Best Payment Gateways for High-Risk Businesses in 2026

If you run a high-risk business, you already know the landscape: chargeback monitoring programmes tightening, card schemes rewriting the rulebook, and standard processors turning you away at the door. Choosing the wrong payment gateway can result in frozen funds, sudden account terminations, or reserve terms that cripple your cash flow for months.

This guide compares seven specialist providers that work with high-risk merchants. We explain what makes each one distinctive, which sectors they are genuinely built for, and the specific questions you need answered before signing anything. There is no definitive single answer here — the right gateway depends on your sector, transaction profile, and compliance history.

Who this is for: Merchants in sectors including gambling, adult entertainment, CBD, cryptocurrency, nutraceuticals, travel, fintech, and drop-shipping who need a dedicated merchant account and specialist fraud protection. Also useful for payment consultants advising clients in these sectors.

What Makes High-Risk Payment Gateways Different?

A standard payment gateway pools merchants together under a single acquiring relationship. For high-risk businesses, this is dangerous: one chargeback spike from another merchant on the platform can trigger account freezes that hit everyone. Specialist high-risk gateways give you a dedicated merchant account, meaning your processing stands or falls on your own performance, not someone else’s.

Beyond account structure, genuine high-risk providers invest in infrastructure that standard gateways do not. This includes behavioural fraud analytics, chargeback alert integrations with services like Verifi and Ethoca, dynamic 3D Secure (3DS2) to manage authentication risk, and dedicated underwriting teams who understand your sector’s specific MCC codes and compliance obligations.

Gateway vs. Acquirer: A payment gateway is the technology that routes and processes your transactions. An acquirer (or acquiring bank) is the financial institution that holds your merchant account and settles funds. Many high-risk specialist providers offer both under one roof. Some, like Nomupay, connect you to a network of acquiring banks and handle the gateway layer. Understanding this distinction matters because your reserve terms and settlement speed are set by the acquirer, not the gateway software.

The 2025-26 Regulatory Context You Cannot Ignore

Two developments in 2025 have changed the stakes for high-risk merchants:

Visa’s VAMP programme: In April 2025, Visa retired its separate Dispute Monitoring Programme (VDMP) and Fraud Monitoring Programme (VFMP), replacing them with a single Visa Acquirer Monitoring Programme (VAMP). This combines fraud alerts (TC40) and disputes (TC15) into one ratio. From October 2025, enforcement began with fines. From April 2026, merchant thresholds tighten to 1.5% in the EU, the US, and the Asia-Pacific. Your acquirer may apply internal thresholds stricter than Visa’s published limits. The practical takeaway: any ratio approaching 1% now draws active scrutiny, and exceeding 1.5% from 2026 carries fines and potential termination.

Mastercard’s Excessive Chargeback Programme (ECP): Mastercard flags merchants who exceed 100 disputes per month or a 1.5% dispute-to-sales ratio. Fines begin immediately at the excessive level. Both schemes’ thresholds apply cumulatively, so a merchant processing on both Visa and Mastercard must monitor two separate ratios.

Why This Matters for Your Gateway Choice Your chosen gateway’s chargeback alert tools, early warning integrations, and dispute reporting quality directly affect whether you stay below these thresholds. A gateway without real-time VAMP ratio visibility is a liability. Ask every provider: “How do I see my VAMP ratio in your dashboard, and what automated alerts do you offer before I breach the threshold?”

What Acquirers Actually Assess During Underwriting

A common mistake is believing the challenge is simply finding a provider “willing to accept high-risk.” In practice, approval hinges on how well your application matches a specific acquirer’s underwriting criteria. Two businesses in the same sector can apply to the same provider and receive entirely different outcomes.

The factors that most affect underwriting decisions are not always the most visible ones. Your sector MCC code sets the starting point, but what follows matters more: your delivery timeframes (upfront payment for goods delivered later creates chargeback exposure), recurring billing models (card-not-present recurring transactions are scrutinised heavily), refund rate, and whether you have a clean prior processing history. New businesses in sensitive sectors such as crypto, adult content, or gambling will typically need at least six months of processing history before many acquirers consider them.

Repeated applications to multiple providers simultaneously is one of the most damaging things a merchant can do. It creates a visible trail of declined applications in underwriting databases, reducing future approval odds. Approach two or three targeted providers whose underwriting criteria match your specific model.

