Currencycloud: payment FX, collections and account infrastructure

Currencycloud provides infrastructure for collecting, holding, converting and paying money across currencies. Its APIs let a financial business build those functions into its own service; Currencycloud Direct provides a ready-made interface that can carry the client’s branding. For an FX business, the relevant offering is international payments and deliverable currency conversion.[1]

Eligibility is a material constraint. The policy updated in May 2026 lists speculative trading and cryptoassets among non-permitted industries, prohibits clients from speculating on FX through the service, and excludes nested financial-institution payments. A broker’s investment licence therefore does not establish acceptance for CFD deposits, trading balances or withdrawals. The actual payment activity, end customers and service model determine the application.[2]

The September 2026 jurisdiction matrix separates three customer models. Type 1 covers licensed firms using the platform for their own business; Type 2 covers licensed firms serving their payment and FX customers; Type 3 uses Currencycloud’s regulatory coverage. Both the contracting client and its customers must be in permitted locations. Type 2 firms need their own relevant permissions in each customer jurisdiction.[3]

Currencycloud’s security statement describes AWS hosting, encryption of network traffic and confidential information at rest, hierarchical access roles, multifactor controls for sensitive systems, access logging and penetration testing. It reports ISO/IEC 27001:2022 certification for its platform and operational security. The separate list of AWS compliance programmes describes the hosting provider’s credentials.[16]

The UK direct-client terms place fees in the Commercial Agreement and exclude applicable taxes. They do not provide a universal numerical platform tariff. Those terms govern direct TCCL clients; introduced end customers have separate terms.[14]

FX revenue configuration is documented more clearly than a standard licence price. Clients can arrange a static spread table or apply a manual markup when acting for a sub-account. The markup mechanism is not available for a house account acting on its own behalf. Sub-account profit is aggregated at the house account and reconciled and paid as monthly commission.[11]

The onboarding model determines who performs customer due diligence. Under outsourced KYC, eligible unregulated clients operate an onboarding journey on Currencycloud’s behalf; the payment customers become Currencycloud customers. The published process includes assessment of the client’s compliance procedures, recorded acceptance of terms, quarterly check-ins and annual sample-file review. UK or Netherlands agent registration may be required; the FAQ estimates one to two months for that registration, rather than promising a total implementation time.[15]

The December 2024 DPA applies to processing for services offered under the client’s own regulatory licence. It expressly excludes services supplied under Currencycloud’s regulatory coverage. Within its scope, Currencycloud acts as processor on client instructions, but separately acts as controller for onboarding checks, regulatory duties, service risk and financial-crime prevention. Those controller uses are outside most DPA provisions.[17]

For the processor relationship, the DPA requires incident notice without undue delay after awareness. At termination, the client can choose return or deletion of personal information; copies must be deleted unless law requires storage. This contractual choice does not erase records held for Currencycloud’s separate controller obligations.[17]

Support is available online, by email and by phone 24/7. Currencycloud states an aim to resolve its highest-priority P1 tickets within two hours. Direct exposes tickets, comments and attachments to other authorised users in the same organisation. A solved ticket closes after seven calendar days; it remains viewable but cannot then be reopened. Access can be restricted through the customer-success team.[20]

The status page publishes separate components for APIs, payments, conversions, Direct and other services, with subscription options. Its availability statement uses a 99.99% monthly reasonable-endeavours target, excluding scheduled maintenance, specified client breaches, unpaid fees, third-party interruptions and circumstances outside its control. Availability of the platform is distinct from settlement through a particular bank or payment rail.[21]

The UK terms distinguish payment balances from forward margin. Relevant payment funds are safeguarded through segregation and/or insurance, without Financial Services Compensation Scheme protection. Ownership of forward deposits and margin transfers to Currencycloud: these amounts are held in its own business account and are outside that Relevant Funds safeguarding treatment.[14]

Currencycloud describes real-time screening before incoming funds are credited or outgoing payments enter the banking network. Rules can approve or reject transactions automatically or send them to a specialist for review, hold or rejection. Retrospective monitoring can trigger further information requests or account action. The client-facing payment status therefore sits alongside an ongoing compliance process, and a banking partner may request additional evidence after Currencycloud’s own checks.[27]

