PaymentsPayments GlossaryPart 6 of 6
Running a Provider Glossary
69 terms from the Payments book's Running a Provider part, each defined in a line and linked to the chapter that explains it.
- ACP (Agentic Commerce Protocol): the open specification, maintained by OpenAI and Stripe, for how an agent and a seller exchange carts and orders (AI in Payments).
- Adverse action notice: the notice Regulation B requires within 30 days for a denied credit application, stating specific principal reasons (AI in Payments).
- Agent bank: a bank that sends its business customers to an acquirer, with liability (it indemnifies losses) or without (referral only) (Partners, ISOs & Residuals).
- Agentic commerce: AI agents that search, choose and pay on a consumer's behalf (AI in Payments).
- Agentic token, shared payment token: a network token issued for a registered agent (Visa Intelligent Commerce, Mastercard Agent Pay), and Stripe's seller-scoped, limited, revocable token passed under ACP (AI in Payments).
- Agent mandate: a scoped, expiring, revocable permission from a user for an agent to pay, checked in code before each payment (AI in Payments).
- AOC, ROC, SAQ: PCI's attestation of compliance, report on compliance, and self-assessment questionnaire; SAQ A-EP is the questionnaire for e-commerce merchants whose own site controls how card data reaches the provider, putting their web servers in scope (PCI DSS, Checkout, Invoices & Payment Links).
- AP2 (Agent Payments Protocol): Google's protocol, donated to the FIDO Alliance, that records what a user authorized as signed mandates (AI in Payments).
- ASV, QSA: an approved scanning vendor and a qualified security assessor (Becoming a Payment Provider).
- Authorization rate, payment success rate: issuer approvals over attempts sent to the network, and authorized attempts over all valid attempts, including authentication failures and risk blocks (Payments Metrics).
- Bill to parent: a parent in the platform's tree paying its merchants' processing fees, so neither the merchant nor its customers do (Payments for Software Platforms).
- Capture token, stored token: the short-lived token a browser gets, and the long-lived one the platform saves in exchange (Running a Card Vault).
- Card fingerprint: a keyed hash of a card number that recognizes the same card behind different tokens (Running a Card Vault).
- Cascading: sending a declined or failed payment to another processor, within the networks' retry rules (Processor Routing).
- CDE (cardholder data environment): every system that stores, processes or transmits card data, plus whatever can reach them (Running a Card Vault).
- Cell: a group of merchants whose data lives on its own isolated database, chosen by load and jurisdiction, to limit blast radius (Payments Architecture at Scale).
- Charging processor: the processor that holds a stored credential and charges it, switched cohort by cohort during a migration (Switching Processors).
- Clawback (partner): a merchant loss or chargeback charged back to the partner liable for it, as its own residual line (Partners, ISOs & Residuals).
- Cryptoperiod: how long a key may be used before it's replaced (HSMs & Key Management).
- Degraded mode: a decision made in advance about what keeps working, what queues and what stops when a processor, network or bank is down (Operating the Platform).
- Donor-covered fee: an optional extra amount a donor adds to cover a charity's costs; a donation, not a surcharge (Payments by Vertical).
- DUKPT, BDK: the scheme that gives every terminal transaction its own key, and the root key it derives them from (HSMs & Key Management).
- EMV Levels 1, 2 and 3: terminal certification of the hardware, the kernel, and the integration end to end; unrelated to Level 2 and Level 3 data (Network Certification).
- Envelope encryption: data encrypted under a data key, which is itself encrypted under a key-encrypting key in a KMS or HSM (Encryption at Rest).
- Exactly-once effects: at-least-once delivery plus idempotent receivers plus reconciliation; exactly-once delivery doesn't exist (Payments Architecture at Scale).
- Fee override: one fee line set at one level of a platform's tree, replacing what that level and everything below it would inherit (Payments for Software Platforms).
- Forwarder: the vault component that swaps a token for the card number on the way to a processor, the only path a number takes out (Running a Card Vault).
- Hot account: a ledger account touched by nearly every transaction (fee revenue, FBO cash, clearing accounts), whose contention limits ledger throughput (Payments Architecture at Scale).
- HSM, KMS: a hardware security module, and a key management service, often built on HSMs (HSMs & Key Management).
- IIAS (inventory information approval system): checkout that flags FSA- and HRA-eligible items so the card pays only for them, run to the SIGIS standard (Payments by Vertical).
- ISV (independent software vendor): a software company, often vertical, that embeds payments in its product (Payments for Software Platforms).
- Key block (TR-31), KCV: a key wrapped with its permitted uses, and a key check value used to confirm a key without revealing it (HSMs & Key Management).
- Location: a physical site under a merchant, such as a store or clinic, with its own terminals and sometimes its own merchant account (Payments for Software Platforms).
