Most fintechs find out they aren't ready during due diligence. By then you' are looking at 3-6 months of delay minimum and in payments, that delay costs you merchant relationships, revenue, and sometimes the business itself.
This is the exact checklist UK acquirers like Barclaycard, Worldpay, and Lloyds Cardnet use. Most fintechs see it for the first time during due diligence. You are seeing it now.
Why Acquirer Due Diligence Is Different From What You Expect
Acquiring banks are taking on liability when they onboard you. Every transaction you process runs through their settlement infrastructure. If your systems fail, their exposure increases. If your fraud rates spike, they carry the risk.
Due diligence is how they assess whether your infrastructure, compliance posture, and operational maturity justify that risk.
Most fintechs walk into these conversations assuming their product quality speaks for itself. Acquirers aren't evaluating your product. They're evaluating your infrastructure, your compliance documentation, and your operational controls and they have a checklist.
Here are the six items that fail most often.
Gap 1 — No Valid AOC
An Attestation of Compliance is the formal document your QSA produces confirming you have completed a PCI DSS assessment and meet the requirements for your merchant level. Without a valid, current AOC most acquirers will not progress your application regardless of anything else you present.
This isn't a technicality. Acquirers are required by card schemes, Visa and Mastercard to only onboard merchants with documented PCI DSS compliance. A gap assessment in progress, a self-assessment questionnaire, or a verbal assurance from your engineering team does not satisfy this requirement.
What you need before you apply: a completed SAQ or QSA-led assessment resulting in a valid AOC document with a current expiry date. Level 2 merchants processing between 1 and 6 million transactions annually must complete an annual SAQ D or full ROC depending on their card data environment.
If your AOC is expired or you've never had one, this is your first priority. Everything else is secondary.
Ask yourself: If an acquirer asked for your AOC today, could you produce it in 24 hours?
→ See your full PCI DSS compliance status and what your acquirer will ask for: syncyourcloud.io/payments/acquirer-readiness/guide
Gap 2 — Chargeback Rate Above 0.5%
Most engineering teams don't know this threshold exists until an acquirer flags it.
Visa and Mastercard operate chargeback monitoring programmes. Merchants with chargeback rates above 0.5% enter warning territory. Above 1% you are in the dispute monitoring programme and most acquirers will reject your application outright or terminate an existing agreement.
Acquirers calculate this as chargebacks in a calendar month divided by transactions in the prior month. A single bad month can trigger monitoring status that follows your application for 12 months.
What you need before you apply: documented chargeback rate data for the last 6 months, evidence of your dispute management process, and a clear explanation if any month exceeded 0.5% and what you did about it.
If your rate is elevated, fix the underlying cause before approaching acquirers not after.
Ask yourself: Do you know your chargeback rate for each of the last 6 months? Is it documented?
→ Check your chargeback rate against acquirer thresholds: syncyourcloud.io/payments/acquirer-readiness/guide
Gap 3 — No Documented Disaster Recovery Strategy
Acquirers need evidence that your payment infrastructure will remain available and recoverable under failure conditions. "We use AWS so it's fine" is not sufficient.
What they're looking for is documented RTO and RPO targets, evidence those targets are achievable based on your architecture, and a tested recovery procedure.
Multi-AZ is not a disaster recovery strategy. It is availability architecture. DR requires documented failover procedures, tested backup restoration, and a recovery runbook your team can execute at 2am without the person who wrote it being available.
What you need before you apply: a written DR strategy covering your payment critical path, RTO and RPO targets with architectural justification, and evidence of at least one DR test in the last 12 months.
Ask yourself: If your primary AWS region went down tonight, how long would it take to restore payment processing? Is that written down anywhere?
→ Generate your RTO/RPO targets and DR documentation: syncyourcloud.io/payments/acquirer-readiness/guide
Gap 4 — Incomplete AML/KYC Programme
This gap catches fintechs that have built strong payment infrastructure but treated compliance as something to handle later.
