Worldpay: acquiring, brokerage payments and payout operations

Worldpay’s financial-services offering expressly includes funding and withdrawals for trading and investment businesses, alongside insurance and money-transfer payments. For a broker, the relevant role is payment acceptance, acquiring and disbursement around its client accounts. The merchant’s approved activity and selected services determine which processing routes are available.[2]

The CFD sector addendum covers forex and analogous investments. It prohibits unlawful-country transactions, payouts and related revenues, treats breaches as material, and requires continuing customer and transaction screening. The addendum establishes obligations for this merchant category; acceptance remains subject to the applicable agreement.[5]

The FX API supports payment-related rate pairs, rate quotes and markups for Account Payout and Multi-Currency Pricing customers. Currency access follows entitlement. Although its capability list links future-rate locking, the detailed guide still labels locking a forward rate for up to 30 days as coming soon. It should therefore not be presented as an available broker hedging facility.[14]

The July enterprise WTC restricts using Worldpay’s services to manage or convert currencies for speculation, conversion arbitrage or mainly profiting from exchange rates, unless Worldpay agrees in writing.[4]

The orchestrated Payments API combines functions such as FraudSight, 3DS and token creation; modular integration lets the merchant call the component APIs separately. The current comparison also distinguishes external authentication data, network-token creation and alternative payment methods: the APM API remains separate, and network-token creation requires the Tokens API. These differences affect the design of a brokerage funding journey.[8]

Outgoing API connections use DNS allowlisting rather than fixed EdgeKey IP addresses. Worldpay publishes a 20-second DNS time-to-live, requires TLS Server Name Indication, and warns against certificate pinning because certificates and keys change. Its certificate guidance requires trusted roots and valid hostnames, dates and chains. These outbound connection rules are distinct from the inbound webhook IP allowlist.[9]

The 3DS guide separates authentication from the subsequent payment: successful authentication evidence must be applied to an authorised payment for the described liability shift. Authentication results, exemption decisions and the payment outcome therefore need to remain linked in the merchant’s records.[16]

The April 2026 Merchant Services Agreement places fees in the Application Form or Pricing Schedule. It also makes authorisation distinct from guaranteed payment and permits remittance deferral and deductions for liabilities. Merchant acquiring costs and usable cash therefore depend on the contracted price, transaction mix and risk terms.[3]

Worldpay separately publishes enterprise Worldpay Terms, applicable where the Order incorporates them. The July 2026 version is a different contract family from the April Merchant Services Agreement.[26]

The September UK/ROI Operating Instructions require notification of changes including the business activity, website, legal entity, bank account and ownership. They describe periodic verification of business controllers and beneficial owners, with requested information uploaded through Worldpay Dashboard. Merchant onboarding is consequently an ongoing operating relationship, not only the initial technical connection.[23]

For CFD businesses, Worldpay can request financial statements, customer numbers and types, customer profiles and evidence of the services and underlying asset classes. The sector terms set a deadline within 30 days after the relevant calendar quarter ends. They also require appropriate systems for real-time screening of customers, accounts and/or transactions.[5]

Access credentials come through the Implementation Manager. The Try environment is intended for manual functional testing, not performance or automated testing, and limits each merchant to ten requests per second. Exceeding that limit produces HTTP 429 responses and can require a wait of up to five minutes. Logging the returned WP-CorrelationId gives support a reference for examining an individual request.[7]

The go-live guide requires completed end-to-end testing, new live credentials and a switch from the Try host to the production host. Test credentials remain usable for testing but do not work against live APIs. Integrations should follow returned action links instead of hard-coding resource locations. These technical steps sit alongside the merchant’s commercial approval.[10]

The UK/ROI Operating Instructions describe a UK-based support team available 24/7 throughout the year. That availability statement does not specify a universal restoration deadline.[23]

Worldpay Dashboard provides account, transaction, settlement and billing views, while the public Merchant Support page links the Product Help Centre and customer due-diligence resources. UK Corporate complaints use the established Relationship Manager or dedicated Corporate Support route.[21][22]

The UK complaints page aims to investigate and fully resolve complaints within 15 business days, with an explanation and expected final-response timing when that is not possible. It says complex cases may take up to 45 days. Those complaint-handling periods are separate from payment-event delivery and technical incident support.[22]

The currently linked Worldpay DPA treats each party as an independent controller, except that Worldpay acts as processor for Pazien services. Its processor clause deems deletion selected rather than return and requires deletion within 30 days of the Cessation Date, subject to legally required retention. That clock is not a promise to delete all acquiring records within 30 days of account closure.[6]

The same DPA’s security statement specifies least-privilege access and secure deletion. Its at-rest encryption commitment is qualified by technical feasibility with reasonable effort, while it prohibits unencrypted transmission of merchant data over the internet. The distinction matters when assessing actual contractual controls instead of assuming an unqualified encryption promise.[6]

Global Payments completed its acquisition of Worldpay on 9 January 2026, alongside disposal of its Issuer Solutions business. The agreements had been announced on 17 April 2025. The combined business retains Cameron Bready as CEO and Josh Whipple as CFO, and brings Worldpay’s enterprise and ecommerce capabilities into a merchant-focused group.[1]

The current parent FAQ says existing services continue and customers should use their normal support channels. It plans to operate under the Global Payments brand, but says specific brand-transition dates and implementation details will be announced later. Worldpay remains the name used by the inspected developer and merchant-contract resources during that transition.[1]

Operator

Worldpay group entities, including Worldpay (UK) Limited, Worldpay Limited, Worldpay AP Ltd and Worldpay B.V.; parent Global Payments

Service scope

Merchant acquiring, online acceptance, card and account payouts, payment FX and fraud tools; trading-business activity requires the applicable merchant agreement and sector terms.

Customer types

Enterprise merchants; Trading and investment businesses; Money-transfer businesses; Insurance businesses

Delivery

API; Hosted; SaaS

Pricing publication

Quote only

Platforms

Access Worldpay; Worldpay Dashboard; FraudSight; Payments API; Card Payouts; Account Payouts

Pricing scope

Merchant-specific application, order and pricing schedule; settlement, security and other commercial terms depend on the contract.

Implementation

Merchant verification, implementation-manager credentials, functional testing and separate production activation.

Support

Merchant Dashboard and help centre; UK/ROI guide describes UK-based support available 24/7.

Permissions and regulatory scope

Payment permissions attach to the contracting entity; CFD sector obligations and the broker’s own trading permissions remain separate.

Provider metadata checked 20 Oct 2026Source 13Source 12Source 5Source 2Source 10Source 3Source 23Source 1Source 15Source 8Source 7Source 21

The July enterprise WTC requires notice of an unauthorised, incorrect or disputed Merchant Data Account entry within five business days of its entry. Together with the post-termination data-access boundary, that gives reconciliation and extraction a defined role before and during exit.[4]

Worldpay distinguishes developer-oriented Docs MCP from Gateway MCP tools for operational actions such as querying a payment reference. Its overview also describes customer-authorised agentic purchases, while Universal Commerce Protocol and agentic tokens remain labelled coming soon. Documentation assistance, operational tooling and consumer payment consent are separate functions.[25]