CommerceGate Review

Regional Breakdown

The EU + LATAM combination is the actual product. An operator licensed in Malta running a Spanish or Portuguese-speaking player base benefits from one contract that handles EUR card acquiring in Madrid and PIX deposits in São Paulo. That is the use case CommerceGate is built for. Brazil specifically: PIX carries 30%+ of e-commerce transactions and is projected to hit 40% by end of 2026, with conversion rates around 90% at checkout versus 50% for Boleto and 30% for debit. CommerceGate's PIX flow handles both dynamic QR (one-off transactions) and static QR (repeatable 1-click deposits), and the static-QR option is the one most iGaming operators want because it removes friction on returning depositors. AML checks are tied to the CPF tax ID so the same consumer can't generate fraudulent QR codes across multiple identities. Mexico's SPEI is a real-time bank transfer rail similar to PIX but with different scale (smaller, slower adoption). Colombia's PSE accounts for 80%+ of online bank payments. Operators serving multiple LATAM countries benefit from one settlement in EUR or USD rather than holding local-currency floats in each market, which is the FX trade-off (1-2% markup, see Pricing).

Verticals

iGaming and sports betting, adult entertainment, dating, forex/CFD trading, subscription services (SaaS, content), eCommerce, marketplaces. The legacy book is adult and dating, where the high-risk acquiring expertise was built between 2006 and 2018. iGaming has been a steady vertical the whole time and is now positioned as a growth area, especially around LATAM. Forex/CFD is supported but operator-side regulatory scrutiny has tightened across the EU since 2021. Cannabis and CBD are absent from its vertical list. No Bitcoin or crypto-derivative operators, since CommerceGate doesn't process for any crypto exchange or crypto-first business. Subscription billing (CGBilling) is strong, with dunning logic, retry cascades and churn-recovery flows. If your business is recurring rather than one-off, CommerceGate's billing platform is a real differentiator versus pure card-only PSPs.

• iGaming
• Sports betting
• Forex
• Adult
• Dating
• eCommerce
• Marketplaces
• Subscription services

Deposits are instant on cards, PIX, SPEI, Webpay and wallet methods. PIX averages 3.7 seconds end-to-end per CommerceGate's own metrics. Boleto Bancário is 1-3 days because consumers physically pay at a bank or post office. Player withdrawals run 24-72 hours depending on method and KYC tier, slower than the 24-hour standard at Nuvei or AstroPay. Settlement to merchant accounts is T+3 to T+7. That is noticeably slower than PayRetailers (T+1 to T+3) and AstroPay (T+1 to T+2), and roughly matches Worldpay's T+2 to T+7. Refund processing takes 5-10 business days, which is on the long end. High-volume operators care about settlement speed because every extra day is working capital tied up at the PSP: on $1M monthly volume, the difference between T+1 and T+5 is roughly $130k floated, before the reserve: 5-10% withheld monthly on that volume reaches $150k-600k held once the 90-180 day window fills.

Integration Assessment

REST API with interactive documentation, sandbox, live callback validation and request inspection. A hosted payment page (gw.cgpaytech.com) for merchants who don't want PCI scope. Server-to-server S2S for PCI-certified merchants. Standard integration takes 1-3 weeks. The gaps matter: no native iOS or Android merchant SDK, no public GitHub org, no open-source plugins for WooCommerce/Shopify/Magento beyond what partners maintain. There are no pre-built connectors for SoftSwiss, EveryMatrix or Slotegrator, the three iGaming platforms most LATAM operators actually use. Operators who run on those platforms either build a custom integration or route CommerceGate through Corefy (which publishes a ready-made connector). For platform-bound operators this is a gap. Documentation quality is Good rather than Excellent, closer to PaySafe than to Stripe.

