Why Direct Licensing Is a Fraud & Risk Advantage in Southeast Asia
Across Indonesia, Malaysia, the Philippines, Singapore, Thailand and Vietnam, 82% of scam victims who lost money recovered none of it. Only 10% got all of it back, according to the GSMA ASEAN Consumer Scam Report 2026.
While those figures are usually read as a consumer protection problem, for merchants and their fraud teams, they point to something structural. Whether payments can be stopped, traced or returned depends on who sits between the merchant and the payment rail. Most of that is decided long before a transaction hits the risk engine.
The chain you can't see
Southeast Asia has multiple major markets, regulators and dozens of local payment methods. Only a few providers have actually built their own connections into them. Most regional coverage is bought: a merchant connects to a gateway, the gateway to a PayFac, the PayFac to a local partner, and the partner to the rail.
Each hop adds delay and truncates the data passed through it, creating another point of failure. It also adds a party who can reasonably say a problem belongs to someone else. Fraud networks have noticed. Indonesia's Financial Services Authority (OJK) has warned that scammers increasingly exploit payment systems and merchant channels to get around standard tracking.
Layers also stack risk checks. Each provider in the chain operates under its own rules and risk framework, fine-tuned to its own risk appetite. A transaction that clears the merchant's fraud model can still be declined two hops later by a partner with less context. Managing payment risk means balancing fraud losses against approvals, and that balance is hard to strike when several parties each set their own thresholds.
For a fraud prevention team, the result is a set of questions with no clear owner. Whose risk engine saw the transaction? Who verified the sub-merchant? Who answers for it when something goes wrong?
What a direct license buys: accountability
A direct license makes the provider the regulated entity that answers for a transaction, with obligations to the central bank or financial regulator in that market.
Those obligations are growing. The Philippines' Anti-Financial Account Scamming Act (AFASA) puts the cost of scam losses on institutions that fail to maintain adequate controls. Bangko Sentral ng Pilipinas Circular 1213, which implements the law, sets requirements for fraud management systems, including when disputed funds must be temporarily held. Singapore's Shared Responsibility Framework takes a similar line: when duties are breached, financial institutions sit first in line to absorb phishing scam losses.
When liability lands on the licensed entity, that entity has every reason to invest in controls. When a provider operates on someone else's license, the company carrying the merchant's regulatory risk and the company managing it are different. The merchant may not know which is which.
Xendit holds its own payments licenses in each of the Southeast Asian markets it serves. Merchant funds sit with an entity that reports directly to the local regulator.
What direct membership adds: data, controls, and speed
A license introduces accountability. Direct membership affords access to payment rails. A provider with direct membership sits on the card scheme, real-time rail or national QR network itself, instead of reaching it through another company. Xendit is a principal member of Visa and Mastercard in Thailand, Malaysia and the Philippines, and a direct acquirer of QRIS in Indonesia and DuitNow in Malaysia.
For a fraud team, that position shows up first in the data. Decline reasons arrive in full from the issuer and the network, without being simplified or remapped by intermediaries. Fraud rules and retry logic rest on the actual signal. Issuers also see more complete transaction information and approve more legitimate customers: merchants on Xendit's direct card acquiring in Thailand saw a 3.3% higher authorization rate across all payments.
It also shows up in how money moves. Refunds are a well-known channel for abuse on real-time rails, where a refund can go out as a new transfer with no reference to the original sale. On Xendit, a refund must reference the original payment and can only be returned to the payment method used for that charge.
Holding both a license and direct membership also extends the scope of a local payment method. Where a rail doesn't natively support recurring payments or refunds, a licensed provider sitting on that rail can build the capability itself, keeping in mind the respective regulations and controls that are required by the regulatory body.
Then there is speed. Real-time payments settle in seconds and can't be reclaimed. In Indonesia, OJK has urged scam victims to report within 10 minutes, noting the national average is closer to 12 hours. A provider that is connected directly to the rail can act on fraud signals triggered inside that window. Every intermediary adds another handoff before funds can be held.
Three questions to ask your payments provider
Merchants can test any provider's position with three questions:
- Whose license are my transactions processed under in each market?
- How much of your coverage runs on your own connections, and how much is resold?
- Do I receive raw decline codes from the network, or a summary?
Specific answers point to a provider that owns its risk. Vague ones usually mean the risk sits with a company the merchant has never dealt with.
Where fraud prevention starts
In Southeast Asia, fraud prevention begins with who stands between the merchant and the rail, and whether that party answers to a regulator for what passes through. Build in efficiencies through your own licenses and direct connections, market by market, instead of renting access.
About Xendit
Xendit is the financial technology platform built for businesses that move fast without missing a beat. By delivering a single, unified solution for payment acceptance, payouts, treasury and financial services that fuel growth, Xendit removes the operational complexity that slows companies down, replacing fragmented local integrations with one intelligent infrastructure layer.
Learn more at xendit.co
About the Author
Bryan Cresswell is the Product Director at Xendit, where he leads the development of payment products that help merchants accept local payment methods across Southeast Asia. Before Xendit, he built acquiring and issuing products for some of the world's leading payments companies, working across Europe and the US. He now applies that global experience to infrastructure built on Xendit's own licenses and direct network connections across the region.
Connect with Bryan on LinkedIn