- Managed payfac (payfac-as-a-service): a platform that runs payments under a provider's payment facilitator registration, with the provider holding the network relationship (Becoming a Payment Provider, The Payments Landscape).
- Mapping file: the file a receiving processor returns after an import, linking each old card reference to its new one (Switching Processors).
- Merchant account: the processing relationship a MID identifies; one business can hold several, for different MCCs or entities; Payabli calls one a paypoint (Payments for Software Platforms).
- MID warming: ramping volume on a new merchant ID while issuers, which haven't seen it before, decline more of its payments (Switching Processors).
- Model risk guidance (SR 26-2, OCC Bulletin 2026-13): the US banking agencies' April 2026 model risk management guidance, superseding SR 11-7 and leaving generative and agentic AI out of scope (AI in Payments).
- P2PE: point-to-point encryption of card data from the terminal to the decryption environment (Card-Present Payments).
- PAN import, PAN export: moving stored card numbers between processors in an encrypted processor-to-processor file, never through the merchant (Switching Processors).
- Pass-through margin: for interchange-plus merchants, the markup kept once interchange and network fees pass through, with any gap between estimated and actual costs shown separately (Payments Metrics).
- Payment facilitator (payfac): a company that signs merchants as sub-merchants under its own master account, registered with the networks through a sponsor (Becoming a Payment Provider).
- Payment orchestration: a layer that routes payments across several processors through one API and vault (Processor Routing, The Payments Landscape).
- PCI DSS: the card industry's security standard for anyone handling card data (PCI DSS).
- PFI (PCI Forensic Investigator): the firm that investigates a card data compromise when a brand requires it (Operating the Platform).
- PIN block: a PIN encrypted together with the card number, in an ISO 9564 format (format 4 for AES) (HSMs & Key Management).
- Raw and deduplicated rates: an acceptance rate counting every attempt, and one counting each purchase's final outcome after retries (Payments Metrics).
- Remote key loading (TR-34): delivering a terminal's first keys with asymmetric cryptography instead of in a key injection facility (HSMs & Key Management).
- Reserve coverage: reserves held over estimated exposure, per merchant and for the portfolio (Payments Metrics).
- Residuals: a revenue share a provider pays a platform or reseller after the fact (Payments for Software Platforms, Partners, ISOs & Residuals).
- Saga: a multi-step money movement run as a sequence of local transactions, each with an explicit compensating action, instead of a distributed transaction (Payments Architecture at Scale).
- Schedule A (buy rate): the cost schedule a provider or ISO charges a partner per merchant, the base its residual is computed over (Partners, ISOs & Residuals).
- Service provider: in PCI terms, anyone who handles card data for other businesses; it brings extra requirements (Becoming a Payment Provider).
- SIGIS: the nonprofit that runs the IIAS standard and Eligible Product List and certifies merchants and processors (Payments by Vertical).
- Sponsor bank: the network member bank that lets a non-bank provider acquire or originate under its membership, and answers to the network for it (Becoming a Payment Provider).
- Stand-in processing (STIP): the network approving or declining on an issuer's behalf when the issuer can't be reached or is too slow (Inside a Processor).
- Sub-account sharding: splitting one logical ledger account into several physical shards chosen by hash, with the logical balance reported as their sum (Payments Architecture at Scale).
- Sub-merchant (sponsored merchant): a merchant that processes under a payment facilitator's account; Stripe calls it a connected account, and Adyen models it as an account holder (Payments for Software Platforms).
- Take rate: net revenue over gross volume, in basis points, read with its mix (Payments Metrics).
- Third Party Agent: Visa's term for a non-processor entity providing payment-related services to a member or its merchants, which the member must register before it works (Partners, ISOs & Residuals).
- Token requestor: the party registered with a network to request and hold network tokens, identified by its token requestor ID (TRID), which decides who can use them elsewhere (Processor Routing, Switching Processors).
- Transactional outbox: an events table written in the same database transaction as the state change, relayed to the event log after commit, so an event exists if and only if the change committed (Payments Architecture at Scale).
- Transaction link identifier: Mastercard's identifier tying the messages that follow an authorization to it (Inside a Processor).
- Trusted Agent Protocol: Visa's protocol letting a merchant verify an agent by its cryptographic signature (AI in Payments).
- VAMP enumeration ratio: Visa's count of enumerated (card-testing) authorizations over all authorizations, approved and declined (Payments Metrics).
- Vault token: a random stand-in for a card or bank number, meaningful only to the vault that issued it (Running a Card Vault).
- Vested residual (portfolio equity): a residual stream that survives the seller's departure for as long as the merchant processes, and can be bought out (Partners, ISOs & Residuals).
- VisaNet, V.I.P.: Visa's network, and the VisaNet Integrated Payment system that carries its authorizations (Inside a Processor).
- ZMK, ZPK: a zone master key shared once with a partner, and the working PIN key it protects on that link (HSMs & Key Management).