Methodology
How verification works
We verify individual claims, not companies. Every decision records who checked what, against which source, for what scope, and until when.
What gets verified
Four kinds of claim can be verified, each on its own:
- Capabilities, per product. For example, international card acquiring for Nigerian merchants, with stated payer regions, card networks, settlement currency and the entity that actually provides acquiring.
- Regulatory licences, such as a CBN switching and processing licence, including the holder entity.
- Certifications, such as PCI DSS or ISO/IEC 27001, always with their scope.
- Corporate registration.
Verification states
| State | Meaning |
|---|---|
| Self-reported | Stated by the provider. No evidence has been reviewed. |
| Evidence submitted | The provider has submitted evidence. It has not been reviewed yet. |
| Under review | A platform reviewer is examining the evidence. |
| Evidence reviewed | A reviewer examined the provider's evidence and found it consistent with the claim, within the stated scope. |
| Independently confirmed | Confirmed against an independent source, such as a public register or the issuing body. |
| Not substantiated | The evidence did not support the claim. Rejected claims are not shown publicly. |
| Verification expired | This claim was verified before, but the verification has passed its expiry date. |
Evidence we accept
- Corporate registration documents and public registry records
- Regulatory licences and public regulator registers
- PCI DSS Attestations of Compliance (AOC) or Reports on Compliance (ROC). A generic certificate or logo is never enough for a PCI DSS claim.
- ISO certificates together with their scope statement
- Data protection documentation
- Product and official API documentation, sandboxes and live tests
- Contracts or partner evidence (for example, a sponsoring bank or acquiring partner), reviewed privately
- Customer references
Evidence is stored privately. It is never public, never indexed by search engines, and is seen only by the provider's own team and our reviewers. Every time a reviewer opens a document, it is logged.
How a decision is made
- The provider adds a claim. It starts as Self-reported.
- The provider attaches evidence. The claim becomes Evidence submitted.
- A reviewer checks the evidence against the exact claim: the legal entity, the scope, the dates and the qualifiers.
- The reviewer records a decision with its source, scope, rationale, a public summary and an expiry date (12 months by default, or sooner if the document expires sooner).
- If the provider later edits a verified claim, it goes back to Self-reported, because the evidence no longer matches.
- When verification expires, the claim is marked Verification expired until it is reviewed again.
How comparison uses verification
| Cell | Meaning |
|---|---|
| Supported | Provider states support and the claim has been verified. |
| Not verified | Provider states support, but the claim has not been verified. |
| Not supported | Provider states this is not supported. |
| Not disclosed | No information has been provided. |
Missing information is never treated as "not supported". We never declare a universal winner.
What verification does not mean
Platform verification covers only the claim and scope stated. It does not replace a regulator, an auditor or your own due diligence, and it is not an endorsement or an approval by any financial institution.
We never claim a provider is approved by all, or any, financial institutions. Rankings are never sold, and listing is free.
Unclaimed profiles
Our team may create a profile for a company before it joins, using properly sourced public facts only. Those profiles are labelled Unclaimed, list their sources, and contain no capability claims the company hasn't made. A company takes control by verifying ownership with a work email on its own domain, or through a document review.
Corrections
If you believe a claim is wrong, email verification@fintech-atlas.example with the provider name, the claim and your evidence. Providers can update their claims at any time from their dashboard.