Documents to prepare now: Company registration certificate, 6–12 months of bank statements, director ID and proof of address, a clear description of your business model and fulfilment process, processing history if available, your website URL with visible terms of service and refund policy, and accurate transaction volume forecasts.

Providers at a Glance: Quick Comparison

Use this table to shortlist providers by your sector and priorities. Full profiles follow below.

Provider	Best For	Key Sectors	Currencies	Settlement	Fraud Tools	Pricing Model	Learn More
Nomupay	High-volume, multi-currency global sellers; complex niches	High-volume, multi-currency global sellers; complex niches	130+	Custom per agreement	PCI DSS L1; 120+ fraud tools; dynamic 3DS; device/geo blocking	Custom interchange-plus or tiered; no hidden FX fees	Visit Nomupay
Worldpay	Established UK/global enterprises; multi-channel	Gaming, Travel, Pharma, Alcohol, Financial Services	135+	Next-day (standard); custom high-risk	FraudSight ML detection; 3DS; tokenisation; OmniShield	Custom; IC++ for high-volume; PAYG from 1.3%+20p	Visit Worldpay
Checkout.com	Enterprise fintech, marketplaces, digital; complex API needs	Fintech, Digital Goods, Marketplaces, eCommerce	150+	Custom; processed $300B+ in 2025	Intelligent Acceptance; AI fraud detection; ID verification	IC++ transparent; enterprise custom	Visit Checkout.com
Cashflows	UK SMEs; transparent pricing; recurring billing	Retail, FSI, Insurance, Sensitive content	EEA-focused	Custom per risk profile	FCA-regulated; Visa/MC principal member; embedded checkout	IC++ standard; blended for smaller volumes	Visit Cashflows
Trust Payments	Licensed gambling/iGaming operators	Gaming & Gambling, Regulated sectors	50+ processing	Same-day cashout available (subject to agreement)	Gambling Harm Detection; AES256; TLS1.2+; integrated fraud mgmt	Bespoke per MCC and turnover	Visit Trust Payments
Axcess MS	SMBs in adult, crypto, niche high-risk	Adult Entertainment, Gaming, Crypto, CFD/Forex, CBD	179	Custom	60+ risk settings; 2x PCI L1 gateways; in-house fraud prevention	Bespoke; tailored per sector	Visit Axcess MS
Fibonatix	CBD, vape, niche supplements; Europe/MENA focus	CBD, Vape, Gaming, Cryptocurrency, Nutraceuticals	Multiple	Custom; typically 3–5 days to onboard	Chargeback protection; fraud management; AML/KYC	Custom; flexible per business model	Visit Fibonatix

How They Rate: At-a-Glance Scores

Ratings reflect each provider’s genuine strength in that dimension based on published features, sector coverage, and independent reviews. Five stars = best in class.

Provider	High-Risk Experience	Fraud Tools	Global Reach	SMB Friendly	Niche Depth	Learn More
Nomupay	★★★★★	★★★★★	★★★★★	★★★★☆	★★★★★	Visit Nomupay
Worldpay	★★★★☆	★★★★★	★★★★★	★★★☆☆	★★★☆☆	Visit Worldpay
Checkout.com	★★★★☆	★★★★★	★★★★★	★★☆☆☆	★★★☆☆	Visit Checkout.com
Cashflows	★★★☆☆	★★★★☆	★★★☆☆	★★★★☆	★★★☆☆	Visit Cashflows
Trust Payments	★★★★★	★★★★☆	★★★☆☆	★★★☆☆	★★★★★	Visit Trust Payments
Axcess MS	★★★★★	★★★★☆	★★★★☆	★★★★☆	★★★★★	Visit Axcess MS
Fibonatix	★★★★☆	★★★☆☆	★★★★☆	★★★★☆	★★★★★	Visit Fibonatix

Provider Reviews

Nomupay – Best Overall for High-Risk Specialists

What makes it different: Nomupay is the UK’s most specialist high-risk processor for businesses operating across sensitive and niche sectors. Unlike enterprise-first processors, Nomupay’s model is built specifically around merchants that have been refused elsewhere. Its gateway connects to a global network of acquiring banks across Europe, MENA, and Southeast Asia, with local licences in multiple regions enabling genuine local acquiring rather than cross-border routing. This improves approval rates meaningfully for international merchants, because the transaction is recognised as domestic by the issuing bank.

