The regtech that unifies the entire merchant lifecycle - discovery, onboarding, and continuous risk monitoring - into one platform banks actually trust.
Onlayer's red wordmark, as it appears on the company's homepage. The Ankara-founded firm now runs merchant-risk checks for institutions from Dubai to London. - Photo: Onlayer
Every acquiring bank lives with the same low hum of anxiety. The merchant it approved last month may be laundering transactions this month. A storefront that looked clean at onboarding may be selling something it shouldn't by the next quarter. For years, the tools to catch that drift were scattered across compliance spreadsheets, manual reviews, and after-the-fact fines from Mastercard and Visa. Onlayer, a company founded in Ankara in 2019, built itself around closing that gap.
The pitch is deceptively plain: bring merchant discovery, onboarding, and ongoing monitoring into a single system, and automate the risk and compliance checks that sit underneath each stage. In practice that means an acquiring bank, a payment service provider, or a fintech can run a prospective merchant through web scanning and payment-signal capture, push it through AI-driven onboarding tuned to the channel - e-commerce, point of sale, marketplace, or social commerce - and then keep watching the portfolio for the kinds of trouble that only surface later. PCI-DSS readiness, anti-money-laundering screening, Mastercard's BRAM program, Visa's VIRP, and transaction-laundering detection are folded into the workflow rather than bolted on afterward.
It is not a glamorous corner of fintech. It is also, arguably, one of the more consequential ones. When merchant risk goes wrong, the consequences are scheme fines, frozen licenses, and reputational damage that ripples through a bank's entire acquiring business. Onlayer's wager is that the institutions carrying that risk would rather pay for a system that catches it early than absorb the cost of catching it late.
Onlayer describes its work as merchant risk and performance management, but the structure is easiest to read as a lifecycle. At the front sits Lead Generation - advanced web scanning and merchant profiling that captures signals about how a business actually takes money: which wallets it supports, whether it offers buy-now-pay-later, which alternative payment methods appear at checkout. Test transactions can probe further. The point is to understand a merchant before, not after, a relationship begins.
The middle stage, Merchant Onboarding, is where the automation earns its keep. Instead of a uniform checklist, Onlayer applies channel-specific logic - the questions and risk weights for a marketplace seller differ from those for a bricks-and-mortar POS merchant - and runs AI-driven decisioning against compliance requirements including PCI-DSS, AML, BRAM, VIRP, and transaction-laundering detection. Onboarding that once took weeks of manual review compresses into a decision with compliance already checked.
The final stage, Merchant Monitoring, is the part banks tend to neglect and regret. Onlayer runs continuous portfolio surveillance, watching for policy and compliance drift, transaction laundering, malware, and e-skimming. It layers in third-party and reputation risk through social-media screening and dark- and deep-web monitoring, and connects back into a client's internal systems by API.
Underneath it all is a credential most competitors can't claim: Onlayer is a certified Mastercard Merchant Monitoring Service Provider, a status that equips acquiring banks to detect transaction laundering and prevent BRAM violations that would otherwise threaten their scheme licenses.
"To be the undisputed standard for merchant trust and payment security worldwide."
- Onlayer's stated missionWeb scanning and merchant profiling that captures payment-method signals and supports test transactions to surface prospects and hidden risk.
AI-driven decisioning with channel-specific logic for e-commerce, POS, marketplaces, and social commerce - with PCI-DSS, AML, BRAM, VIRP and TLD readiness built in.
Continuous portfolio surveillance for compliance drift, transaction laundering, malware and e-skimming, with API integration into internal systems.
Automated Mastercard BRAM and Visa VIRP scanning inside onboarding and monitoring to help acquirers avoid scheme penalties.
A certified product that helps acquiring banks detect transaction laundering, prevent BRAM violations, and protect scheme licenses.
Vendor and reputation checks including social-media screening plus dark- and deep-web monitoring.
