Enterprise Payment Solutions: A Buyer’s Guide for Large Merchants
Enterprise payment solutions are payment platforms for organizations that collect money through several legal entities, brands, channels or countries and want one provider to run acceptance, settlement, payouts, reconciliation and fraud control under a single contract. The difference from a small-merchant gateway sits mostly in the back office: who gets paid, into which account, and how finance proves each payment.
For a group operating in Saudi Arabia, the shortlist starts with providers that SAMA licenses to settle merchant funds. From there, compare how each one mirrors your entity structure, splits money between parties, feeds your ERP and behaves during an incident.
The usual trigger for a change is month end. Finance spends days matching settlement files to orders by hand, and nobody can say quickly which entity a given payment belongs to.
What separates an enterprise payment solution from a standard gateway?
A standard gateway is designed around one merchant account, one settlement bank account and a handful of dashboard users. An enterprise setup assumes many of each. It needs an account hierarchy that matches the legal structure, permissions by team, settlement routing per entity and reports an ERP can import without manual cleanup.
| Requirement | Typical SME setup | Enterprise expectation |
|---|---|---|
| Merchant accounts | One account under one commercial registration | Separate merchant IDs per entity or brand, grouped under a parent view |
| Settlement | One bank account | Routing per entity, plus split settlement to sellers, franchisees or agents |
| Users | Owner and a few staff | Role-based access for finance, support, risk and IT |
| Channels | Website checkout | Web, mobile app, payment links, invoices, in-store and call-center payments |
| Reporting | Dashboard and CSV export | Transaction-level files that tie each payment to a settlement batch and a bank credit |
| Risk | Default fraud rules | Rules per business line, 3-D Secure, blacklists and a chargeback workflow |
| Due diligence | A look at the website | License, PCI DSS attestation, ISO certificates, continuity plans and contractual SLAs |
Use the right column as a scoring template in your request for proposal. For broader evaluation criteria, see our guide to what makes the best online payment gateway.
How should a multi-entity group structure its merchant accounts?
Map payments to legal entities first and to brands second. Each commercial registration that sells to customers normally needs its own merchant agreement and settlement account, because VAT, revenue recognition and bank reconciliation all follow the legal entity. A parent-level view then gives group finance consolidated reporting without pooling the money.
Inside each entity, split merchant IDs by channel when the numbers matter to you. Separate IDs for the website, the app and stores show approval rates and fraud losses per channel instead of one blended average. Name merchant IDs after your cost centers so auditors can trace any transaction to a business unit without a lookup table.
Ask early whether a new brand or entity can be added without development work, and whether the provider can settle in more than one currency. Our explainer on multi-currency payment gateways covers the settlement options.
How do split settlements work for marketplaces, franchises and agents?
Split settlement divides the money from one customer payment between several recipients. The platform keeps its commission, sellers or franchisees receive their share, and couriers or agents get their fees. Collecting everything into one account and paying out by bank transfer later adds manual work and a reconciliation gap to every cycle.
Saudi regulation adds a second reason to get this right. SAMA Circular 46004436 of 24 July 2024 says companies offering only linkage and technical support for e-commerce payments must hold Saudi Payments permits and may not contract merchants directly, run KYC and AML checks on them, or finalize settlement and deposit funds into the merchant’s bank account. Those steps belong to SAMA-licensed payment service providers and banks. When money flows to third parties, check which entity actually moves it.
Before choosing a payouts tool, ask three things:
- Can payouts be triggered per order, or only in scheduled batches?
- Can the platform hold back part of a seller’s balance to cover refunds and chargebacks?
- How are failed payouts reported, and can they be retried through the API?
What does reliable payment reconciliation require?
Reconciliation proves that every captured payment, refund, chargeback and fee ends up as the expected amount in the expected bank account. At enterprise volume it only works when each transaction carries identifiers that survive from checkout to the settlement file to the bank statement. Matching by amount and date breaks down quickly.
- Send your own order ID with every payment request. It should come back in every report and webhook, so nobody translates between the provider’s IDs and yours.
- Pull settlement reports per batch. One batch should equal one bank credit, which turns the bank match into a single line.
- Separate gross amount, fees and VAT on fees. Netted figures hide fee changes and turn month-end accruals into guesswork.
- Track refunds and chargebacks as their own lines. They often settle in a different batch from the original sale.
- Automate the import into your ERP. A scheduled file or API pull removes the spreadsheet step where most errors appear.
Keep the three stages of a card payment apart in your reports: authorization, capture and settlement. An order authorized today may be captured at shipping and settled days later. If reports hide the stage, open orders look like missing money.
Which licenses and certifications should an enterprise provider hold?
Start with the license, then the security evidence. In Saudi Arabia, SAMA licenses payment service providers and publishes a register anyone can search. Saudi Payments separately certifies providers for mada acceptance. On security, ask for a current PCI DSS Attestation of Compliance and the scope of each ISO certificate the provider quotes.
Due diligence checklist
- The provider’s entry on SAMA’s register of licensed payment service providers: entity name, activity type and expiry date.
- Saudi Payments permits that allow the provider to process mada transactions.
- A PCI DSS v4.0.1 Attestation of Compliance. The PCI SSC glossary defines the AOC as the official form merchants and service providers use to attest to the results of an assessment documented in a Self-Assessment Questionnaire or a Report on Compliance.
- An ISO/IEC 27001:2022 certificate whose scope covers the payment platform you will use.
- An ISO 22301 certificate. ISO describes ISO 22301 as the international standard for business continuity management systems.