Fraud and security: Nomupay operates at PCI DSS Level 1 — the highest certification available — and its hosted integrations automatically extend PCI compliance to merchants using them, removing the compliance burden. Its fraud suite includes more than 120 configurable tools: dynamic 3D Secure, device fingerprinting, IP and geolocation blocking, BIN analysis, velocity rules, and behavioural risk scoring. A proprietary “Chargeback Defender” tool sends early alerts so merchants can convert a potential chargeback into a refund before it is filed, directly protecting VAMP ratios.

Sectors and capabilities: Sectors supported include gaming and gambling, travel, technology, CBD, adult content, cryptocurrency, nutraceuticals, drop-shipping, competitions, dating, and financial services. Nomupay supports over 198 payment methods (Visa, Mastercard, Amex, Apple Pay, Google Pay, WeChat, AliPay, iDEAL, and local alternatives) and 130+ currencies with transparent FX rates. Dynamic routing automatically retries declined payments with a fallback acquirer, recovering revenue that would otherwise be lost. Integration works with WordPress, Shopify, Magento, WooCommerce, and direct API in multiple programming languages. Processing uptime is published at 99.99%.

Limitations: Sectors such as crypto, adult content, drop-shipping, and gambling typically require at least six months of prior processing history. Pricing is always bespoke — no standard rate card is published, which makes initial comparison difficult. Not suited for low-risk startups who would be better served by Stripe or Shopify Payments.

Who should apply: High-volume merchants operating internationally; businesses previously declined by mainstream processors; merchants needing multi-currency acquiring with genuine local presence; any business in a niche high-risk sector that requires a bespoke, actively-managed solution.

✓ Use Nomupay if:

• You operate in a niche high-risk sector (CBD, adult, crypto, gambling, drop-shipping) and need a single gateway that handles multiple acquirers behind the scenes
• You process cross-border transactions and need local acquiring to improve approval rates
• You need 120+ fraud controls and a team that monitors your account proactively
• You have been declined by other providers and need a specialist assessment

✗ Caution:

• New businesses in the most sensitive sectors need 6 months of processing history before applying
• No published standard pricing — always request a full written quote

Worldpay – Best for Large Established UK Enterprises

What makes it different: Worldpay is the largest merchant acquirer in Europe by volume (processing over 40 billion transactions annually across 146 countries, per TSG’s September 2024 data). For established UK businesses in permitted sectors, this scale translates into infrastructure reliability, deep integration options (100+ across 26 categories), and banking relationships that smaller specialist providers cannot replicate.

High-risk sectors supported: Gaming and gambling, travel, pharmaceuticals, alcohol, financial services (including money remittance, CFD, forex, and cryptocurrency exchange — each with specific T&Cs). Worldpay’s accepted sectors are published in its restricted business lists; merchants must confirm their MCC in writing before proceeding.

Fraud and security: FraudSight uses machine learning to predict fraudulent transactions before they occur. A basic version is included with the eCommerce gateway; advanced features cost extra. OmniShield Assure provides data breach insurance, EMV assurance, and end-to-end encryption. Tokenisation reduces PCI DSS scope. The Worldpay Merchant Guarantee Service covers losses from certain third-party unauthorised card-not-present fraud under defined eligibility criteria.

Pricing: Published PAYG rate for micro businesses starts at 1.3% + 20p for online Visa/Mastercard consumer transactions (source: Worldpay’s PSR-mandated online pricing tool, September 2025). Businesses with annual card turnover above £75,000 typically receive bespoke blended pricing; very high-volume merchants may qualify for IC++ (interchange-plus-plus). Contract length is typically 36 months, with automatic renewal clauses common — review carefully. Settlement is standard next-day for eligible UK merchants.

Limitations: Worldpay is an enterprise-first processor. Its onboarding complexity, typical 36-month contract terms, and reported inconsistencies in customer service responsiveness make it a poor fit for small or early-stage high-risk businesses. Several independent reviews flag hidden fees — always request a full itemised pricing schedule before signing. CMA inquiry into the Global Payments/Worldpay merger (announced April 2025) introduces some structural uncertainty for UK merchants.

