Payment processor licensing in Iraq has become a central question for e-commerce platforms, technology companies and international payment firms seeking to enable online payments for Iraqi merchants. Gateways sit between merchants, customers and banks, capturing payment details, routing transactions for authorisation and, in many models, handling settlement to merchants. Depending on how a gateway is structured, it may be a regulated payment service provider requiring Central Bank of Iraq authorisation, or a technology supplier operating under a licensed institution’s responsibility.
As online commerce grows in Iraq, merchants increasingly need reliable ways to accept card, wallet and bank payments. Gateways that understand the regulatory requirements from the outset can build trust with banks, merchants and the regulator. Those that do not may find their bank partners unwilling to work with them or their operations challenged.
The Central Bank of Iraq Law No. 56 of 2004 and the Electronic Payment Services for Funds Regulation No. 2 of 2024, which replaced Regulation No. 3 of 2014, govern the licensing of electronic payment service providers, including payment processing and gateway services, supplemented by Central Bank instructions on information security, settlement and merchant acquiring. The Banking Law No. 94 of 2004 governs bank participants. Card scheme rules apply by contract. The Anti-Money Laundering and Counter-Terrorism Financing Law No. 39 of 2015 applies to merchant onboarding and transaction monitoring, and the Electronic Signature and Electronic Transactions Law No. 78 of 2012 supports electronic commerce.
When payment processor licensing in Iraq is required
Whether a gateway requires its own licence depends on its role. Key factors include:
- Merchant contracts. Does the gateway contract with merchants for payment acceptance, or does an acquiring bank?
- Settlement. Do funds pass through the gateway’s accounts before reaching merchants?
- Transaction decisions. Does the gateway approve merchants, set limits or decide whether transactions proceed?
- Branding. Do merchants and customers perceive the gateway as the payment provider?
A gateway that contracts with merchants, aggregates funds and settles to merchants is likely to be providing a regulated payment service. A gateway that provides software to an acquiring bank, which contracts with merchants and settles directly, may be treated as an outsourced technology provider.
Licensing requirements for gateways
Where authorisation is required, applicants should expect the Central Bank to assess:
- Corporate form and ownership. An appropriately established company, with transparent ownership and fit and proper shareholders.
- Financial resources. Capital or financial guarantees sufficient for the business and for settlement obligations.
- Management. Qualified managers, including for compliance, risk and information security.
- Technology and security. Secure systems, compliance with relevant security standards, data protection, business continuity and incident response.
- Settlement arrangements. Bank accounts, settlement timelines and protection of merchant funds.
- AML framework. Merchant due diligence, transaction monitoring and reporting.
The licence may be granted for specified activities and subject to conditions. Corporate advice in Iraq can assist in establishing the applicant entity and documenting its ownership.
Merchant onboarding and monitoring
Gateways are a common entry point for fraud and money laundering, particularly through merchants selling high-risk goods or acting as fronts. Gateways must verify merchant identity and ownership, understand the merchant’s business, assess risk and monitor transaction patterns for inconsistencies. Prohibited and restricted merchant categories should be defined. Merchants should be contractually required to comply with law and scheme rules and to cooperate with investigations.
Settlement and protection of merchant funds
Where the gateway holds merchant funds pending settlement, it should keep them in dedicated accounts, reconcile them daily and settle within defined timelines. Reserves or rolling holdbacks may be used to cover chargebacks and refunds for higher-risk merchants. The merchant agreement should explain settlement timing, fees, reserves, chargebacks and termination.
Information security standards
Gateways handle card and account data, making security critical. Compliance with recognised payment security standards is commonly expected by banks and schemes. Gateways should also implement strong customer authentication where required, tokenisation, encryption, fraud screening and regular security testing. Incident response plans should include notification to the Central Bank, partner banks and affected merchants.
Relationships with acquiring banks and schemes
Even licensed gateways usually rely on acquiring banks and scheme connections. Agreements with banks should allocate responsibility for merchant onboarding, chargebacks, fraud, settlement and regulatory compliance. Scheme rules impose obligations on participants, including registration of payment facilitators where applicable. Commercial contract advice in Iraq can help negotiate bank and scheme-related agreements.
Cross-border gateways
International gateways serving Iraqi merchants, or processing payments for Iraqi customers, should consider whether their activity requires Iraqi authorisation, how funds will be settled in Iraq and how foreign exchange requirements apply. Partnering with a licensed local provider may be necessary.
Ongoing obligations
Licensed gateways must comply with reporting, audit, inspection and change approval requirements. Changes in ownership, management, activities or key partners may require notification or approval. A compliance calendar and licence conditions register help manage these obligations.
Merchant agreements and terms
The merchant agreement is the gateway’s primary tool for managing risk. It should set out onboarding requirements, prohibited activities, fees, settlement timing, reserves, chargeback procedures, data security obligations, audit rights, suspension and termination rights and liability allocation. It should also require merchants to display accurate information to customers, handle refunds fairly and cooperate with fraud investigations. Terms should be enforceable under Iraqi law and available in Arabic. Clear merchant terms reduce disputes and give the gateway a contractual basis to act quickly when a merchant presents risk.
Managing chargebacks and disputes
Chargebacks are a significant operational and financial risk. The gateway should have procedures to receive chargeback notifications, notify merchants, gather evidence, respond within scheme deadlines and recover amounts from merchants or reserves. High chargeback ratios may indicate fraud or poor merchant practices and should trigger review. Effective chargeback management protects the gateway’s relationships with acquiring banks and schemes.
Illustrative example. An e-commerce platform wants to offer its sellers integrated card payments. It plans to collect all customer payments into its own account and pay sellers weekly after deducting commissions. Analysis shows that this model involves holding funds and providing a payment service to sellers, requiring authorisation. The platform considers applying for its own licence but, for faster launch, partners with a licensed gateway that onboards sellers as merchants, holds funds in safeguarded accounts and settles directly, while the platform receives its commission under a separate agreement.
Key takeaways
- Payment processor licensing in Iraq depends on whether the gateway contracts with merchants, holds funds and controls transactions.
- Licensed gateways must meet requirements on ownership, capital, management, security, settlement and AML.
- Merchant due diligence and protection of merchant funds are central regulatory concerns.
- Cross-border and platform models should be analysed carefully before launch.
How Etihad Can Help
Payment processor licensing in Iraq is a strategic decision that shapes a business’s operating model, partnerships and growth. Clear analysis of the gateway’s role allows it to pursue the right authorisation and build a compliant platform.
Etihad Law Firm advises payment gateways, e-commerce platforms and banks on licensing, merchant agreements and regulatory compliance in Iraq. We help clients enter the online payments market with a sound legal foundation.