TODA Pay Review

Regional Breakdown

The Romania focus is the most concrete regional play TODA Pay has made. RON card acquiring, cash voucher integration and ONJN-aware gambling positioning suggest real merchant relationships in the Romanian iGaming market, and CEE more broadly (Poland, Czech Republic, Hungary, Bulgaria) is reachable through the same APMs. TODA Pay claims MENA and GCC without naming a single partner or country, so without local acquiring relationships in Saudi Arabia, UAE, Egypt and similar markets, the MENA pitch is more aspirational than operational. Africa is similarly thin: TODA Pay promises 'exclusive access to advanced payment solutions across Africa' and names no partner behind it, no Flutterwave, no Cellulant, no MFS Africa. For real African coverage Flutterwave, Cellulant or PayTabs are the actual specialists. CIS coverage through KZT settlement is real, and Kazakhstan is one of the few non-EU CIS markets TODA Pay can demonstrably handle.

Verticals

Explicit positioning for high-risk verticals: iGaming (casino, sports betting, lottery), forex and CFD brokerage, crypto exchanges, plus eCommerce, subscriptions, marketplaces and money services (adult entertainment is not named but the high-risk framing makes it implicit). The PayAtlas listing names 30+ verticals across crypto exchanges, gambling/betting, e-learning, SaaS, hotels, travel, insurance, money services, skill gaming, forex trading and more, a broad list consistent with a horizontal high-risk PSP rather than a vertical specialist. iGaming is real but undifferentiated: there are no named casino references, no SoftSwiss/EveryMatrix/Slotegrator connectors, no published iGaming-specific case studies and no dedicated gambling sales motion visible. For a forex broker or crypto exchange the positioning is cleaner, since the Card Payout product and USDT/USDC settlement are structurally good fits for non-casino high-risk verticals.

• iGaming
• sports betting
• forex
• crypto exchanges
• high-risk eCommerce
• subscriptions
• marketplaces
• money services

Card deposits clear instantly at the gateway level: the player completes 3DS2 if required, the issuer authorizes, and the merchant gets a webhook within seconds. Card payouts to a beneficiary card via Visa Direct or Mastercard Send claim real-time settlement (typically under 30 minutes, often under 5 minutes depending on issuer cooperation). IBAN payouts via SEPA settle same-day or T+1 within the SEPA zone, while SWIFT payouts to USD or other non-SEPA currencies take 1-2 business days. Open Banking deposits in the UK, Germany, Sweden and Austria settle instantly into the merchant's bank account, bypassing the multi-day card clearing window. The settlement-to-merchant side is where TODA Pay diverges from standard PSPs: fiat settlement runs through SEPA or SWIFT on a schedule the commercial team negotiates per merchant, while the stablecoin alternative is a T+2 to T+5 USDT or USDC payout to the merchant's wallet. TODA Pay contradicts itself on the window: T+2 to T+5 in its Romania material against weekly T+7 on the product side, and it is the only source for either figure, so pin the cadence down in writing. Even the faster of the two sits slightly behind the T+1 to T+3 cycle most card-acquiring PSPs run on direct card rails, so a high-volume merchant should expect a few days of float in TODA Pay's account before stablecoin reaches their wallet, less painful than the older weekly-batch crypto-settlement cadence but still not best-in-class. Refund processing is not separately documented but on cards typically follows the standard 5-10 business day issuer window. Mass payouts are advertised as instant on cards and batched on IBAN, with no published per-day or per-month cap. Recurring billing is supported through the Corefy connector's recurring-transaction endpoint.

Integration Assessment

REST API host-to-host integration is the documented surface. The cleanest integration path is via the Corefy orchestration platform connector at corefy.com/integrations/payment-providers/todapay, which exposes auth, capture, sale, void, full refund, partial refund and recurring transactions, plus webhook callbacks for status updates. Direct integration without Corefy in the middle is possible, since the merchant gets API credentials from the TODA Pay commercial team, but it is not self-serve and there is no public developer portal at docs.todapay.com or a similar URL. There is no GitHub organization, no published Node.js / Python / PHP / Go / Java SDKs, no e-commerce plugins for WooCommerce, Magento, PrestaShop or Shopify, and no native iOS or Android mobile SDK. TODA Pay advertises 'streamlined APIs, SDKs and no-code integration options', none of which exist publicly. For an operator on a custom backend the integration is workable through Corefy, while for a platform-native operator on SoftSwiss or EveryMatrix there is no connector and you would have to build it. The estimated timeline is 1-3 weeks for a custom backend with developer attention, longer if the merchant is also routing through Corefy for the first time.

Compliance Context

PCI DSS is claimed (with no public attestation level published, where Level 1 PCI DSS service-provider status would normally be advertised explicitly and TODA Pay does not). 3D Secure 2 is supported on card flows. Smart routing acts as a fraud-mitigation layer by segmenting first-time deposit traffic from trusted users and directing each transaction through the channel most likely to approve it. TODA Pay references an AI-driven risk engine without naming the underlying vendor (Featurespace, Hawk:AI, Sift and ComplyAdvantage are the common stacks for high-risk PSPs, and it names none of them). Tokenization is claimed for storing card data, with the standard pitch of keeping the merchant out of PCI scope, and GDPR compliance is referenced. The licensing posture is the weak link: the FINTRAC MSB registration (M20438511) is a registration with no consumer-protection regime or capital requirement, and the Polish EMI claim is not independently confirmed by the KNF register or by third-party rating services. There is no SOC 2 Type II, no ISO 27001, no public penetration testing partner and no published bug bounty program. For comparison, Adyen publishes its PCI DSS Level 1 attestation, ISO 27001 certificate and SOC 2 Type II report, and TODA Pay publishes none of these as of May 2026.

Regulatory Position

FINTRAC Money Services Business registration M20438511 attached to SMART PAYMENTS TECHNOLOGIES LTD (BC1266435), the entity TODA Pay names in its terms and corporate pages at 170-6660 Graybar Road, Richmond, BC. It references PCI DSS compliance without a public attestation level, and GDPR compliance. TODA Pay previously claimed a Polish EMI license and dropped the claim by mid-2026; no independent verification was ever published, the Polish KNF EMI register does not surface SMART PAYMENTS TECHNOLOGIES LTD or any TODA Pay-branded entity, and the independent rating agency PayRate42 was unable to confirm the Polish EMI authorization. There is no MGA, UKGC, MGCB or other gambling-specific license, no MiCA CASP license for the stablecoin-settlement leg, no SOC 2 Type II report, no ISO 27001 certificate and no published penetration testing partner. KYB onboarding is sales-led with manual document review, and no KYC vendor is publicly named for end-user verification (Sumsub, Veriff, Onfido and Jumio are common partners for the category, and TODA Pay names none).

Client Evidence

TODA Pay names no reference customers at all. It sells to high-risk verticals (iGaming, sports betting, forex, crypto exchanges, eCommerce) across emerging-market geographies (Romania, Turkey, GCC, Africa, MENA, CEE) without naming a single operator. PayAtlas confirms zero published case studies, and PayRate42 notes the absence of disclosed reference customers as part of its transparency assessment. For an operator running diligence, the absence of any named client (combined with the absence of public reviews on Trustpilot, G2, Capterra and Glassdoor) means there is no third-party signal to rely on, so direct reference checks during the sales process are the only path to validation.