Divibank
Sub-acquirer from scratch
Building a sub-credenciadora from 0 to 1, from merchant (EC) registration and SLC compliance to PCI certification, with 13x growth in GMV transacted in one year.
Before
We were only acting as a PSP, and it was clear we needed to grow our revenue in the payments journey. Depending on third-party sub-acquirers limited our earnings, speed of innovation and visibility over the billing funnel.
Action
As GPM, I structured the creation of a sub-acquirer from scratch: product and operations design, the PCI DSS certification track, compliance processes with acquirers, plus the technical and regulatory connection for receivables registration and centralized settlement via SLC.
Impact
In one year, GMV transacted grew 13x, running on our internally controlled infrastructure, with more margin per transaction, resilience and data as a decision asset.
What I learned
- Building a sub-acquirer is 30% technology and 70% risk: PCI, compliance, registrars (registradoras), SLC and SPB define the design before any feature.
- Growing 13x with strategic product decisions requires planning, tough decisions and a lot of resilience to start reaping the rewards.
- Where you settle (SLC) and how you protect data (PCI) are NOT product decisions; they are the tip of the regulatory iceberg.
A sub-acquirer is not born from features
It is born from tracks: registration and licensing, SPB connectivity, PCI DSS certification and a compliance operation that responds in real time. That foundation design is what allowed the product to scale.
PCI and compliance as the foundation
There was no way to launch billing and grow 13x without treating security as a product. The PCI DSS track entered the design from the start: environment segmentation, tokenization and minimal storage of sensitive data, audit trails and access controls. Compliance stopped being a final phase and became a product sprint.
The connection to SPB
Pix and settlement require understanding our Brazilian Payment System, SPB. We structured connectivity with banks and acquirers, reconciliation flows and operation monitoring; that is where the sub-acquirer truly starts to exist, outside a third-party umbrella.
From 0 to results in one year
What was a wish became an operation: 13x growth in GMV transacted, own billing products and own distribution channels, and a team that sees the journey end to end. Differentiation became control: infrastructure, risk and data at the same table.