Visa completed its acquisition of Currencycloud on 20 December 2021. Currencycloud operates within that group while retaining a distinct payment and FX product offering. The ownership relationship does not turn every Visa product into part of a Currencycloud agreement.[29]

The Currency Cloud Limited is an active UK company, number 06323311, incorporated on 25 July 2007. Companies House records 1 Sheldon Square, London, as its registered office. The service brand sits above several regional operators, so the named counterparty in the applicable agreement remains significant.[28]

The Singapore migration FAQ describes moving designated clients from TCCL to Currencycloud Pte. Ltd. through a novation or amendment. It requests signing within one month of the migration letter’s date, allows valid KYC material to transfer with consent, and may require updated documents. API integration, account numbers and login details remain unchanged. Currencycloud Singapore does not provide forwards or derivatives, so technical continuity does not imply an unchanged product range.[30]

For USD Top-up, USD Collections, ACH Pull and Local USD Spark, the documented operator change is to Visa Global Services Inc. The terms-acceptance API records the account, terms type/version and accepting user details, returning an acceptance identifier and timestamp. This is a specific customer-consent workflow for the named services.[31]

Operator

The Currency Cloud Limited and regional service entities

Service scope

Payment-related currency conversion, collections, multicurrency accounts and payment infrastructure.

Customer types

Licensed firms using their own business accounts; Licensed payment and FX providers; Eligible clients using Currencycloud regulatory coverage

Delivery

API; Hosted

Pricing publication

Quote only

Published jurisdictions

United Kingdom; Netherlands; Singapore; United States

Platforms

Currencycloud APIs; Currencycloud Direct; Currencycloud Spark

Integrations

HTTP APIs; HMAC-signed event notifications; CSV reporting

Pricing scope

Commercial Agreement fees; FX spread and payment charges depend on the contracted service.

Implementation

API or Direct onboarding; customer licensing, KYC model and payment-approval configuration shape the deployment.

Support

24/7 support; published P1 resolution aim of two hours.

Permissions and regulatory scope

Regional payment/e-money permissions; eligibility is model-specific and speculative trading is prohibited.

Provider metadata checked 20 Oct 2026Source 28Source 24Source 9Source 25Source 3Source 2Source 15Source 1Source 5Source 33Source 4Source 11Source 20Source 14Source 23Source 26

The 13 October 2026 Future Ready notice schedules mandatory additional data for new accounts from 30 October, after demo availability began on 6 October. As checked on 20 October, the fields are still optional, but supplying any requires the complete applicable set. Existing-account updates retain the none-or-all rule. The changes cover identity, business activity, addresses and expected transaction information; they are distinct from payer and beneficiary requirements. API, SDK and Direct onboarding need to follow the relevant account flow.[32]

Weekend FX runs, for approved eligible clients, from Friday 17:00 to Sunday 17:00 Eastern Time. The FAQ supports TOM and SPOT conversions, with settlement on following business days; it excludes forwards and T+3 transactions. It also says weekend conversions cannot currently be cancelled or moved to another conversion date. A weekend quote therefore does not promise that the beneficiary receives funds during the weekend.[13]

Trace and recall requests can be managed from completed Swift payments in Direct. The FAQ gives inconsistent trace-eligibility thresholds of five and seven working days, so it does not establish one dependable public starting point. Its follow-up clock is clearer: chase an unanswered request after seven business days from the request. A single trace or recall request is allowed per payment.[35]

On UK direct-client termination, platform use ends, outstanding obligations become due and held funds are returned on request. Confidential information is returned within 30 days from termination, subject to legal and accounting retention; obligations on already executed contracts survive.[14]

A separate March 2024 UK sponsored-model standards document places record duties on the client: relevant transaction and customer records are retained for five years from trade execution or the end of the applicable customer relationship. It also requires access to relevant records for five years after termination and describes a planned two-calendar-month mutual wind-down. These are duties under that dated sponsored-model document, rather than a general promise to delete all customer data at exit.[36]