carry sensitive data. Each participant must protect the data it handles and notify others of incidents. Contracts should define incident notification timelines, cooperation in investigation and responsibility for customer and regulatory notifications. Without coordination, a breach at one point may go unreported to the institutions that bear the consequences.
Regulatory status of each participant
Not every participant needs its own licence, but participants that hold funds, contract with merchants or provide payment services to the public usually do. Licensed institutions should check that their partners have the authorisations their roles require. Facilitating an unlicensed participant may expose the licensed institution to criticism.
Dispute resolution across the chain
When losses arise, disputes may involve several participants under different contracts with different governing laws and forums. Aligning dispute resolution clauses, or at least anticipating multi-party disputes, can reduce cost and inconsistency. Scheme rules may provide their own arbitration or dispute procedures for scheme transactions. Arbitration advice for Iraqi disputes can assist in designing forum provisions suited to multi-party payment disputes.
Due diligence on chain participants
Before joining a payment chain, each participant should conduct due diligence on the others it contracts with. That includes verifying licences, reviewing financial standing, assessing security certifications and controls, understanding subcontracting arrangements and checking for regulatory sanctions or disputes. Due diligence should be refreshed periodically, particularly for participants that hold funds or sensitive data. A participant that discovers late that a partner lacked a required licence or had weak security may find that its contractual remedies are of little practical value.
Illustrative example. An online retailer uses a gateway that aggregates payments and settles to the retailer twice weekly. The gateway’s processor suffers a system failure that duplicates several thousand transactions, and customers’ banks reverse the duplicates through chargebacks. The retailer’s settlement is reduced by the chargebacks, although it never received the duplicate funds. Review of the contracts shows that the gateway agreement lacks a clear allocation of responsibility for processor errors. The retailer negotiates a new agreement with the gateway, and the gateway amends its processor contract to include indemnities for processing errors and daily reconciliation obligations.
Key takeaways
- Payment processing chains in Iraq involve multiple participants whose regulatory, contractual and practical responsibilities may not align.
- Licensed institutions remain responsible for functions they outsource within the chain.
- Settlement arrangements determine who is exposed if a participant fails.
- Liability, incident notification and dispute provisions should be aligned across all contracts in the chain.
How Etihad Can Help
Understanding payment processing chains in Iraq allows participants to identify where risk sits, allocate it through contracts and meet their regulatory obligations. A clear map of the chain is the foundation of that understanding.
Etihad Law Firm advises banks, payment providers, merchants and technology companies on payment chain structuring, outsourcing compliance and liability allocation in Iraq. We help clients design arrangements that protect them when transactions go wrong.