Inyo Gateway
API-first payment orchestration for domestic and international money movement — pull and push, with adaptive risk routing, KYC, anti-fraud, and tokenization built into the same surface.
Inyo Gateway is the orchestration layer for the full Inyo money-movement stack — designed to flex to whatever shape your flow needs. Pull funds from a card, ACH, or AFT. Push funds to a card, bank, or mobile wallet. Do both, with the same API. Or just run KYC on a customer without moving money at all. The Gateway composes the primitives; you decide which ones you need.
When transactions do route, they route smart: direct card-network connections, many acquirer partners, and real-time decisioning that scores each transaction against trust signals, corridor performance, and cost. KYC, 3D Secure 2, Account Name Inquiry, tokenization, and anti-fraud are part of the same surface — not separate vendor integrations bolted on after the fact.
How it works
Adaptive routing, decided per transaction
Every transaction is scored against trust signals in real time. Known, low-risk customers authorize directly. Unknown or higher-risk customers get enhanced due diligence inserted into the flow — agentic KYC, Account Name Inquiry, 3DS2 — only where it earns its keep.
Inyo Orchestrator
Real-time risk evaluation & routing
Trust signals · corridor · BIN · velocity · history
Path A
Trusted customer
Frictionless path
-
1
Trust signal recognized
Known BIN, prior good history, low corridor risk, established device.
-
2
Direct authorization
Routed to the best-performing acquirer with no challenge inserted.
-
3
Approved
Maximum conversion. Customer doesn’t see a step they don’t need to see.
Path B
Unknown / higher-risk
Enhanced due diligence path
-
1
Risk signal detected
New customer, unusual corridor, velocity anomaly, BIN-level concern.
-
2
KYC + Account Name Inquiry
Agentic KYC in parallel: document, biometric, sanctions, payment-instrument. ANI confirms the cardholder name with the issuer.
-
3
3D Secure 2
Frictionless 3DS where possible, challenge only when the signal warrants it — with liability shift.
-
4
Authorized & approved
Routed with the right indicators applied. The customer is verified; you keep the revenue you would have lost.
Outcome
Maximum approvals, minimum losses
Compose the flow you need
The orchestrator is built around modular primitives. Use just the ones your product needs:
- Pull only: accept cards (purchases or AFTs), ACH debits, or wire receipts. Settle to your account; no payout step required.
- Push only: dispatch OCTs, ACH credits, local bank rails in 170+ countries, or mobile money. Funds you already hold, sent to a recipient.
- Pull + push (end to end): the full chain — collect from a sender, run FX, deliver to a recipient through whichever rail is best for the corridor. One transaction identifier across both legs.
- KYC only: run identity verification on a customer without moving money. Useful for onboarding, re-verification, or pre-flight checks before a downstream flow.
Same API surface across every shape. You don’t buy a different product for each one.
Direct connection to Visa/Mastercard, and many acquirers
Inyo holds direct connections to Visa and Mastercard for card processing, alongside relationships with many acquirers and processors — including Worldpay. This isn’t a reseller chain: fewer intermediaries between your transaction and the network, more control over interchange categorization, and the ability to fail over across acquirers without re-vaulting tokens.
Verification built into the transaction lifecycle
Most stacks treat verification and fraud scoring as third-party plug-ins. Inyo Gateway integrates them into the transaction lifecycle, callable individually or layered automatically when the trust signal warrants it:
- 3D Secure 2: frictionless authentication with full data enrichment, challenge only when risk warrants it. Liability shift on transactions that need it — without burning conversion on the ones that don’t. Deeper view in the 3DS2 guide.
- Account Name Inquiry: verify the cardholder name on file with the issuer before the transaction runs. Confirms you’re paying (or pulling from) who you think you are — a sharp tool against first-party fraud and incorrect recipient lookups.
- Agentic KYC via Inyo360: document, biometric, identity, watchlist, payment-instrument, and behavioral agents in parallel. Run inline with onboarding, AFTs, or high-risk OCTs.
- ML-driven risk scoring: every transaction scored in real time with structured, auditable findings — not a black box. Explicit rules override the model where you need deterministic behavior.
All four feed the same decisioning surface, so risk signals from one inform the others. KYC, 3DS, and ANI happen before a transaction is dispatched — not after the fact.
One integration, one reconciliation surface
Every authorization, settlement, return, and fee carries a consistent transaction identifier from the first call through final reconciliation. Webhooks fire on every state change. Settlement files break down fees at the line level. See the payment reconciliation guide for how Inyo handles matching at volume.
Tokenization
Two ways to tokenize — pick what fits your stack
Inyo Gateway supports two tokenization models out of the box: a private vault tokenizer for full coverage and operational simplicity, and network tokens for the higher approval rates and lifecycle survival that only the card networks can deliver. Use one, the other, or both side-by-side — the API contract is the same.
