Who Needs to Be Involved Before You Add Crypto Payments?

• A crypto payments provider handles your users' data, so it goes through a vendor review like any other supplier with that access.
• Privacy looks at who is responsible for the data and how much reaches your systems. Security reviews certifications and which other companies receive the data.
• Procurement gathers your KYB documents, and legal confirms the data protection terms are part of the main agreement.
• Finance reviews fees and who handles chargebacks and user support.
• A 45-minute agenda gives all five teams a slot in one meeting.

A third-party vendor risk assessment is the check a company runs on a supplier that will touch its systems or customer data. A crypto payments provider qualifies because it verifies your users' identity and processes their card payments.

In Verizon's 2026 Data Breach Investigations Report, breaches involving a third party made up 48% of the total, up from 30% a year earlier. With a third party involved in nearly half of breaches, companies review a supplier's access to their data before launch.

Privacy wants to know who is responsible for your users' data at each step. That decides who answers a user's request for a copy of their data, and who notifies the data protection authority when required.

The EU's data protection law, the GDPR, defines two roles. The controller decides why and how personal data is used. The processor handles personal data on the controller's behalf.

A payments provider can hold both roles for different activities. It processes some data for you, and it keeps its own verified records of each user, because anti-money-laundering rules require it.

Under our business terms, we act as your processor for the personal data you share with us to run the service, following your documented instructions.

On the user side, our privacy notice names the Mercuryo company each user contracts with as the controller of that user's account. That split tells your privacy team who answers each kind of user request.

Privacy also asks how much user data your systems touch. That depends on how deeply you connect, and we support two levels.

With a light connection, users upload identity documents and complete a liveness check (a selfie) inside our widget, and we collect and verify them for you.

The light connection can also include silent authentication. Users accept our terms in your app, your system signs them in, and we run authentication on our side, so they skip the login step.

If you already verify users with a supported KYC provider and want a deeper connection, KYC sharing can transfer that verification to us once our compliance team approves the setup, so users can skip a second ID check.

Another deeper option is to send identity documents to us from your own systems, with users completing a liveness check in our widget.

Because each level changes how much user data your systems hold, agree on the connection type with privacy before engineering starts.

Security sends a vendor risk assessment questionnaire, a list of questions about how the vendor protects data. For a crypto payments provider, start with these questions.

• Is its security certified?
• Where is the data stored?
• Which other companies handle it?
• Will you hear before that list changes?
• How will you hear about an incident?
• Can you audit it?

• Our security is certified to ISO/IEC 27001:2022, announced in April 2026, and we are authorised under PCI DSS, the card industry's data security standard.
• Data is stored and processed in the EU, the UK, the US, and other regions, as set out in our privacy notice.
• AWS and Microsoft Azure are our cloud providers, under our business terms.
• Any new or replacement sub-processor, meaning another company handling the data, comes with advance notice, and you can object on data protection grounds.
• You hear from us without undue delay if your users' personal data is affected, in line with the standard the GDPR sets for processors.
• Audits are allowed with reasonable notice.

Security reviewers can request certificate details and supporting evidence from us during their review.

Payment providers verify the businesses they work with, as they do with users. This step is called KYB, short for know your business. Depending on the company, procurement, legal, or compliance prepares it.

For Mercuryo's KYB, the standard set covers basic information about your business, the people who own and run it, and identity verification for those key people. Production access starts once KYB is approved, so prepare these documents early.

Legal checks that the contract sets out how your users' personal data is used. Under the GDPR, a processor's work must be governed by a written contract, and that contract can be part of the main agreement.

Our version of those terms sits in the data protection section of our business terms and addresses instructions, security, sub-processors, audits, transfers and incidents. Our legal team works with yours to finalise the contract as part of onboarding.

Finance joins to approve the fees. We publish the fees users pay, and the pricing you choose is confirmed during onboarding.

Finance then looks at the day-to-day work of running payments. We act as merchant of record for transactions through our on-ramp and off-ramp, and manage chargebacks and payment disputes, including fraud checks. Users also get 24/7 support from us, starting on launch day.

Market coverage matters for the revenue plan, and our on-ramp is available in 150+ countries and 62 currencies. We confirm which services are live in your target markets.

Send this agenda and our documents a week ahead, so each reviewer reads their part before the meeting.

The timings add up to 45 minutes, and any open points become next steps toward sign-off.

Once your teams sign off, onboarding starts. Our sales and technical teams stay with you through the integration, and a dedicated success manager supports you after launch.

Before your internal meeting, ask us for the documents each team needs, and we'll send them over.

Is a crypto payments provider a data controller or a processor? It can be both, depending on the activity. A provider acts as a processor for the data you share, and as a controller for the account data users give it directly.

In our case, we are your processor under our business terms, and the Mercuryo company each user contracts with is the controller for that account under our privacy notice.

What goes in a vendor risk assessment questionnaire for a payments provider? A practical core set includes certification, where data is stored, which other companies handle it, notice of changes, how incidents are reported, and audit rights. We answer each of these in published documents and hold ISO/IEC 27001:2022 certification.

What should a crypto payment processor comparison include beyond fees? How much user data each connection type shares, which certifications the provider holds, who handles chargebacks and disputes, and who supports your users. As merchant of record, we manage chargebacks and disputes for transactions through our ramps and offer users 24/7 support.

Do we need a data processing agreement? Yes, if the provider processes personal data on your behalf. The GDPR requires a written contract for that, and it can form part of the main agreement. Ours is in the data protection section of our business terms.