Acquirers are themselves regulated entities. When they onboard you they become part of your compliance chain. An incomplete or undocumented AML/KYC programme creates regulatory exposure for them and they will not accept that risk.
What they expect to see: a documented AML policy, evidence of KYC procedures applied consistently to your customer onboarding, a named MLRO for UK entities, and records showing your programme is actively maintained not just documented once and forgotten.
If you're using a third party for KYC, Onfido, Jumio, Sumsub you still need to document how their outputs feed into your compliance decisions and who owns the final determination.
What you need before you apply: a current AML policy document, KYC procedure documentation, evidence of consistent application, and your MLRO appointment letter.
Ask yourself: If an acquirer asked to review your AML policy and KYC procedures tomorrow, what would you send them?
→ Assess your regulatory and compliance readiness: syncyourcloud.io/payments/acquirer-readiness/guide
Gap 5 — Penetration Test Overdue or Never Conducted
PCI DSS Requirement 11.4 mandates penetration testing at least annually and after any significant infrastructure change. Most fintechs know this requirement exists. Fewer have actually done it.
Acquirers will ask for your most recent pen test report and remediation evidence. A pen test conducted 18 months ago with open findings is worse than no pen test it shows you found vulnerabilities and didn't fix them.
What they expect: an external pen test conducted within the last 12 months by a qualified tester, a remediation log showing findings were addressed, and evidence that critical and high findings were closed before the retest.
Internal pen tests conducted by your own engineering team do not satisfy PCI DSS Req 11.4 for Level 1 and Level 2 merchants. You need an independent qualified security assessor.
What you need before you apply: a current external pen test report with clean or fully remediated findings, conducted by a PCI SSC recognised assessor.
Ask yourself: When was your last external pen test? Do you have the remediation log?
→ See your full pen testing and vulnerability management status: syncyourcloud.io/payments/acquirer-readiness/guide
Gap 6 — Insufficient Sanctions Screening
UK and EU acquirers operate under FCA and EBA regulatory frameworks that require real-time or daily batch sanctions screening against OFAC, HM Treasury, and EU consolidated lists.
This is the gap most technical teams underestimate because it feels like a compliance problem. It isn't. Sanctions screening needs to be embedded in your payment infrastructure not run as a monthly spreadsheet exercise by your compliance team.
What acquirers expect to see: automated screening integrated into your transaction processing pipeline, evidence of daily or real-time screening frequency, a documented process for handling matches, and audit logs proving the screening is actually running.
Manual sanctions checks, monthly batch processing, or screening only at onboarding without ongoing monitoring will fail acquirer due diligence every time.
What you need before you apply: documented sanctions screening architecture, evidence of integration into your payment flow, screening frequency confirmation, and match handling procedures.
Ask yourself: Is your sanctions screening automated and running on every transaction? Can you produce the audit logs right now?
→ Assess your full sanctions screening and regulatory compliance posture: syncyourcloud.io/payments/acquirer-readiness/guide
Know Where You Stand Before the Conversation
Acquirer due diligence moves fast once it starts. The worst position to be in is discovering a gap during the process because acquirers don't pause while you fix things. They move to the next applicant.
The six gaps above are the most common reasons UK fintechs get rejected or delayed. None of them are insurmountable. All of them take weeks or months to fix if you find them late.
The Acquiring Bank Readiness Report assesses your readiness across all six areas PCI DSS compliance status, chargeback rate, disaster recovery documentation, AML/KYC programme, pen testing currency, and sanctions screening and produces a scored report structured for your legal and compliance team or to attach directly to your acquirer application.
It covers 30 fields across five sections: Company and Transaction Profile, PCI DSS Compliance, Technical Infrastructure, Regulatory and Compliance, and Operational Readiness.
It takes 15 minutes. It costs significantly less than one hour of the QSA time you will need if you go into due diligence unprepared.
Run your Acquiring Bank Readiness Report before your next acquirer conversation → syncyourcloud.io/payments/acquirer-readiness/guide