Who should apply: Established UK businesses with strong processing history, large transaction volumes, and operations in mainstream high-risk sectors (travel, gaming, financial services) who need proven enterprise-grade infrastructure and multi-channel support.

Checkout.com – Best for Complex Enterprise Tech and Global Scale

What makes it different: Checkout.com is a technology-first payments infrastructure company, built on a single modern API that handles acquiring, processing, fraud, and payouts in one integration. It processes more than $300 billion in eCommerce volume annually (2025 projection, per company announcement, September 2025) and operates direct acquiring across 55+ countries in APAC, MENAP, the UK, and EEA. Unlike legacy processors, it offers granular transaction-level data, enabling enterprise merchants to optimise approval rates and fee structures actively.

Key features: Intelligent Acceptance uses AI to adjust routing, authentication, and data handling per transaction to maximise approval rates — the company states this tool has helped merchants generate over $10 billion in additional revenue. Identity Verification (built on its 2022 acquisition of Ubble) uses AI for biometric KYC. The platform supports card issuing via Visa partnership (launched July 2025), enabling merchants to issue their own branded cards. Tokenisation is comprehensive, including network token support aligned with Mastercard’s 2025 mandates in MENA.

High-risk context: Checkout.com serves complex tech-driven sectors, including fintech, digital goods, marketplaces, and select crypto/digital asset businesses (subject to FCA compliance). Its enterprise onboarding involves a detailed review of business model, delivery timelines, and compliance controls. The process is longer than specialist high-risk providers, but reflects its position as a regulated FCA-authorised payment institution. Clients include Netflix, eBay, ASOS, Pinterest, and Vinted.

Pricing: IC++ model (interchange + scheme fees + Checkout.com margin). Typical enterprise rates are 2.3–2.9% + $0.30 per transaction, depending on volume. No standard rate card is published; pricing is negotiated based on volume and risk profile.

Limitations: Checkout.com focuses exclusively on enterprise merchants. It is not the right choice for SMBs, and its onboarding timeline and compliance demands will exceed the patience of small operators needing quick approval. Its niche sector depth (adult, CBD, gambling) is less developed than specialists like Nomupay or Trust Payments.

Who should apply: Enterprise merchants in fintech, digital commerce, or tech-driven sectors with high transaction volumes, complex integration needs, and the internal resources to manage an enterprise-grade onboarding process.

Cashflows – Best for Transparent Pricing and UK SMEs

What makes it different: Cashflows is a Cambridge-based cloud payment processor, gateway, and European acquirer, regulated by the FCA as an electronic money institution since 2011. Notably, it was the first independent UK payments institution to achieve principal membership of both Visa and Mastercard simultaneously. It won ‘Best Online Payments Solution’ at the 2025 Payments Awards.

Pricing transparency: Cashflows offers genuine Interchange++ pricing for eligible merchants, which separately itemises the interchange fee (paid to the card issuer), scheme fees (paid to Visa or Mastercard), and Cashflows’ own margin. This is one of the clearest pricing models available for merchants who want to understand exactly where their processing cost comes from. Blended pricing is also available for lower-volume merchants.

High-risk capabilities: Cashflows serves sensitive content merchants, recurring billing operators, and businesses in retail, FSI, and insurance. Its fraud and chargeback monitoring tools are integrated directly with Visa and Mastercard’s early warning systems. As of 31 December 2023, Cashflows had 2,114 merchants and processed £8.8 billion, with net revenue of £18.3 million (from published company accounts).

Integration: Hosted (redirect), embedded checkout (fields hosted by Cashflows), and direct API. Omnichannel support includes in-person terminals (Castles hardware). A unified reporting platform covers both online and in-person payments.

Limitations: EEA-focused acquiring scope limits its utility for truly global merchants needing local acquiring in Asia or the Americas. Its sector depth for very high-risk niches (adult, crypto, gambling) is less extensive than Nomupay, Axcess, or Trust Payments.

Who should apply: UK SMEs and mid-market merchants in retail, financial services, or recurring billing who want transparent IC++ pricing, a UK-regulated acquirer, and clear contractual terms.

