TODA Pay Review

Regional Breakdown

The Romania focus is the most concrete regional play TODA Pay has made. RON card acquiring, cash voucher integration and ONJN-aware gambling positioning suggest real merchant relationships in the Romanian iGaming market, and CEE more broadly (Poland, Czech Republic, Hungary, Bulgaria) is reachable through the same APMs. TODA Pay names no partner in MENA or the GCC, and without local acquiring relationships in Saudi Arabia, UAE, Egypt and similar markets, its MENA coverage is more aspirational than operational. Africa is similarly thin: TODA Pay promises 'exclusive access to advanced payment solutions across Africa' and names no partner behind it, no Flutterwave, no Cellulant, no MFS Africa. For real African coverage Flutterwave, Cellulant or PayTabs are the actual specialists. CIS coverage through KZT settlement is real, and Kazakhstan is one of the few non-EU CIS markets TODA Pay can demonstrably handle.

Verticals

Explicit positioning for high-risk verticals: iGaming (casino, sports betting, lottery), forex and CFD brokerage, crypto exchanges, plus eCommerce, subscriptions, marketplaces and money services (adult entertainment is not named but the high-risk framing makes it implicit). TODA Pay is a horizontal high-risk PSP rather than a vertical specialist. iGaming is real but undifferentiated, with no named casino references, no SoftSwiss/EveryMatrix/Slotegrator connectors, no published iGaming-specific case studies and no dedicated gambling sales motion visible. For a forex broker or crypto exchange the positioning is cleaner, since the Card Payout product and USDT/USDC settlement are good fits for non-casino high-risk verticals.

• iGaming
• sports betting
• forex
• crypto exchanges
• high-risk eCommerce
• subscriptions
• marketplaces
• money services

Card deposits clear instantly at the gateway level: the player completes 3DS2 if required, the issuer authorizes, and the merchant gets a webhook within seconds. Card payouts to a beneficiary card via Visa Direct or Mastercard Send claim real-time settlement (typically under 30 minutes, often under 5 minutes depending on issuer cooperation). IBAN payouts via SEPA settle same-day or T+1 within the SEPA zone, while SWIFT payouts to USD or other non-SEPA currencies take 1-2 business days. Open Banking deposits in the UK, Germany, Sweden and Austria settle instantly into the merchant's bank account, bypassing the multi-day card clearing window. The settlement-to-merchant side is where TODA Pay diverges from standard PSPs: fiat settlement runs through SEPA or SWIFT on a schedule the commercial team negotiates per merchant, while the stablecoin alternative is a T+2 to T+5 USDT or USDC payout to the merchant's wallet. TODA Pay contradicts itself on the window: T+2 to T+5 in its Romania material against weekly T+7 on the product side, and it is the only source for either figure, so pin the cadence down in writing. Even the faster of the two sits slightly behind the T+1 to T+3 cycle most card-acquiring PSPs run on direct card rails, so a high-volume merchant should expect a few days of float in TODA Pay's account before stablecoin reaches their wallet, less painful than the older weekly-batch crypto-settlement cadence but still not best-in-class. Refund processing is not separately documented but on cards typically follows the standard 5-10 business day issuer window. Mass payouts are advertised as instant on cards and batched on IBAN, with no published per-day or per-month cap. Recurring billing is supported through the Corefy connector's recurring-transaction endpoint.

Integration Assessment

REST API host-to-host integration is the documented surface. The cleanest integration path is via the Corefy orchestration platform connector at corefy.com/integrations/payment-providers/todapay, which exposes auth, capture, sale, void, full refund, partial refund and recurring transactions, plus webhook callbacks for status updates. Direct integration without Corefy in the middle is possible, since the merchant gets API credentials from the TODA Pay commercial team, but it is not self-serve and there is no public developer portal at docs.todapay.com or a similar URL. There is no GitHub organization, no published Node.js / Python / PHP / Go / Java SDKs, no e-commerce plugins for WooCommerce, Magento, PrestaShop or Shopify, and no native iOS or Android mobile SDK. Nor does TODA Pay offer a public no-code integration option, and any SDK it has stays private. For an operator on a custom backend the integration is workable through Corefy, while for a platform-native operator on SoftSwiss or EveryMatrix there is no connector and you would have to build it. The estimated timeline is 1-3 weeks for a custom backend with developer attention, longer if the merchant is also routing through Corefy for the first time.

