That is the question a diligence reader actually has, so it is answered here in full: who you contract with, who holds the money, how Crosswire is paid, how providers are vetted and when they are named. This is not a certifications page. The substance is the structure.
Everything on this page is structural. There are no counts, no dates that age and no live status, because a fact that needs updating every month is a fact that will eventually be wrong here.
Three separate relationships. Crosswire sits beside the money, never inside it.
Regulated services are contracted with the party that holds the licence.
Money moves between the client and the provider, in both directions.
The provider pays Crosswire. No Crosswire margin sits in the infrastructure price.
Most payment companies cannot draw this diagram, because they sit in the middle of the money. The separation is the point: what Crosswire cannot touch, it cannot lose, freeze or fail to return.
One answer each, with the document that substantiates it.
The licensed provider. Every regulated service is provided by, and contracted directly with, the provider that holds the licence for it.
Crosswire's own relationship with the client covers design, coordination and integration support. It is not a regulated service, and Crosswire has no authority to bind the client or a provider, to agree regulated terms on either side's behalf, or to approve anyone for anything.
The licensed provider. Crosswire holds no client funds, ever.
Funds move between the client and the provider in both directions. Crosswire does not receive, hold, safeguard or take possession of client money at any point, and holds no account into which client money is paid.
Crosswire is paid by the infrastructure partners, so the infrastructure price carries no Crosswire margin. If you want advisory or implementation work on top, that is a separate chargeable service and it is quoted and agreed in advance before any work starts.
The incentive that creates is worth stating openly rather than leaving it to be discovered: Crosswire earns only when a rail is actually placed and used, so it is paid for a stack that goes live and stays live, not for an introduction. It also means the reader should assume Crosswire has a commercial relationship with every provider it proposes, and should read a recommendation with that in mind.
The counterweight is structural. A rail that gets declined, churns or fails in production pays nothing, and the client is the party who chooses whether to proceed, on the provider's own paper.
Against a published maturity ladder, and only the top rung is assignable.
A provider moves from discovered, to commercial, to verified, to production-verified, to routable. Only routable providers are assigned to a client stack. The full ladder and the rule are set out below.
When onboarding begins. Providers are selected, locked and disclosed at that point, and not before.
This is policy, not evasion. Before onboarding, a rail is a design choice that can still change on the basis of the entity, the vertical, the volumes and the provider's own read of the flow. Naming it early would present a candidate as a commitment. Discovery, design and pricing therefore describe rails at capability level: licensed banking, licensed card acquiring, regulated digital-asset settlement, verification.
Membership of the Crosswire network is a separate matter and is public: partners who have agreed to be named are named on the site. Which of them serves a particular client's rail is what stays closed until onboarding.
The rail is re-routed to an alternative in the network, and the work already done is kept.
Approval is the provider's decision alone, and no part of the Crosswire process can override it. Where a provider declines, the compliance record and the documents already collected stay in place and only the difference the alternative provider requires is requested. The client is not asked to start the file again.
Where no routable alternative fits the flow, Crosswire says so rather than proposing a rail that is not tested for it.
The information a provider needs to assess and onboard the client, shared with the client's knowledge for that purpose.
In practice that is corporate and business information, the commercial profile of the flow, and the KYB and KYC documentation the provider requires. It is shared so the provider can perform its own due diligence and price the flow. It is not sold, and it is not shared for advertising.
The rights the GDPR gives you: access, rectification, erasure, restriction, portability and objection, exercised by writing to us.
Retention is set out in the privacy notice, along with the legal bases we rely on and the position on international transfers. Once a provider holds data as its own controller, that provider's own notice governs it as well, and its identity is known to the client from the point onboarding begins.
The maturity model Crosswire runs providers through, published as policy.
Identified as a possible rail. The capability is claimed by the provider and nothing has been checked or tested.
Terms have been discussed and a commercial basis agreed in principle. A signed partnership sits here. Nothing has been run.
Licence, legal entity and permissions checked against the public registers of the relevant authority, and the provider's documentation reviewed against the capability claimed.
Real flow has run. Onboarding has been completed end to end, payments have settled, and the behaviour that only appears in production has been observed: failure handling, support responsiveness, reconciliation quality and how the provider behaves when something breaks.
Production-verified, currently accepting the flow profile in question, and commercially in place for it. Only a routable provider is assigned to a client stack.
Only routable providers are assigned to a client stack. The reason the ladder has five rungs rather than two is that a signed partnership is not a tested rail: most of the industry publishes the second rung and lets the reader assume the fourth. A provider can be verified on paper and still be unroutable, because the flow it accepts today is not the flow in front of us.
The ladder and the rule are published. Per-provider status is not, and neither are licence verification dates: a date on a page ages the moment it is written, and a stale date reads as assurance while being worth less than none.
Stated plainly, because implied adjacency is worse than absence.
Crosswire is operated by Wernberg & Partners AB, registered in Sweden under company registration number SE5569781734, at Sveavägen 159, 113 44 Stockholm, Sweden.
Written questions on any of the above: hello@crosswirepay.com.