Compliance Context

PCI DSS Level 1 continuously since 2009, one of the longest unbroken streaks among mid-tier high-risk PSPs. 3D Secure 2.x is mandatory on EU card transactions for PSD2 SCA compliance and optional but heavily configured on non-EU. AVS, CVV2, host validation, smart device recognition. Merchant-configurable velocity filters (block by amount, frequency, country, BIN). An in-house fraud and AML team runs rule-based plus ML-style anomaly detection, with no named third-party vendor disclosed, which is unusual in 2026 when Sift, Riskified and Forter partnerships are routine marketing, so the models are likely internal and trained on 19 years of high-risk portfolio data. The claimed portfolio chargeback ratio of 0.7% sits comfortably below the Visa/Mastercard 1% trigger that puts merchants into excessive-chargeback programs. KPMG-audited. 99.999% uptime (provider-stated), with one documented 20-minute downtime in the previous six years on the company's own account.

Regulatory Position

Bank of Spain Payment Institution license number 6896, granted 2020, the first non-banking group in Spain to receive a financial-institution license specifically for cross-border online payments. Passportable across the full EEA (30 countries). Legal entity CommerceGate Payment Solutions S.L. (Spanish company registry B67016634), headquartered at World Trade Center, North building, 4th floor, Moll de Barcelona, 08039 Barcelona. PCI DSS Level 1 certified continuously since 2009, a 17-year compliance streak that very few competitors can match. PSD2-compliant with Strong Customer Authentication and 3D Secure 2.x. GDPR-compliant for EU data handling. KPMG handles the annual audit. In Brazil, CommerceGate operates under local payment-institution partnerships rather than a direct Banco Central do Brasil license, which is the same model Nuvei and Worldpay use to access PIX. It is not an Electronic Money Institution, so it does not issue e-money or hold customer funds in the EMI sense. It is not licensed by MGA, UKGC, FCA or any gambling regulator directly; gambling-operator licensing is the merchant's responsibility, and CommerceGate verifies it during KYB.

Review Analysis

2.8/5 from 3 Trustpilot reviews. Three reviews is not a signal, it is noise. The most-cited negative review describes a merchant application that was rejected without rationale despite full documentation; the positive review cites a professional team and wide solutions. 4.6/5 Glassdoor from 5 anonymous employee reviews tells you the people who left have generally been satisfied, but again the sample is tiny. Traders Union rates CommerceGate 4/5. Capterra and Software Advice list the company but have no published user reviews. No G2 ratings. The structural reason is the same as for any B2B high-risk PSP: end users transact through merchant brands rather than the CommerceGate name, so the consumer-review pool is empty. AstroPay has 9,591 Trustpilot reviews at 4.3/5 because players know the wallet brand. PayRetailers has 20 reviews. Pay4Fun has none. CommerceGate sits at the bottom of that distribution, which is roughly normal for a niche EU+LATAM specialist.

Context for Operators

Trust signals worth weighing here: a 19-year operating history under continuous Bank of Spain prudential supervision, PCI DSS Level 1 unbroken since 2009, a KPMG audit relationship, a named leadership team with verifiable LinkedIn profiles, and a documented public registration (Spanish company registry B67016634). Those carry more weight than a 3-review Trustpilot score in either direction. The one consistent operator complaint, across the Trustpilot review and a Shark Processing third-party review, is the compliance/onboarding experience: heavy documentation requests beyond what Stripe or PayPal ask for, and rejection decisions without explanation. That is a documented pattern rather than a one-off. If you are allergic to that style of underwriting, you will be allergic to CommerceGate too.

Client Evidence

No published client list. CommerceGate states ~1,000 merchants over 19 years across iGaming, adult entertainment, dating, forex and eCommerce. The high-risk adult and dating portfolio is the legacy book, and those operators rarely allow public reference. The LATAM iGaming book is newer and similarly silent. Operators evaluating trust here should weigh the Bank of Spain license, the KPMG audit and the 17-year PCI DSS streak over a non-existent client logo wall. Compared to AstroPay (Premier League sponsorships, named operator partnerships) or Nuvei (named clients across DraftKings, FanDuel, Microsoft), CommerceGate is structurally invisible by design and by client preference.