ADR-0003: Never hold funds — licensed PSP with a sub-merchant model
Every money flow goes through a licensed PSP in the merchant's name; platform revenue from payments comes from the PSP partner programme, never from custody.
ADR-0003: Never hold funds — licensed PSP with a sub-merchant model
- Date: 2026-09-18
- Status: Withdrawn — the merchant payment surface it governs was removed with the vertical (see ADR-0010). The record is kept for history.
- Deciders: the owner, Claude (seed)
- Tags:
compliancerevenue
Context
Offering payments or BNPL directly requires a SAMA licence. Tabby and Tamara are licensed and have their own merchant terms. The product wants a share of payments without becoming a payment service provider.
Decision
Every money flow passes through a licensed PSP in the merchant's name (sub-merchant). The platform creates the sub-account, enables the methods (mada, Apple Pay, Tabby, Tamara), and only receives webhooks.
- Platform revenue from payments comes through the PSP partner programme (revenue share), not by collecting and then transferring.
- There is no platform balance table in the database.
Consequences
- Positive — no SAMA licence required for the platform, direct settlement to the merchant, higher trust.
- Negative — the share depends on the PSP contract; the range of methods depends on what the partner supports.
- Revenue impact (SAR / month, confidence) — R2 ≈ 45,000 at 1,000 merchants (low confidence until the contract is signed).
Rejected alternatives
- Becoming a payment facilitator: licensing, capital, and compliance beyond the reach of this phase.
- Direct Tabby / Tamara integration only: leaves mada and Apple Pay without a unified solution.
References
Withdrawn 2026-09-20. This record describes a surface that is no longer part of the product: the merchant payment surface it governs was removed with the vertical. ADR-0010 records the decision.
ADR-0002: Cloudflare-first runtime with Postgres over Hyperdrive
Superseded by ADR-0008 — the original seed decision to run every service on Cloudflare Workers with Postgres behind Hyperdrive.
ADR-0004: Custom domains via Cloudflare for SaaS, dashboard on the core domain
Tenant storefronts are served on custom hostnames through Cloudflare for SaaS by the planned storefront app; the dashboard stays isolated on app.example.com.