GMPays vs. CorePay: High-Risk Payments, Two Different Bets

Every merchant that gets flagged as “high-risk” eventually asks the same question: do I want a provider that is the licensed institution, or one that’s built a network of institutions willing to underwrite me? That question sits at the center of a quieter divide in high-risk payment processing, and GMPays and CorePay sit on opposite sides of it.

Both companies serve the same broad category of business: merchants that standard acquirers decline outright, subscription platforms, gaming operators, nutraceuticals, digital goods, and other verticals with elevated chargeback exposure. But the way each company positions itself to actually move that money is structurally different. GMPays operates under its own electronic money institution (EMI) license, issued by the Czech National Bank. CorePay, based in Winter Park, Florida, operates as a payment facilitator that places merchants with acquiring banks and processors across the US, UK, EU, and Australia, underwriting each account individually rather than holding a banking license of its own.

Neither model is inherently better. Direct licensing and the sponsor-network model are both established, legitimate ways to serve merchants that mainstream processors won’t touch. But they carry different risk profiles, different points of accountability, and different implications for a merchant trying to build a stable merchant account relationship. This piece looks at what each company actually is, how their underwriting philosophies diverge, and what that divergence means for merchants deciding where to send their payment processing relationship.

What GMPays Actually Is

GMPays operates under the legal entity Mercurius Partners s.r.o., which holds a license from the Czech National Bank as a small-scale electronic money issuer. That license is publicly verifiable and puts GMPays in a category of European payment providers that can issue e-money and process transactions without routing every account through a third-party sponsor bank. The company’s terms of service designate the Czech National Bank as the supervisory authority merchants can escalate disputes to, a detail worth noting, since it means GMPays’ regulatory accountability is concrete and named, not abstract.

GMPays markets itself as a payment gateway for online payments, with particular traction among gaming and digital-goods platforms; its own AML policy states the company “constantly and proactively updates and strengthens compliance policies and procedures,” including in areas it describes as “not currently being subjected to regulation”, language that signals GMPays operates in some genuinely emerging, lightly regulated corners of the industry, even as it holds a formal EMI license for its core operations.

On the customer-experience side, the public record is more mixed. Independent website-reputation scans generally find no malware, phishing, or blacklist flags associated with GMPays’ domains. At the same time, a meaningful cluster of user reviews on third-party platforms describe recurring friction: withdrawal delays, repeated identity-verification requests, and complaints about transaction fees. It’s important to be precise about what these reviews do and don’t establish, they are user-submitted, unverified complaints, not findings from a regulator or an audit, and they’re concentrated among end-users of a specific merchant (a gaming platform) rather than GMPays’ merchant clients broadly. They shouldn’t be read as evidence of licensing or legal problems. But they are a real, recurring signal about operational friction that merchants evaluating GMPays should weigh alongside the licensing picture.

What CorePay Actually Is

CorePay is a US-based payment processing company headquartered in Winter Park, Florida, with a second office in London. Rather than holding its own banking or e-money license, CorePay positions itself as a specialty underwriter that places merchants with acquiring banks and processors across four regions, the United States, the European Union, the United Kingdom, and Australia, each with region-specific compliance built in: PSD2 and Strong Customer Authentication in the EU, FCA-regulated processing in the UK, and APRA-aligned processing in Australia.

CorePay’s core pitch to merchants is individualized underwriting: rather than auto-declining based on an industry code, the company reviews chargeback history, refund policy, business model, and compliance documentation before approval, and says it structures rolling reserves to release on a predictable schedule rather than holding funds indefinitely. It works across a wide band of specialty verticals, nutraceuticals, iGaming, telemedicine and online pharmacy, subscription and membership billing, hemp and CBD, and med spas, framing itself explicitly as a merchant services partner for businesses “other processors decline.”

Public reviews for CorePay, concentrated on Google, skew strongly positive, with merchants citing responsive support and dedicated account managers. As with GMPays’ reviews, this should be read for what it is: a self-selected sample of public reviews rather than an independent audit of the company’s underwriting or reserve practices. CorePay itself does not claim to hold a banking or e-money license; its regulatory footing runs through the acquiring banks and processors it partners with in each region, which is a standard structure for payment providers operating as facilitators or independent sales organizations (ISOs) rather than as licensed institutions.

The Core Argument: Two Underwriting Philosophies, Not Two Levels of Trust

1. Licensed institution vs. sponsor-bank network

The most concrete difference between GMPays and CorePay isn’t reputation, it’s structure. GMPays’ EMI license means it is, itself, the regulated entity a merchant contracts with, and the Czech National Bank is a named recourse point if something goes wrong. CorePay’s model routes a merchant’s funds through partner acquiring banks in each jurisdiction, which means CorePay’s own regulatory status is that of a facilitator, while the actual money movement sits with regulated banks it has agreements with. For a merchant, this changes who you’re ultimately relying on: with GMPays, it’s one licensed entity; with CorePay, it’s CorePay’s underwriting plus whichever bank sits behind your specific account and region.