Trust Payments – Best for Licensed Gambling and iGaming Operators

What makes it different: Trust Payments has over 20 years of experience specifically in the regulated gaming vertical, and its product suite is built around the operational needs of gambling and iGaming operators. Its dedicated in-house gaming specialists actively monitor approval rates, BIN blocks, and local transaction speeds for gaming clients.

Gambling-specific features: The platform offers a ‘Gambling Harm Detection’ tool (Probability of Harm model) that proactively identifies at-risk players, helping licensed operators meet UK Gambling Commission social responsibility requirements. Pay-in, pay-out, and subscription flows support instant withdrawals — a critical retention feature for iGaming operators. Over 50 processing currencies are supported. Merchants operating under MCC 7995 (gambling and related MCCs) must hold a valid UK Gambling Commission licence; Trust Payments’ acquiring partner, acquiring.com provides the merchant acquiring infrastructure.

Security: AES256 encryption, SSL certificates, and minimum TLS 1.2 for all data in transit. Integration options include no-code (payment links), low-code (hosted redirect), API, and platform plugins. Omnichannel via the Converged Commerce product with Ingenico and Castles terminals.

Pricing: Bespoke per MCC and turnover. Same-day cashout is available for eligible operators under agreed settlement terms — confirm this specifically in writing.

Limitations: Specialist in regulated gambling; less developed for other high-risk niches. Only uses its own acquiring solution, which reduces flexibility if you want to shop acquirers for a rate. Best suited to EU-incorporated or UK-licenced gambling operators; less suited to non-gambling high-risk sectors.

Who should apply: Licensed UK or EU gambling and iGaming operators who need a processor with deep sector expertise, responsible gambling compliance tools, and fast player payouts.

Axcess Merchant Services – Best for Adult, Crypto, and Niche SMBs

What makes it different: Established in 2007, Axcess Merchant Services is a UK-based specialist focusing on SMBs in high-risk sectors that mainstream providers frequently decline. Its model is built around working with a diverse range of banking partners, so it can match each merchant to the acquiring bank most appropriate for their sector rather than routing all merchants through a single relationship.

Sectors: Adult entertainment, gaming and gambling, cryptocurrency exchanges, CFD and forex brokers, CBD, travel, subscription services, skill-based competitions, dating, financial services, and regulated sectors.

Fraud tools: Over 60 configurable risk settings, two PCI DSS Level 1 gateways, in-house fraud prevention with copy-and-pay integration. Supports 179 currencies, making it strong for international operations.

Pricing: Fully bespoke; negotiated based on sector, volume, and risk profile. No standard rates are published.

Limitations: Less well-suited to very large enterprise merchants who need global acquiring infrastructure at scale. Published information on settlement timelines is limited; always confirm in the written contract.

Who should apply: UK and global SMBs in adult, crypto, CFD, forex, or other niche high-risk sectors that need a provider with genuine sector expertise and access to multiple banking relationships.

Fibonatix – Best for CBD, Vape, and Europe/ MENA Focus

What makes it different: Founded as a consultancy in 2008 and transitioning to a payment services provider from 2013, Fibonatix specialises in high-risk sectors with complex regulatory environments, particularly CBD, vaping, nutraceuticals, and adult content. Its European and Middle Eastern processing infrastructure makes it well-positioned for merchants needing reliable acquiring in these regions.

Sectors: CBD and seeds, vape and e-cigarettes, gaming and gambling, cryptocurrency, nutraceuticals, supplements, adult entertainment, and dating.

Key features: Fast merchant onboarding (3–5 business days typically) using a hybrid of automated systems and personal case management. Settlement in multiple currencies. Chargeback protection and fraud management built in. Full AML and KYC compliance processes.

Limitations: Less prominent UK brand recognition than Nomupay, Worldpay, or Checkout.com. Most suitable for Europe and MENA markets; less developed US acquiring capability.

Who should apply: CBD, vape, or nutraceutical merchants needing fast onboarding and European/MENA acquiring; businesses in the adult sector looking for a dedicated, specialist provider.

Key Factors When Choosing Your High-Risk Gateway

1. Reserve Requirements

Rolling reserves are the most common cash-flow trap in high-risk processing. A rolling reserve is a percentage of each transaction — typically 5–15% — held back by the acquirer for a defined period (commonly 90–180 days) as security against future chargebacks. Some providers require an upfront bond instead. Neither is inherently unfair, but the terms vary enormously. Key questions: What percentage is held? For how long? What triggers a reduction? Are reserve requirements reviewed after 6–12 months of clean performance?

