Rapyd: payment acceptance, payouts and account infrastructure

Rapyd’s trading-sector proposition covers the movement of funds around a brokerage: accepting customer payments, paying withdrawals and managing balances across currencies. Its current page explicitly addresses forex and CFD platforms and combines card acquiring with local payment methods and payout services. The practical fit depends on the broker’s business, customer locations, payment routes and approved use of those services.[1]

The restricted-business list, effective 10 June 2026, requires additional documentation for investment and brokerage services, crypto providers, prop trading and wallets; it also lists CFDs as restricted. Unlicensed securities, investment and currency-exchange services are prohibited, as are transactions from unlicensed financial-product or trading platforms, including rolling spot FX. A broker’s licence therefore supports its application but does not itself establish Rapyd acceptance.[2]

Rapyd provides sandbox access, API resources, hosted interfaces and plugin routes. Its developer page links the official OpenAPI repository and Postman material; the advertised Python SDK is labelled beta. The sandbox is the development environment for constructing and checking the payment flow, while production onboarding remains a separate commercial and compliance process.[7]

Hosted Checkout begins with a session created through the API. Rapyd returns a checkout URL, the customer completes payment on the hosted interface and the flow returns to the merchant. Full-page redirects, embedded iframes and mobile WebView delivery are documented. Branding and localisation can be configured, while a direct API implementation gives the merchant responsibility for its own payment interface.[8]

Global IC++ pricing passes through interchange and scheme fees and adds a quoted Rapyd acquiring component. The numerical country examples below are standard merchant tariffs with explicit eligibility limits; they do not establish a trading-platform quote.[10]

Under the UK general terms, applicable taxes are additional and fee changes normally require at least 30 days’ notice, or longer where required. Fees, reserves and negative balances can affect the funds available for payout.[11]

The legal directory assigns a regional Rapyd contracting entity after the business supplies its information and identifies the required services. Product schedules supplement the relevant regional agreement. It also warns that a pre-existing agreement with a partner may govern instead. That makes the signed arrangement, rather than a global product menu, the starting point for the production configuration.[12]

The UK general terms require notice at least five Business Days before a business change and confirmation before implementing it. The acquiring guidelines also require approved merchant outlets and clear website identity, pricing, customer-service and cancellation information.[11][14]

The UK-labelled Virtual Accounts schedule allows customer bank transfers or same-name bank-account funding for payouts, subject to location restrictions. Rapyd generally updates the wallet within one Business Day of receiving funds, after confirmation and compliance checks; the originating bank’s transfer time is separate. The underlying accounts are in Rapyd’s name and pool funds from multiple users. Assigned account credentials therefore identify incoming funds without creating a separate bank deposit in the broker’s name.[13]

Merchant card-data duties continue alongside hosted delivery. The acquiring guidelines require PCI compliance where applicable, prohibit retaining security codes after authorisation and require card-payment documentation to be kept for at least 540 days. Suspected or confirmed unauthorised access to card or transaction-data systems must be reported immediately and within 24 hours of awareness, including relevant supplier incidents.[14]

Rapyd’s security centre describes AWS infrastructure replicated across availability zones in US East 1, with Europe West 1 used for recovery. It describes encryption, an isolated card-data vault and access controls, and says it has Level 1 PCI-DSS certification and a SOC 2 Type II report. These are Rapyd’s published assurance statements. The named regions describe that architecture; they do not establish that every local product stores all information within its customer’s jurisdiction.[15]

Rapyd’s official developer organisation directs production incidents, account activation and critical issues to customer support. API questions and sandbox development go to the community. Email support is the fallback when the support portal cannot be accessed. Keeping the payout’s unique transaction reference with a case helps identify the affected instruction.[16][25]

Rapyd provides regulated payment services through different group entities and, in some markets, network partners. Its regulated-entities directory is a map of those roles, not an approval for every merchant activity or country route. The two European examples below distinguish an independently read register entry from a provider disclosure.[20]

The UK agreement says the services are not bank deposits. For e-money held, it promises applicable safeguarding while excluding deposit compensation. Ownership of funds received or collected for the services transfers absolutely to Rapyd.[11]

Rapyd dates its origins to a wallet business begun in 2016, subsequently developed into payments infrastructure. Its current company material identifies Arik Shtilman as chief executive. The group serves merchants and payment partners through a combination of its platform, regional operations and acquired businesses.[21]

On 14 March 2025, Rapyd announced completion of its acquisition of PayU Global Payment Organisation in Latin America and Africa. The announcement named Mexico, Brazil, Argentina, Chile, Colombia and Peru, with expansion in Nigeria and South Africa. It described the start of combining operations and named General Catalyst, Vista Credit Partners and TAL Ventures among the financing participants. The deal’s stated scope was those regional PayU businesses.[22]

Current country-specific privacy terms continue to identify local PayU entities in those regions. A customer moving between regional arrangements therefore needs to follow the controller and contract applicable to its own service, rather than assume that the acquisition made every account or data relationship identical.[23]

Operator

Rapyd group; the assigned regional entity contracts for each service

Service scope

Merchant payment acceptance, payouts, multi-currency ledgers, virtual accounts and stablecoin payment options.

Customer types

Approved FX and CFD businesses; Merchants; Platforms and payment partners

Delivery

API; Hosted

Pricing publication

Public and quoted pricing

Platforms

Rapyd Collect; Rapyd Disburse; Rapyd Wallet; Rapyd Virtual Accounts

Integrations

Rapyd API; Hosted Checkout; Payment links

Pricing scope

Quoted global acquiring component; selected standard country tariffs exclude high-risk merchants.

Implementation

Sandbox/API or hosted integration, followed by entity, business-model and payment-service approval.

Support

Customer support portal for production and account issues; developer community for API and sandbox enquiries.

Permissions and regulatory scope

Regional payment and electronic-money entities or network partners. Merchant approval and enabled services remain separate from entity permissions.

Provider metadata checked 20 Oct 2026Source 21Source 12Source 18Source 1Source 3Source 6Source 7Source 10Source 16Source 20

Wallet reporting exposes transaction fees, method, beneficiary and account details. The payout tracker can share status and proof of payment. These records help finance teams reconcile payment movements and explain a withdrawal’s progress; a recorded payout and final beneficiary credit remain distinct events.[5]

UK termination stops new transactions, leaves pending items to complete and makes outstanding fees due. Portal access may remain available for 30 days after termination, or longer for pending settlement; it is not assured continuing access. A remaining balance can be claimed for six years after termination, subject to contractual set-off and risk-related holds.[11]

Rapyd’s product privacy policy covers Rapyd Financial Network (2016) Ltd and group affiliates. It describes automated KYC/KYB approval or rejection, with unresolved cases sent to human experts and a support route for disputed rejection. It also permits personal-data use for machine-learning or AI research and service improvement. That statement should be read alongside the service’s actual controller, applicable country terms and lawful processing basis.[26]

The privacy centre generally describes retention for six years after the business relationship ends, with local-law and legal-claim exceptions. Closing an account does not erase transaction and anti-money-laundering records that must remain. Rights requests receive an answer within a maximum of 30 days; this is a response clock, not a promise that every requested deletion will be completed or legally possible within that period.[27]