Neither structure is unusual in cross-border payments. Direct e-money licensing is common among European fintechs; the facilitator/ISO model is the dominant structure for US-based high-risk processors, including some of the largest and most established names in the space. The distinction matters less for legitimacy and more for what merchants should ask about: GMPays merchants can point to a named regulator; CorePay merchants should ask which sponsor bank sits behind their specific account and region, since that relationship, not CorePay’s marketing language,  ultimately governs fund availability.

2. Compliance-first underwriting vs. individualized risk review

CorePay’s public materials lean heavily on a “we underwrite every account before approval” pitch, full documentation review, three to six months of processing history, licensing documentation, and a compliant website before an account goes live. That’s a compliance-forward posture aimed at avoiding the “approve fast, terminate faster” pattern that aggregators are known for. GMPays’ own AML documentation strikes a similar compliance tone but is paired with a more expansive appetite for crypto payments-adjacent and gaming-adjacent traffic, categories where, by GMPays’ own admission, regulatory frameworks are still catching up.

The fair characterization isn’t “GMPays is loosely regulated and CorePay is compliance-first.” GMPays holds a real license and describes an active AML program; CorePay is not itself a licensed institution but layers documentation-heavy underwriting on top of its bank partnerships. The more accurate frame is that GMPays accepts direct regulatory accountability in exchange for operating closer to the edge of what’s currently regulated, while CorePay accepts a more diffuse, partner-dependent accountability structure in exchange for underwriting discipline applied merchant-by-merchant. Both are legitimate trade-offs; they’re just different trade-offs.

3. Geography as a proxy for risk appetite

GMPays’ regulatory home, the Czech Republic, is one of several EU jurisdictions, alongside Cyprus, Lithuania, and Malta, that have become popular bases for smaller e-money institutions, in part because EMI licensing thresholds there are more attainable for early-stage or niche fintechs than in larger EU markets. That’s not a red flag by itself; it’s a well-documented pattern in European fintech licensing. CorePay’s footprint runs the opposite direction: a US home base with region-specific bank partnerships layered on in the UK, EU, and Australia, mirroring the standard expansion path of US payment gateways and processors that scale into new markets through local acquiring relationships rather than a single pan-regional license.

4. What “high-risk friendly” means in practice

Both companies use “we approve what others decline” as a core pitch, but they’re not chasing identical merchant profiles. GMPays’ public materials and reviews cluster around gaming and digital-goods platforms with high transaction volume and international customer bases. CorePay’s stated vertical list skews toward US-regulated or quasi-regulated categories, telehealth, online pharmacy, nutraceuticals, med spas, businesses that are “high-risk” mainly because of chargeback history and card-network sensitivity, not because they sit near unregulated territory. That’s a meaningful distinction for merchants: “high-risk” in payments isn’t one category, and the provider best suited to a CBD subscription brand in the US is not necessarily the one best suited to a global gaming platform.

The Counterpoint

The steelman case against this whole framing is that structure matters less than merchants think. A merchant doesn’t experience “EMI license” or “sponsor-bank network” directly, they experience approval speed, fee transparency, and whether their funds show up when expected. By that measure, the public review evidence is arguably more informative than the licensing structure: CorePay’s public reviews skew positive on responsiveness and account management, while a subset of GMPays’ reviews point to withdrawal friction and verification burden. A merchant could reasonably conclude that operational track record should outweigh structural pedigree, since a well-run sponsor-bank facilitator can outperform a licensed institution with clunky operations, and vice versa.

That’s a fair point, and it’s worth taking seriously, but it doesn’t fully resolve the question, because structure determines what happens when things go wrong, not just how smoothly they run day to day. A merchant with a licensed EMI has a named regulator to escalate to if a dispute over frozen funds turns into a real conflict. A merchant in a sponsor-bank network is dependent on CorePay’s relationship with that specific bank remaining intact, a risk that’s invisible in ordinary operations but becomes very visible if a sponsor bank exits the vertical, which has happened industry-wide as banks periodically reassess appetite for high-risk categories. Reviews tell you about last quarter. Structure tells you about the tail risk.

Comparison Table

Takeaway for Merchants

If you’re choosing between a provider like GMPays and one like CorePay, the licensing structure question isn’t academic, it’s the first thing to clarify in due diligence, not an afterthought. Ask any high-risk provider directly: are you the licensed entity, or are you placing me with a partner bank? If it’s the latter, ask which bank, in which jurisdiction, and what happens to your account if that relationship changes. Pair that structural answer with recent, verifiable references from merchants in your specific vertical, not just star ratings, but a conversation about how the provider actually behaves when a chargeback spike or a reserve dispute happens. Neither “directly licensed” nor “sponsor-network” is automatically the safer choice; the safer choice is the one whose accountability structure you actually understand before you sign.

Open question for the industry: as sponsor banks grow more selective about which high-risk verticals they’ll support, does the facilitator model that companies like CorePay rely on become a long-term liability, or does direct EMI licensing, the GMPays path, become the more durable structure for high-risk payment providers over the next five years? We’d genuinely like to hear from merchants and industry watchers who’ve navigated both.

CorePayGMPayshigh-risk merchantshigh-risk paymentPayment GatewayPayment Processingpayment providers