Option 1
Private vault tokenizer
Inyo’s PCI DSS Level 1 vault captures and stores card data on your behalf. Inyo-issued tokens replace PANs in your systems — broad coverage, predictable behavior, no dependence on issuer-side support.
- •Universal coverage: works for every card you accept, regardless of issuer.
- •PCI scope reduction: PAN never touches your systems.
- •Same API surface: store, retrieve, charge, refund — all token-based.
- •Path to network tokens: vault tokens can be upgraded in place as issuer support expands.
Option 2
Network tokens (VTS & MDES)
Tokens issued by Visa Token Service and Mastercard MDES — the card networks themselves. Recognized by issuers as first-party, with lifecycle managed at the network level.
- •Higher approval rates: 2–8% lift on tokenized transactions vs. raw PAN (typical range in production).
- •Survives re-issue: network updates the token underneath when a card is reissued, expired, or replaced.
- •Acquirer-portable: the same token works across acquirers during cascade failover — no re-vaulting.
- •Issuer-dependent: coverage depends on issuer support. Inyo automatically falls back to the vault tokenizer when network tokens aren’t available.
Either way: PCI scope reduced. With both options, raw card data never touches your systems. Inyo’s PCI DSS Level 1 environment captures the PAN, mints the token, and returns only the token — your scope shrinks from full SAQ-D to SAQ-A or SAQ-A-EP territory depending on your integration model.
For the full technical view of how vault tokens differ from network tokens and when to use each, see the payment tokenization guide.
Frequently Asked Questions
What is Inyo Gateway?
Inyo Gateway is an API-first payment orchestration platform that composes the money-movement primitives your product actually needs — pull transactions, push transactions, KYC, 3D Secure 2, Account Name Inquiry, tokenization, and risk decisioning — on a single surface. It connects directly to Visa and Mastercard and to many acquirer partners.
Can I use just pull, just push, or just KYC?
Yes. The orchestrator is modular by design. Run pull-only (collect funds with no payout step), push-only (dispatch funds you already hold), pull + push end to end (a complete remittance corridor), or KYC-only (run identity verification on a customer without moving money). The same API supports every shape.
How is Inyo connected to Visa and Mastercard?
Inyo holds direct connections to Visa and Mastercard rather than acting as a reseller. This gives more control over interchange categorization, authorization logic, and the ability to fail over across acquirers without re-vaulting tokens. Worldpay and other partner acquirers extend that reach further.
How are KYC and anti-fraud integrated?
They are part of the same Gateway surface, not bolted-on third-party integrations. Identity verification (via Inyo360) and ML-driven fraud scoring run inline with the transaction, so risk decisions happen before a payment is dispatched.
Can Inyo Gateway send payouts outside the United States?
Yes. Inyo Gateway dispatches payouts to 170+ countries via local bank rails, push-to-card (OCTs through Visa Direct and Mastercard Send), and mobile money networks, selecting the rail per-recipient by performance and cost.
How does the trust-based routing actually work?
Every transaction is scored in real time against trust signals — BIN reputation, prior history with this cardholder, corridor risk, velocity, device, and the customer's relationship to your platform. Known and low-risk customers get authorized directly with no additional friction. Unknown or higher-risk customers get enhanced due diligence inserted into the flow: agentic KYC via Inyo360, 3DS2 challenge, sanctions screening. The same API surface delivers both paths.
What kind of tokenization does Inyo support?
Two options: a private vault tokenizer (Inyo’s PCI Level 1 vault, universal coverage across every card you accept) and network tokens via Visa Token Service (VTS) and Mastercard MDES (issuer-recognized as first-party, with higher approval rates and lifecycle managed at the network level). You can use one, the other, or both side-by-side. Network tokens are used wherever the issuer supports them; the vault tokenizer is the fallback and the path for cards outside network-token coverage.
How does tokenization reduce my PCI scope?
Card PAN never touches your systems. Inyo's PCI DSS Level 1 environment captures the card, mints the network token, and returns only the token to your platform. Your own PCI scope shrinks from full SAQ-D to SAQ-A or SAQ-A-EP territory, depending on your integration model.
Does Inyo support 3D Secure 2?
Yes. 3DS2 is built into the Gateway with full data enrichment to maximize frictionless authentication, and challenges are invoked selectively based on the transaction's risk signal. Liability shift applies on challenges that complete successfully.
What is Account Name Inquiry, and when should I use it?
Account Name Inquiry (ANI) verifies the cardholder name on file with the issuer before a transaction runs. Use it to confirm that the payment is going to (or pulling from) the person you expect — a strong tool against first-party fraud, account-takeover scams, and incorrect recipient lookups, especially in money-movement flows where the wrong recipient is hard to recover from.
One gateway. Pull and push. Anywhere.
Talk to the Inyo team about consolidating your gateway, KYC, and anti-fraud behind a single integration.
Talk to Sales