Digital Audit - Worldpay

Domain: Digital - Digital / Technology Entity scope: Worldpay (Worldpay LLC / Worldpay (UK) Limited) - the global merchant payment processor and acquirer; FIS (former parent 2019–2024), GTCR (private-equity majority owner 2024–2026), and Global Payments (acquisition completed 9 January 2026) are flagged as owner/acquirer-chain and attributed accordingly unless a specific act is branded Worldpay technology. Compiled: 2026-06-26 Method: Live web search only

Enterprise Technology Stack & Vendor Relationships

Worldpay operates one of the world’s largest merchant-acquiring and payment-processing platforms, handling roughly $2.2 trillion in transactions annually across approximately 146 countries and 135 currencies.¹

Core fraud and risk platform - FraudSight. Worldpay’s proprietary fraud-prevention product, FraudSight, integrates device and behavioural fingerprinting from ThreatMetrix (LexisNexis Risk Solutions / RELX group; US/UK-domiciled).² No Israel connection identified.

Featurespace - strategic investment and licensing. Worldpay made a strategic investment in Featurespace and licensed its Adaptive Behavioural Analytics ML platform, which powers FraudSight’s risk models. Featurespace is headquartered in Cambridge, England (UK-domiciled); not Israeli-founded or Israeli-domiciled.³

Ravelin - acquisition completed 2025. In February 2025 Worldpay closed the acquisition of Ravelin, an AI-native fraud-prevention platform founded 2015 and headquartered in London, UK.⁴⁵ UK-domiciled; no Israel connection identified.

Mastercard / Capital One / Visa partnerships. Worldpay deployed Mastercard’s Transaction Fraud Monitoring and AML solutions globally,⁶ entered a bilateral transaction-data-sharing agreement with Capital One (October 2024),⁷ and expanded a Visa partnership to enhance its 3DS Flex authentication product (June 2025).⁸ Mastercard, Capital One and Visa are all US-domiciled; no Israeli component identified.

Fireblocks - stablecoin settlement infrastructure (Israel-nexus vendor - Israeli-FOUNDED, US-domiciled). Worldpay selected Fireblocks to power a 24/7 T+0 stablecoin merchant-settlement system, settling in USDC/USDG on the Solana blockchain with coverage across 40+ blockchains; merchants including Banxa and Crypto.com use this Worldpay–Fireblocks rail.⁹ Fireblocks was founded in 2018 by Israeli founders and maintains substantial R&D in Tel Aviv, including an Israeli-registered subsidiary (Fireblocks Ltd, 8 Yitzhak Sadeh, Tel Aviv).¹⁰ However, the Fireblocks group parent (Fireblocks Inc.) is US-domiciled with its operational headquarters in New York - the same Israeli-founded-but-US-domiciled structure as Forter (below). It is therefore flagged as Israeli-founded, US-domiciled (with Tel Aviv R&D) rather than a cleanly Israeli-domiciled vendor; the Worldpay–Fireblocks settlement relationship is nonetheless the most material current Israel-nexus technology tie identified in this audit.

Forter - crypto fraud partnership (Israeli-FOUNDED, US-domiciled). In June 2020 Worldpay partnered with Forter to offer “Fraud Freedom,” chargeback-indemnification for crypto brokers/exchanges.¹¹ Forter’s primary headquarters is New York (575 Fifth Avenue) with an R&D office in Tel Aviv; it is Israeli-founded but US-domiciled.¹² No evidence confirms this partnership remained active after Worldpay’s 2024 spin-out from FIS; treated as unresolved.

MoonPay - crypto card processing (2021). MoonPay selected Worldpay for merchant acquiring across 160+ countries for card-based crypto purchases; MoonPay is US-based (FCA- and Central Bank of Ireland-registered), not Israeli-domiciled.¹³

Vendors checked, no Worldpay relationship found. Simplex (Israeli-domiciled, Givatayim; acquired by Nuvei 2021),¹⁴ Paygilant (Israeli), Riskified (NY-domiciled, Israeli-founded), and BlueSnap (US-domiciled, Israeli-founded) operate in adjacent fraud/payments markets, but no Worldpay integration with any of them was identified.

Worldpay Model Context Protocol (MCP). In November 2025 Worldpay launched an open-source MCP server on GitHub (built on the Anthropic MCP standard) enabling AI agents to drive payment flows via Worldpay’s APIs - an in-house protocol with no third-party Israeli component.¹⁵

Surveillance, Biometrics & Retail Technology

Worldpay’s authentication suite incorporates biometric methods (fingerprint, Face ID) within its 3DS Flex online/mobile authentication flow, analysing geolocation, behavioural history and device signals for passive authentication of low-risk transactions.¹⁶ Biometric capture in 3DS Flex is delivered through the existing ThreatMetrix/LexisNexis device-profiling SDK; no separately contracted surveillance or biometrics vendor - and no Israeli-domiciled one - has been identified. Worldpay is a payment processor; it does not deploy or resell retail surveillance technology (CCTV analytics, in-store biometric identification).