2. Dedicated Account vs. Aggregator Model

A dedicated merchant account means your processing is independent. An aggregator pools you with other merchants under a shared MCC, meaning another merchant’s chargeback problems can trigger restrictions on your account. For high-risk businesses, a dedicated merchant account is strongly preferred.

3. Chargeback Management Tools

Your gateway’s ability to intercept disputes before they become formal chargebacks is directly tied to your VAMP and Mastercard ECP ratios. Look for integration with Verifi (Visa’s CDRN/RDR) and Ethoca (Mastercard’s alert network). Ask how quickly alerts are delivered and whether the system can automatically issue refunds on flagged transactions before the chargeback is filed.

4. PCI DSS Scope

Your PCI DSS obligations depend on your integration method. Hosted payment pages (redirect) dramatically reduce your PCI DSS scope, as card data never touches your servers. Direct API integrations push you to PCI DSS SAQ D or a full QSA assessment. PCI DSS Level 1 certification at the provider level (as held by Nomupay and Axcess) is the most rigorous standard. If you use a hosted integration from a Level 1 provider, your PCI compliance burden is minimal.

5. MCC Code and Written Acceptance

Your Merchant Category Code (MCC) is assigned by your acquirer and determines how your transactions are classified by Visa and Mastercard. High-risk MCCs include 7995 (gambling), 5912 (pharmacies), 6012 (financial institutions), 6051 (crypto/non-financial foreign exchange), and others. Always obtain written confirmation from your provider that your specific MCC and business model are approved before onboarding. Verbal assurances are not contractually binding.

6. Settlement Speed and Multi-Currency

Settlement timelines for high-risk merchants are set by contract and risk assessment, not by card scheme rules. T+1 (next-day settlement) is available from some providers but is typically reserved for established merchants with clean performance history. New accounts may face T+3 to T+7 settlements, with reserve deductions applied first. Confirm the exact funding timeline in writing, including what events trigger settlement delays.

Reserve Term Checklist — Ask Every Provider

• What percentage is withheld, and is it a rolling or upfront reserve?
• Over what time period are funds released?
• What KPIs trigger a reserve reduction?
• Is there a maximum reserve cap?
• What happens to reserve funds if the account is terminated?

Common Misconceptions

Misconception 1: Offshore gateways always offer lower fees. In practice, lower headline rates from offshore providers are often offset by higher rolling reserves, longer settlement cycles, weaker fraud tooling, and fewer legal protections if a dispute arises. FCA-regulated UK providers operate under consumer protection and anti-money-laundering frameworks that offshore providers may not.

Misconception 2: Reserve requirements are fixed by Visa or Mastercard. Card schemes do not mandate specific reserve percentages. Reserve levels are set entirely by your acquiring bank based on their own risk assessment of your business. Even well-established merchants with clean chargeback histories may be subject to reserves in sensitive sectors.

Misconception 3: A single application to multiple providers improves approval odds. The opposite is true. Multiple simultaneous applications create a visible declined-application trail in underwriting databases, making future approvals harder. Apply to two or three carefully matched providers sequentially, not simultaneously.

Misconception 4: 3D Secure automatically reduces your processing fees. 3DS2 can shift certain fraud liability and improve your risk profile with your acquirer, which may inform future rate negotiations. It does not automatically reduce fees on existing contracts. Its primary value for high-risk merchants is reducing unauthorised card-not-present fraud, which directly protects your VAMP ratio.

FAQs

Your Next Step

Before contacting any provider, complete the following:

1. Confirm your MCC code and verify it is not on the provider’s prohibited list
2. Prepare 6–12 months of bank statements and processing history if available
3. Ensure your website has visible terms of service, refund policy, and contact details
4. Prepare accurate monthly transaction volume and average ticket value forecasts
5. Shortlist no more than 2–3 providers that match your sector and volume profile
6. Request written confirmation of: reserve percentage and duration, settlement timeframe, MCC approval, VAMP monitoring tools, and contract termination rights
7. Never accept the first offer without reviewing the reserve terms in full

The right gateway balances security, sector expertise, compliance support, and cash-flow terms. Cost should be a factor, but it should never be the deciding one.