Compliance Context

TODA Pay is PCI DSS compliant but publishes no attestation level, where a Level 1 PCI DSS service provider would normally advertise that status explicitly. 3D Secure 2 is supported on card flows. Smart routing acts as a fraud-mitigation layer by segmenting first-time deposit traffic from trusted users and directing each transaction through the channel most likely to approve it. TODA Pay references an AI-driven risk engine without naming the underlying vendor (Featurespace, Hawk:AI, Sift and ComplyAdvantage are the common stacks for high-risk PSPs, and it names none of them). TODA Pay tokenizes stored card data to keep the merchant out of PCI scope, and GDPR compliance is referenced. The licensing posture is the weak link: the FINTRAC MSB registration (M20438511) is a registration with no consumer-protection regime or capital requirement, and TODA Pay holds no Polish e-money authorization. There is no SOC 2 Type II, no ISO 27001, no public penetration testing partner and no published bug bounty program. For comparison, Adyen publishes its PCI DSS Level 1 attestation, ISO 27001 certificate and SOC 2 Type II report, and TODA Pay publishes none of these as of May 2026.

Regulatory Position

FINTRAC Money Services Business registration M20438511 attached to SMART PAYMENTS TECHNOLOGIES LTD (BC1266435), the entity TODA Pay names in its terms and corporate pages at 170-6660 Graybar Road, Richmond, BC. It references PCI DSS compliance without a public attestation level, and GDPR compliance. TODA Pay holds no Polish EMI license. Neither SMART PAYMENTS TECHNOLOGIES LTD nor any TODA Pay-branded entity is registered with the KNF as an e-money institution. There is no MGA, UKGC, MGCB or other gambling-specific license, no MiCA CASP license for the stablecoin-settlement leg, no SOC 2 Type II report, no ISO 27001 certificate and no published penetration testing partner. KYB onboarding is sales-led with manual document review, and no KYC vendor is publicly named for end-user verification (Sumsub, Veriff, Onfido and Jumio are common partners for the category, and TODA Pay names none).

Review Analysis

The public review record is thin rather than absent. Trustpilot carries 3.7/5 from 4 reviews, a quarter of them five-star and none at one star, on a profile claimed in July 2024 with every review posted between 22 April and June 25, 2026. For a payment processor that has been operating since 2022, almost four years of merchant relationships, a single nine-week burst of four reviews is thin, because most high-risk PSPs accumulate some review volume even if it is mixed, with operators complaining about reserves, chargebacks and freezes while others leave positive notes about flexibility on high-risk MCCs. The near-silence around TODA Pay does not necessarily mean the product is bad, since it may reflect a tightly held B2B-only customer base, a recently launched commercial motion or merchant reluctance to publicly identify their high-risk processor, but it does mean any due diligence has to rely on direct reference checks and document verification rather than public sentiment.

Context for Operators

TODA Pay carries four specific diligence concerns. First, it is FINTRAC MSB-registered but not regulated, so no standardized consumer-protection protocol applies. Second, no information is disclosed on ultimate beneficial owners, directors or key team members. Third, two other high-risk payment processors, SignaPay.ca and DomusPay.io, are registered at TODA Pay's Richmond, BC address, suggesting a corporate-services address rather than an operational headquarters. Fourth, TODA Pay holds no Polish EMI license. None of these concerns is automatically disqualifying, since many legitimate high-risk PSPs run lean corporate structures, use registered agent services and hold MSB-only Canadian registrations as a starting regulatory perimeter. Stacked together, the four concerns reach the threshold where independent verification (KNF register lookup, BC corporate registry search, direct UBO request, named reference customer) is mandatory before any merchant relationship.

Client Evidence

TODA Pay names no reference customers at all. It sells to high-risk verticals (iGaming, sports betting, forex, crypto exchanges, eCommerce) across emerging-market geographies (Romania, Turkey, GCC, Africa, MENA, CEE) without naming a single operator. For an operator running diligence, the absence of any named client, combined with four Trustpilot reviews, leaves almost no third-party signal to rely on, so direct reference checks during the sales process are the only path to validation.