Onlayer's customers are the organizations that answer for merchant behavior: acquiring banks, payment service providers and acquirers, marketplaces and e-commerce platforms, fintechs and digital-wallet providers, and - at the top of the pyramid - central banks and national card schemes. The company reports more than 200 clients, including some 90 financial institutions, and names Mastercard, BNP Paribas, Emirates, Wio, Alternative Payments, and iyzico among the firms it works with.
The differentiation is less about any single feature than about consolidation. Most banks stitch merchant risk together from a handful of point tools - one for onboarding, another for screening, a third for monitoring - and the seams between them are where risk hides. Onlayer's argument is that owning the whole lifecycle removes those blind spots. A signal captured at discovery informs the onboarding decision, which informs what monitoring watches for.
The second differentiator is regulatory depth. Coverage of 150+ country-specific frameworks and formal certifications - Mastercard MMSP, PCI Security Standards Council membership, Mastercard technology-provider status - are the kind of credentials that take years to earn and are hard for a generalist fraud tool to replicate.
Against alternatives such as G2 Risk Solutions, LegitScript, ComplyAdvantage, Sift, Ravelin and Featurespace - most of which specialize in one slice of the problem - Onlayer competes on breadth of the merchant lifecycle plus scheme-level compliance in a single platform.
Onlayer runs a B2B SaaS model: a modular subscription platform sold to banks, PSPs, marketplaces, fintechs and card schemes, generally scaled by merchant volume and by the modules a client turns on - onboarding, monitoring, compliance, analytics - and integrated into internal systems by API.
Selling to this buyer is its own discipline. Co-founder and CEO Kivanç Harputlu has spoken publicly about the realities of high-stakes B2B growth: long enterprise sales cycles, buyers who cannot afford a wrong risk decision, and the patience required to earn credibility one certification at a time. That patience shows up in the company's roots. Onlayer began life close to a PCI-compliance project - its Crunchbase record still carries the legacy name "PCI Checklist" - and grew outward into a full merchant-management platform.
The expertise is concentrated where it counts: payment-scheme rules, transaction-laundering patterns, and the regional regulatory frameworks that differ market to market. It is the sort of domain knowledge that compounds slowly and is difficult to shortcut.
In November 2025, Onlayer closed an $8.2 million Series A led by Oleka Capital. The round drew a notably deep bench of backers, and the company earmarked the capital for geographic expansion into MENA and Asia-Pacific alongside a deeper push into AI-powered risk, compliance, and performance analytics - including plans for an AI division backed by a roughly $11 million, three-year investment.
Figures as disclosed in public reporting. AI-division figure reflects a planned three-year commitment.
Series A Investors
Leads strategy and enterprise growth; a frequent voice on high-stakes B2B sales into banks and card schemes.
Heads the engineering and platform architecture behind Onlayer's onboarding and monitoring systems.
Oversees security and the company's growing AI and risk-intelligence capabilities.
Kıvanç Harputlu, Emre Aydın and Tunç Yıldırım launch Onlayer with a focus on automating merchant onboarding.
Onlayer joins as an Associate Participating Organization, aligning its platform with PCI-DSS.
The company develops its Merchant Monitoring Service Provider capability for acquiring banks.
Partnerships with central banks and card schemes; offices open in London, Dubai and Saudi Arabia.
Oleka Capital leads a Series A to fund MENA and APAC expansion and a dedicated AI division.
Onlayer is a regtech and merchant-management platform that unifies merchant discovery, onboarding, and continuous risk and compliance monitoring for acquiring banks, PSPs, and fintechs.
It was founded in 2019 in Ankara, Türkiye by Kıvanç Harputlu (CEO), Emre Aydın (CTO), and Tunç Yıldırım (CISO / Chief AI Officer).
Onlayer raised an $8.2M Series A in November 2025 led by Oleka Capital, bringing total disclosed funding to roughly $9.6M.
The platform automates PCI-DSS, AML, Mastercard BRAM, Visa VIRP, and transaction-laundering (TLD) checks across 150+ country-specific frameworks.
Acquiring banks, payment service providers, marketplaces, fintechs, central banks and card schemes - including named clients such as Mastercard, BNP Paribas, Emirates and Wio.