For years, high-risk merchants, offshore gambling operators and unlicensed online investment platforms have used a simple workaround to access European payment rails: insert an EU-based company into the payment chain and call it a “payment agent”, “payment processing agent” or “collection agent.”
The model became popular for obvious reasons. Offshore or high-risk operators often struggle to obtain direct access to EU banks, acquirers, EMIs and payment gateways. They face licensing questions, AML scrutiny, chargeback concerns, card-scheme risk, reputational issues and de-risking by financial institutions. An EU-based “payment agent” can create a more acceptable payment-facing structure, open EU bank or EMI accounts, receive customer funds, process deposits and withdrawals, reconcile transactions and remit balances to the offshore or high-risk operator.
Why payment agents matter
EFRI has seen variations of this model in online investment fraud, binary options, illegal broker schemes and online gambling.
The Payvision case illustrates why this debate is not academic. Payvision B.V., a Dutch payment institution and acquirer, processed payments for high-risk merchants for many years. EFRI has documented Payvision’s role in processing payments for fraudulent binary options and forex networks linked to Gal Barak and Uwe Lenhoff, including merchant structures involving offshore companies, opaque UBO arrangements, missing investment-services licences and public supervisory warnings.
According to documents reviewed by EFRI, Payvision’s role went beyond passive payment processing. The documents indicate that Payvision assisted in the establishment and use of European corporate structures that could be onboarded as merchants and connected to European payment rails. This is exactly why the “payment agent” debate matters: corporate form can be used to manufacture payment acceptability. Payvision is not an isolated case. Based on EFRI’s case work, several high-risk payment service providers and intermediaries appear to have offered or facilitated corporate-structuring solutions for high-risk merchants, including structures designed to improve access to banks, acquirers and payment gateways.
The infamous illegal gaming sector
A similar model is openly promoted in the online gambling sector. Public advisory material describes the creation of Cyprus-based Payment Processing Agent companies for non-EU online gaming businesses. One Cyprus law firm article explains that a non-EU gaming operator may establish a Cyprus subsidiary as an intermediary between players and the online casino, handling payment processing for transactions on the gaming website. The same article states that Cyprus is attractive because of access to credit-card payment providers, acquiring banks and EMIs in Europe.
Other corporate-service providers describe the logic even more directly. One provider states that offshore Curaçao entities face increasing difficulty accepting online payments because of regulatory scrutiny and high-risk classification, and presents an EU-Cyprus payment processing agent as part of the solution. Another provider describes a payment agent company as a client-facing company in a reputable jurisdiction that processes payments for an offshore online casino, receives a small fee, and forwards profits to the main offshore company.
These examples show the commercial logic clearly: the payment agent is used to create an EU-facing payment access point for businesses that may otherwise struggle to obtain direct access to European payment infrastructure.
Applicable PSD2 rules
Under current PSD2 law, there is no general “payment agent” exemption. A company that merely receives customer funds, processes payments, reconciles balances and forwards money to a merchant is likely to provide a regulated payment service, such as money remittance or payment collection, and therefore generally requires authorisation as a payment service provider unless a specific statutory exemption applies.
In practice, however, the Commercial Agent Exclusion under PSD2 has frequently been used to argue the legality of such “payment agent” structures. The argument usually runs as follows: the EU company acts as agent of the merchant or payee; therefore, payments made to that company are treated as payments made to the merchant; therefore, no separate payment-service licence is required. This reasoning is attractive for high-risk merchants because it creates a payment-facing EU entity while the real commercial operator may remain offshore or otherwise difficult to onboard directly
But that argument confuses two different concepts. The Commercial Agent Exclusion is not a general payment-collection exemption. It applies only where the agent is genuinely authorised to negotiate or conclude the sale or purchase of goods or services on behalf of one side. A company that merely handles the money — receiving funds, processing deposits and withdrawals, reconciling balances and forwarding funds — is not a commercial agent merely because the contract calls it one.
While this substance-over-form approach is already inherent in PSD2 and supported by EBA and FCA guidance, the market has exploited interpretative gaps in the application of the exemption
What the new PSR changes
The new (drafted) Payment Services Regulation (PSR) directly addresses the uncertainty around commercial agents by narrowing and mandating a harmonized interpretation across Member States. Under the PSR final compromise text, the Commercial Agent Exclusion is narrowed and harmonised. Payment transactions through a commercial agent fall outside the PSR (no license is required) only where the agent is authorised to negotiate or conclude the sale or purchase of goods or services on behalf of only the payer or only the payee, and where the agreement gives the agent a real scope to negotiate or conclude that transaction. This makes clear that a mere payment-facing entity that collects, processes and remits money is not protected simply because it is called an “agent”. The label is irrelevant; the substance of the role is decisive. The PSR therefore does not invent this principle, but codifies and enforces the rigorous substance-over-form test that national supervisors and the EBA have already consistently defended.
Will the PSR end the “payment agent” model?
Not automatically. The PSR will not kill every questionable payment-agent structure overnight.
But it gives supervisors a sharper, more standardized tool to challenge artificial agency models. The PSR final compromise text recognises that the commercial-agent exclusion has been applied differently across Member States. However, the current text contains a dangerous loophole that scammers are already preparing to exploit for regulatory arbitrage. There is a visible drafting tension: Recital 11 focuses on whether the buyer or seller has real negotiating autonomy, while Article 2(2) focuses on whether the agent itself has a scope to negotiate. Scammers will use this to argue that an agent-centric mandate suffices under Article 2, even if the end-customer has zero real autonomy. By creating this interpretative friction, bad actors can manipulate the definition of “agency” to keep artificial payment structures alive. Until the EBA provides a unified “repository of use cases”, this ambiguity acts as an open invitation for high-risk operators to continue misrepresenting their payment-processing roles as exempt agency arrangements
The stricter Commercial Agent Exclusion should make it harder for high-risk merchants, offshore gambling operators and unlicensed investment platforms to avoid payment-services regulation through contractual labels.
For EFRI, the rule should be simple:
“Payment agent” is not a magic word.
If an entity controls payment flows, receives customer funds and remits money to another operator, it should not escape payment regulation by calling itself a commercial agent.
EFRI’s view
EFRI has long argued that payment fraud and high-risk online business models depend on access to regulated payment rails. The payment agent model shows why formal labels are not enough
The PSR’s stricter commercial-agent wording is a step in the right direction. But it will matter only if supervisors, banks, acquirers and EMIs enforce it strictly.
The decisive principle must be substance over form.
If the entity negotiates or concludes a real commercial transaction for one party, the exclusion may apply. If it mainly collects, processes and remits money, it belongs inside the payment-services perimeter.
Otherwise, the same old payment-agent model will continue under a new name.