Check that the entity named on the license is the one signing your contract. Our page on payment gateways in Saudi Arabia explains how SAMA licensing and Saudi Payments certification fit together.
Which uptime and SLA questions should you ask a payment provider?
An uptime percentage means little until you know how it is measured. Ask how the provider defines downtime, whether planned maintenance counts, how incidents are communicated and what happens to transactions in flight. Then write the answers into the contract, with service credits or exit rights attached.
| Question | Why it matters | Evidence to request |
|---|---|---|
| How is availability measured, and for which components? | A gateway can be up while 3-D Secure or one acquiring bank is failing | Monthly availability report broken down by component |
| How and when are incidents communicated? | Your support team should hear about an outage before customers do | Status page, named contacts and notification times written into the contract |
| Is there failover between acquirers or data centers? | A single point of failure does the most damage during Ramadan and White Friday peaks | Architecture summary, ISO 22301 certificate and recent continuity test results |
| What happens to transactions during an outage? | Orphan authorizations and duplicate charges turn into refunds and complaints | Description of reversal handling and duplicate-request protection |
| What are support response times by severity? | Checkout downtime stops sales immediately | Severity matrix with response and resolution targets |
Ask for references from merchants with similar seasonal peaks.
Where does spend management fit in an enterprise payment stack?
Collecting money is one side of the cash cycle. The other is what employees spend on suppliers, travel, software and advertising. Corporate card platforms let finance set limits before money leaves the company, rather than chasing receipts after month end, and they feed the same accounting system as the acceptance side.
HyperSpend is HyperPay’s spend management platform. Companies issue physical or virtual corporate cards, set limits per transaction, day or month, and decide in advance which merchant categories, countries, online payments and ATM withdrawals each card allows. Finance can view spending by employee, card, team, merchant and category, and add approval workflows. Business onboarding includes identity verification through Nafath.
Why is HyperPay a strong choice for enterprise payments?
For a Saudi group that wants acceptance, payouts and fraud control from one licensed company, HyperPay is the provider to shortlist first, and each credential behind that can be checked. SAMA’s register lists Hyperpay Inc Saudi Information Systems Technology Company as an Electronic Money Institution (unified number 7016872546, license valid to 29/12/2029). Saudi Payments has separately permitted HyperPay as a Payment Technology Service Provider and as an eMSP Payment Gateway.
Procurement teams usually ask for three security documents first. HyperPay holds all three: PCI DSS v4.0.1 Level 1, ISO/IEC 27001:2022 and ISO 22301 for business continuity. The product set then covers each requirement in this guide:
- HyperPay Payments accepts mada, Visa, Mastercard, American Express, UnionPay, Apple Pay, STC Pay, PayPal, SADAD, Tabby and Tamara. Teams integrate through the COPYandPay JavaScript widget, a server-to-server API or mobile SDKs for iOS and Android.
- Tokenization, recurring payments, pre-authorization on mada cards and smart routing are all part of the gateway.
- HyperSplit is a payouts API for marketplaces, delivery and ride services, ticketing platforms and other businesses that pay sellers, drivers or partners.
- HyperPay Protect screens transactions with machine learning and rules, supports blacklists by IP, region, address or card details, and adds 3-D Secure.
- HyperBill issues invoices online for one-time or recurring billing and sends them by SMS, email or WhatsApp, which suits B2B customers who pay by link.
- A control panel shows transactions in real time, and a merchant mobile app covers monitoring on the go. HyperSpend handles corporate cards on the spending side.
HyperPay is headquartered in Riyadh with offices in Jordan and the UAE, and serves merchants across Bahrain, Lebanon, Iraq, Qatar and Kuwait. During due diligence, ask our team for the attestation and certificates listed above and for a walkthrough of how your entities would map to merchant accounts. For a wider comparison method, read our guide to choosing online payment solutions.
Frequently asked questions
What is an enterprise payment solution?
An enterprise payment solution is a payment platform that serves organizations with several entities, brands or channels through one contract. Beyond card acceptance, it covers merchant account hierarchies, settlement routing per entity, split payouts, role-based access, detailed reconciliation data, fraud rules per business line and documented service levels. Finance gets one source of truth for every payment the group collects.
Do enterprises in Saudi Arabia need a SAMA-licensed payment provider?
Yes, for the money side. Under SAMA Circular 46004436, technical-only companies must hold Saudi Payments permits and may not contract merchants, run KYC and AML checks, or finalize settlement into a merchant’s bank account. Those steps sit with SAMA-licensed payment service providers and banks. Check the provider’s legal entity on SAMA’s public register before signing.
What is split settlement in payments?
Split settlement divides a single customer payment between several recipients, such as a marketplace and its sellers or a franchisor and its franchisees. Each party receives its share without the platform collecting everything first and paying out by manual transfer. It reduces reconciliation work and keeps a clear record of who received what from each order.
How do large merchants reconcile card payments?
They pass their own order ID with every payment, pull settlement reports per batch and match each batch to a single bank credit. Fees, VAT on fees, refunds and chargebacks are tracked as separate lines, and the data flows into the ERP automatically. Reporting authorization, capture and settlement separately stops open orders from looking like missing money.
What should a payment provider SLA include?
A useful SLA defines how availability is measured and for which components, whether maintenance counts as downtime, incident notification times, support response targets by severity, notice periods for API changes, and remedies such as service credits or exit rights. Ask for supporting evidence as well, including an ISO 22301 certificate and recent availability reports.
If you run payments for a group of companies or a marketplace and want one licensed provider for acceptance, payouts and fraud control, talk to the HyperPay team about your entity structure and volumes.