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Worldpay has not publicly named a primary hyperscale cloud provider (AWS, Azure, GCP) in retrieved official documentation; press and investor materials describe data centres across North America, Europe, Asia-Pacific and Latin America without naming the host.¹⁷ Worldpay operates its own IPS Cloud, a validated PCI Point-to-Point Encryption (P2PE) solution - a proprietary product, not a sovereign-cloud arrangement.¹⁸ As a payment institution across the EU, Worldpay is subject to the EU Digital Operational Resilience Act (DORA, in application from 17 January 2025);¹⁹ no specific Worldpay DORA designation was found. Worldpay maintains a public Privacy Center and a Data Processing Addendum (updated June 2025).²⁰ No Israeli sovereign-cloud participation or Israeli data-centre relationship was identified.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of Worldpay holding defence, military, or intelligence-sector technology contracts in Israel, the UK, or the United States. Worldpay’s product portfolio is entirely oriented to commercial merchant payment processing. No partnership with any Israeli defence-technology company (Elbit, Rafael, IAI, or Check Point in a defence capacity) was identified.

AI, Algorithmic & Autonomous Systems

FraudSight is Worldpay’s primary AI deployment - an ML risk-decisioning system combining real-time transaction signals, ThreatMetrix device fingerprinting, Featurespace behavioural analytics, and Worldpay’s global transaction dataset; post-acquisition, Ravelin’s AI-native fraud models are being integrated into the FraudSight suite.⁴ FraudSight is connected in real time to Capital One’s fraud-risk ML engine.⁷ The Worldpay MCP framework (November 2025) positions Worldpay as infrastructure for autonomous AI-driven (“agentic”) commerce.¹⁵ Worldpay also deployed Mastercard’s AI-based fraud monitoring globally.⁶ The Fireblocks-powered stablecoin settlement system uses automated treasury logic to convert merchant fiat receipts into stablecoins at T+0.⁹ No Israeli-domiciled AI vendor supplies core AI infrastructure to Worldpay (the Fireblocks relationship is flagged above as an Israeli-founded, US-domiciled vendor).

Technology Ecosystem & R&D Footprint

Worldpay’s confirmed office network spans Cincinnati OH (HQ), London (international HQ), Atlanta, Denver and Jeffersonville (US); UK, France, Germany, Italy, Netherlands, Romania, Sweden, Spain and UAE (EMEA); Australia, China, Hong Kong, India, Japan, Singapore, Thailand and the Philippines (APAC); and Argentina, Brazil and Mexico (LATAM).²¹

Israel R&D office - no primary-source confirmation (claim discarded). Several secondary aggregator pages asserted a Worldpay engineering centre in Rehovot, Israel. Live investigation found no primary source supporting this: the official Worldpay careers location page does not list Israel, no Worldpay press release or job posting names an Israeli R&D office, and the claim appears traceable to circular secondary/AI-generated sourcing (including prior dossier material). It is assessed as an unverified aggregator artefact - No public evidence identified of a Worldpay R&D office in Israel.²¹

Worldpay operates a public Developer Hub (docs.worldpay.com) and publishes the MCP server on GitHub.¹⁵ Its technology-focused acquisitions (Ravelin - London; strategic investment in Featurespace - Cambridge) are UK-based; no Israeli company has been acquired by the Worldpay brand.⁴³

Civil Society Scrutiny & Regulatory History

FCA authorisation. Worldpay (UK) Limited, Worldpay Limited, and Worldpay AP Ltd are authorised by the Financial Conduct Authority as Authorised Payment Institutions (from 13 October 2015).²² No FCA enforcement action or fine against any Worldpay entity was identified across 2022–2026 FCA registers.

GDPR / ICO and PCI DSS. No ICO enforcement action or GDPR fine against Worldpay was identified; Worldpay maintains a current Data Processing Addendum and Privacy Center.²⁰ Worldpay holds PCI DSS compliance and a validated P2PE solution; no PCI-related sanction was publicly identified.

Civil society and breach history. No significant civil-society campaign targeting Worldpay’s technology practices (privacy, algorithmic bias, surveillance) was identified, and no mention of Worldpay in relation to Israeli military- or settlement-linked technology was retrieved. No major public data breach attributable to Worldpay’s own infrastructure was identified within the audit period (the 2010 RBS WorldPay breach predates the current entity).

End Notes