# Who can license settlement records: a tree | SourceX

Canonical: https://refer.sourcex.si/questions/who-can-license-merchant-settlement-reconciliation-records
Last updated: 2026-10-19

For merchant settlement reconciliation records, start with the payments operations director or the controller, who know which processors, batches and adjustment approvals exist, then find the officer who can approve a licensing discussion: the CEO, with the CFO preparing the case and general counsel advising. The company's own ledger and workpapers are its records. Processor-generated reports may sit under the processor agreement, and cardholder data never enters the discussion at all.

This decision tree is part of the [merchant settlement reconciliation guide](/guides/workflow-merchant-settlement-reconciliation). It is written for payments integration advisors who already know a business with years of reconciliation history and need to reach the person who can say yes. It is general information, not legal advice.

## Knowing the batches is not the same as owning them

The payments operations director can tell you which payment providers the company used, when each daily batch closes, how long the old portal stays open and whether the adjustment log names an approver. The controller can tell you whether workpapers were kept by period and who signed each exception. Both are the right first conversations. Neither, on their own, usually decides whether company records are discussed with an outside party.

The same gap applies to technical access. A payments engineer holding API credentials can export settled transactions, payouts and fee lines in bulk. That is access to a system, not authority over the records in it. The [why data rights matter](/proof/why-data-rights-matter) page sets out why SourceX treats these as separate questions.

## The tree, branch by branch

Ask these four questions in order. Each one either names who decides or adds a reviewer.

1. **Who created the record?**
   - The company: ledger journals, reconciliation workpapers, the adjustment log with approvers, internal notes on why each gap was closed. These are company records. Go to question 2.
   - The payment provider: settlement reports, deposit reports and fee statements downloaded from its portal. These mix the provider's own identifiers with the company's order references, and the provider agreement may limit reuse even though the company can download them. Flag these for counsel and go to question 2 for the rest.
2. **Does any record carry cardholder data?**
   - Yes: those fields are out of scope. The PCI Security Standards Council defines cardholder data as, at minimum, the full primary account number, plus name, expiration date or service code when they appear with it. No licensing discussion includes it, and no partner should see it.
   - No, or only masked references: go to question 3.
3. **Are there financing liens, a sale process or litigation?**
   - Yes: counsel and possibly lenders or the board must be consulted. Some short-term funders file liens on business assets; the page on [how financing liens can restrict a data license](/questions/merchant-cash-advance-ucc-lien-restrictions) explains when that matters.
   - No: go to question 4.
4. **Will the CEO take a short call?**
   - Yes: introduce the CEO, with the payments operations director or controller as sponsor.
   - Not yet: do not submit. Ask the controller to raise it with the CEO.

## Roles at a glance

| Person | What they know | Can authorize licensing? |
|---|---|---|
| Payments operations director | Providers, daily cutoffs, portal access dates | Rarely alone; strong sponsor |
| Payments engineer or portal admin | Which reports and API objects exist | No; informs only |
| Controller | Workpapers, adjustment log, who approved each fix | No; helps prepare the case |
| CFO | Finance records and the processor relationship | Prepares the case; the CEO approves |
| General counsel | Processor agreement, liens, privacy duties | Advises; may gate |
| CEO | Authority to commit company records | Yes; authorizes and signs |
| Board or PE sponsor | Material contract approvals | Only where governance requires it |

If raising the subject with a client feels awkward, [whether referring clients hurts the relationship](/questions/does-referring-clients-hurt-relationship) covers how partners usually frame it.

## Signs you are talking to the wrong person

Partners often stall because the conversation stays with someone who cannot move it forward. Watch for these signals:

- They offer to "just send a sample" to show what exists. Anyone willing to share records before the CEO has agreed is acting beyond their authority, however good the intention.
- They describe the records fluently but cannot say who signed the last vendor contract.
- They promise to "run it past finance" without naming who in finance.
- Every answer starts with what the system can export rather than what the company decided.

None of these makes the person unhelpful. It makes them a sponsor, and the next move is to ask, politely and directly, who would need to approve a conversation about licensing company records.

## Three places a second signature appears

**The payment provider agreement.** Processors set terms for their reports and portal content. Whether a downloaded settlement report is the company's to license, shared, or restricted is a contract question. Counsel answers it; the advisor only notes that the reports exist and for which years.

**People in the records.** Refund notes, dispute comments and customer references can identify individuals even after card numbers are gone. Under the EU General Data Protection Regulation, personal data is any information relating to an identified or identifiable natural person, and similar laws apply elsewhere. The [data controller versus data processor comparison](/compare/data-controller-vs-data-processor) explains why the company's role matters here.

**Group structures.** A business that settles through a parent company's merchant account, or reconciles for sister brands, may hold records that belong to another entity. The CFO identifies which legal entity owns which ledger.

## What stays open until SourceX's rights review

The tree tells a partner whom to introduce. It does not decide:

- which record classes the company has the right to license, and whether provider-generated reports are among them
- which periods are excluded because of liens, disputes or a sale process
- how customer references and refund notes are de-identified
- whether buyers want settlement exception histories, and on what terms

An introduced company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English. Partners sign the Channel Partner Agreement before submitting introductions, and the first valid introduction within the 90-day window is credited when the company submits a verified application. The [system map](/guides/merchant-settlement-reconciliation-records-across-systems) shows where each record lives, and the [referral brief template](/resources/merchant-settlement-reconciliation-referral-brief-template) has a field for the officer this tree identifies.

## Next step

> **Refer a company. Earn up to $100,000.** Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.

Once the tree points to a CEO willing to discuss the company's settlement records, [register as a partner](/register), check the company against [who qualifies](/who-qualifies) and read the [program terms](/terms) before you make the introduction.

## Sources

- https://refer.sourcex.si/terms
- https://www.pcisecuritystandards.org/glossary/
- https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng