Your largest merchants have started asking for crypto settlement, and the honest internal answer is that you cannot build it this year. Engineering is the small part. Safeguarding arrangements, liquidity, reconciliation, screening and permission for the activity all sit outside the roadmap, and every quarter you defer, somebody else quotes your merchant.
A whitelabel arrangement is the standard answer. You put your brand on an engine somebody else operates, sell it as your own product and earn on volume you would otherwise have turned away. It works. It also creates a dependency that is hard to reverse, because what you rent sits between you and your customer.
This article takes the payment service provider (PSP) side of the deal: where the licence perimeter falls, how the money splits, what compliance you inherit and what a workable exit looks like. Our post on the whitelabel crypto payment gateway platform already covers integration, security, and interface, so this one does not.
What you are actually buying
Strip the branding away, and a whitelabel payment gateway solution is three separable layers wearing one coat of paint:
- The presentation layer is yours: checkout pages, hosted fields, notification emails and the merchant dashboard, on your domain and in your styling.
- Beneath it sits the orchestration layer, the application programming interface (API) between your systems and the provider’s, usually driven by webhooks rather than polling, because confirmation and settlement events arrive after the payer has closed the tab.
- Underneath both is the regulated layer you cannot repaint: safeguarding of funds, ledgering, reconciliation, transaction monitoring and dispute handling. It belongs to whoever holds the permission.
What matters in a whitelabel deal is where the boundary between the second and third layers falls. Push it down, and you own more operationally and need broader permissions. Leave it high, and you launch faster while owning less of the value. Our post on gateway integration benefits, challenges and solutions covers what you inherit.
Whose licence covers the merchant
Referral, agency, distribution, and whitelabel are used as though they were synonyms. They are not, and the difference determines which merchant sues you.
Under a referral model, you pass a lead: the regulated firm contracts with the merchant, and you earn a fee without assuming liability. Under an agency model, you act in the name of and under the full responsibility of a principal, appear on the regulator’s register as its agent, and the principal answers for what you do. A distribution arrangement, common in e-money, lets you distribute and redeem on behalf of an issuer without becoming one. Whitelabel cuts across all three: it describes whose brand appears, not whose permission applies.
| Model | Contracts the merchant | Holds the funds | Carries liability |
| Referral | The regulated firm | The regulated firm | The regulated firm |
| Agency | The principal, through you | The principal | The principal |
| Distribution | The issuer | The issuer | The issuer |
| Whitelabel | Either, by agreement | The permission holder | Per the contract |
The build versus buy calculation
Time to market decides this one, and the engineering is rarely the long pole. A regulated launch runs several clocks at once, and they run in the worst possible order.
First the authorisation clock: drafting, regulator questions, remediation of deficiencies and a decision. A follow-up peer review by the European Banking Authority (EBA) puts the median authorisation process in the European Economic Area (EEA) at 9.5 months from the day the application is submitted, with delays often caused by incomplete or poor-quality applications. Beside it runs the banking clock, frequently the real blocker, because a settlement account and a safeguarding account each carry their own due diligence. Then the assurance clock: penetration testing, resilience testing and a Payment Card Industry Data Security Standard (PCI DSS) assessment where card data is in scope. Banks want a permission, and supervisors want a banking relationship.
Cost runs the same way. The development estimate is the smallest line in the file: a permission brings initial capital and a standing own funds requirement, a compliance officer and a money laundering reporting officer (MLRO) on payroll, external audit, safeguarding reconciliation and regulatory reporting that never stops. Renting converts most of that into a per-transaction cost, which is easier to forecast and harder to leave.
The market is also smaller than it looks. A European Parliamentary Research Service briefing counts 737 payment institutions and 338 e-money institutions currently registered in the EU, against 939 and 400 authorised historically: roughly a fifth of everything ever authorised has since lapsed. That is the denominator for any board arguing that owning the permission is the safer option.
Buying whitelabel payment gateway software doesn’t make any individual step faster. It compresses the timeline by borrowing clocks somebody else has finished, which is the honest value proposition and the reason it resists unwinding. The strategic case sits in our newsroom piece on why modular fintech is the future of global commerce.
Choosing a white label payment gateway provider
Due diligence on a supplier you will depend on is not a scoring exercise but an attempt to find out, in advance, what happens on your worst day.
Start with classification, which rewrites the contract. Supervisors judge outsourcing by consequence rather than spend: a function is critical or important if its failure would materially impair your regulatory compliance, your financial performance or the continuity of your services. A gateway that carries your merchants’ payments meets that test, and an ordinary software contract is then no longer sufficient. The agreement has to give you and your supervisor audit and access rights, name the sub-providers, require notice before the chain changes, tie service levels to your resilience targets and commit to exit assistance.
Registers are the underestimated part. Under the Digital Operational Resilience Act (DORA), supervisors expect a machine-readable record of every contractual arrangement for information and communications technology (ICT) services supporting the firm, down to the subcontractors your provider relies on. When the European Supervisory Authorities trial-ran that reporting in 2024 with almost 1,000 financial entities, 6.5% of the registers analysed passed every data quality check. However, half of the rest failed fewer than 5 of the 116 checks. The EBA has since consulted on draft guidelines that would replace its 2019 outsourcing guidelines with a wider third-party risk framework aligned to DORA, extending comparable record-keeping to non-ICT arrangements and allowing firms two years to review and amend existing arrangements.
Diligence questions worth asking before you sign
- Ask which legal entity is regulated for each activity, and expect a named authority.
- Ask for the sub-outsourcing chain in writing, including the cloud host and screening supplier.
- Ask for the scope behind every security certification, because a badge on its own tells you nothing.
Test those questions against what a provider publishes. Bitpace has obtained certification to ISO/IEC 27001, and every product routes through a demo and a compliance-approved know your customer (KYC) process rather than self-serve signup, so that control is visible before you ask. Certificate scope and hosting arrangements are not published, which tells you precisely which questions belong in the contract.
Where your margin actually comes from
Acting as a whitelabel payment gateway reseller only works if the spread between what you pay and what you charge covers your cost base. Commercial models here are assembled from a handful of parts: a wholesale per-transaction cost you mark up, a share of the conversion margin earned when crypto becomes a settlement currency, a platform or branding fee, a minimum monthly commitment, or tiering that improves your rate with volume. Some providers pay a share of what your sub-merchants generate; others sell wholesale and leave retail pricing to you.
One mistake recurs more than any other: quoting a headline rate without modelling network fees, which are charged separately on crypto rails, are paid to the network rather than to your provider, and cannot be recovered once a transaction is broadcast. A related error is treating the rate as static when it comes from live liquidity rather than a rate card.
Note what nobody publishes. The Bitpace whitelabel crypto payment gateway page describes the product, not the commercials: your brand-then engine it operates, plus a sub-merchant panel that gives the parent merchant an all-in-one view and merchant-specific reports. No revenue share, licence fee or minimum volume appears anywhere, so ask for the complete cost stack when you book the demo.
Sub-merchant onboarding and KYC obligations
The moment your brand appears at checkout, your merchants believe it is theirs. Your provider and your regulator may see it differently, and that gap is where the work sits.
Somebody has to run KYC on every sub-merchant: beneficial ownership, nature of the business, sanctions and adverse media screening. It has to be ongoing rather than a snapshot taken at signup, and in most arrangements, the work is split. You collect and package the file because you own the relationship and the regulated entity decides acceptance because it carries the consequence. Write that split down, with turnaround times and what happens when a merchant you have sold to is declined.
Monitoring deserves the same treatment. Rules, thresholds, and alert handling belong to whoever is responsible for the anti-money laundering (AML) programme, which usually leaves you with visibility rather than ownership. Establish whether you can see alerts for your own merchants, whether you can add rules, and how a false positive is cleared without your support desk admitting it is blind. Our post on compliance-ready crypto payments with multi-provider liquidity covers the auditability side.
Chargebacks, reserves and settlement risk
Card specialists arrive at crypto expecting the dispute machinery they know, and it is not there. On the crypto rails, a confirmed transfer is final: there is no issuer to reverse it and no representment cycle. That removes a category of losses and a working-capital drag. Commercial risk survives. Refunds still happen and overpayments and underpayments still need rules, and a merchant that ships against an unconfirmed payment has lost the goods.
Read the risk transfer clauses slowly. Who carries the loss if a sub-merchant fails while refunds are owed? Who absorbs a payment that arrives after a quoted rate has expired? A rate held for a fixed window shifts volatility from the merchant to whoever quoted it, so the agreement should name them. Treat card and crypto as two risk products with separate reserve policies, and never promise a settlement time on a supplier’s behalf: confirmation-speed language describes how the rails behave, not a guaranteed cut-off.
Frequently asked questions
How does whitelabeling work with Bitpace?
We take our robust crypto payment gateway and customise its appearance to align with your brand. You get all Bitpace’s functionality but with an interface that reflects your company’s brand.
How quickly can we integrate the Bitpace Whitelabel Solution?
Our payment gateway can be branded and made immediately available for your use. You can start offering your branded crypto payment gateway solution to your clients right away!
How is whitelabel margin usually structured?
Typically, as a wholesale price, you mark up, sometimes combined with a share of conversion margin, a platform fee, a minimum commitment, or volume tiering. Network fees sit outside that. Providers rarely publish these terms, so ask for the complete cost stack and how your rate moves with market conditions.
Do you still own sub-merchant KYC?
You own the relationship and usually the file collection, while the regulated entity owns the acceptance decision. Both parties bear consequences, so agree on turnaround times, escalation routes, and what happens when a merchant you have already sold to is refused. Ongoing monitoring is what most teams underestimate.
What should an exit clause cover?
Portfolio migration with a defined notice period, export of transaction and reconciliation data in a usable schema, portability of stored credentials, treatment of in-flight settlements and open disputes, plus the option to run the service through a transition period after termination. A provider unable to answer is selling a dependency.
Start accepting crypto payments with Bitpace’s crypto payment gateway
Get paid in Bitcoin, Ethereum, Litecoin and many more established cryptocurrencies with the Bitpace crypto payment gateway. Reach out now to start accepting crypto payments.
