How to use this tool

Acquirer Readiness — Guide

How to complete the readiness assessment, what each section measures, how the score is calculated, and how to use the exported brief when approaching an acquirer.

What is this tool for?

Before approaching a payment acquirer (Worldpay, Adyen, Barclaycard, etc.), you need to demonstrate that your business meets their underwriting requirements. A failed or delayed application wastes weeks and can delay your go-live date by months.

This tool walks you through the six sections that acquirers assess — from PCI compliance and chargeback history to technical infrastructure and regulatory status — and produces a readiness score with a prioritised gap list and a pre-application brief you can use in your acquirer conversations.


Step-by-step walkthrough

Step 1 — Complete all six sections
  1. Work through each section in order. All fields are required for an accurate readiness score.
  2. Use the most accurate answer available — the tool gives you credit for partial progress (e.g. "in remediation" for PCI status) rather than penalising you for being honest.
  3. Your progress is saved in the browser — you can return and update answers as your compliance programme progresses.
Step 2 — Review your readiness score
  1. After completing all sections, the tool shows your overall readiness score and a per-section breakdown.
  2. Red sections are blocking gaps — areas where an acquirer is likely to request remediation before proceeding.
  3. Amber sections indicate areas to improve but not necessarily blocking.
Step 3 — Export your pre-application brief
  1. Click Export Brief to download the assessment summary.
  2. Share it with your compliance team to prioritise remediation, or use it as a conversation document when approaching an acquirer to demonstrate pre-screening diligence.

Assessment sections explained

Company & Transaction Profile
Legal name, country of incorporation, annual volume, monthly transaction count, average ticket size, and business model. Acquirers use this to risk-score your application before underwriting.
PCI DSS Compliance
PCI DSS level, current compliance status, QSA name, AOC/SAQ expiry date, tokenisation approach, and CDE scope. The single most important section — acquirers will not onboard merchants without valid PCI compliance documentation.
Technical Infrastructure
Cloud provider, payment gateway/PSP, current uptime SLA, disaster recovery design, fraud tools, and payment API P99 latency. Acquirers increasingly require evidence of technical resilience as part of underwriting.
Regulatory & Compliance
FCA licence or registration, AML/KYC programme, sanctions screening, data residency, incident history, and chargeback rate. Required for both acquiring and regulatory due diligence.
Operational Readiness
Support hours, monitoring stack, runbooks, engineering team size, release frequency, and penetration test recency. Acquirers assess operational maturity as part of risk management.
Agent-Based Payments
Agent transaction types, human approval thresholds, audit logging, and fail-safe controls. Specific to AI-initiated payments — newer acquirers request this as part of their fraud and liability assessment.
PCI DSS compliance is the single most important factor. Without a valid AOC (Attestation of Compliance), no acquirer will allow you to process live card transactions. Prioritise this above all other sections.

Key terms

AcquirerThe bank or financial institution that processes card payments on behalf of a merchant. They accept the liability for card transactions and settle funds to the merchant account.
AOCAttestation of Compliance — the document certifying that a PCI DSS assessment has been completed and the merchant or service provider is compliant as of the assessment date.
SAQSelf-Assessment Questionnaire — a PCI DSS compliance tool for merchants who are eligible to self-assess rather than undergo a full QSA audit. Different SAQ types (A, A-EP, D) apply to different card data handling models.
Chargeback rateThe percentage of transactions disputed by cardholders. Calculated as chargebacks / total transactions in a given month. A rate above 1% risks acquiring account termination under Visa and Mastercard chargeback monitoring programmes.
CDE scopeCardholder Data Environment scope — the systems that are in-scope for PCI DSS because they store, process, or transmit cardholder data. Minimising CDE scope (via tokenisation and hosted fields) reduces compliance burden.
FCA PIFinancial Conduct Authority Authorised Payment Institution — a UK regulatory status required to initiate or process payments on behalf of third parties. Required for embedded finance and marketplace payment flows.

Frequently asked questions

Ready to assess your acquirer readiness?
Complete the six sections and get a prioritised gap list in under 10 minutes.