Onlayer

The product has expanded meaningfully from a single-purpose PCI SAQ checklist tool (its original identity as PCI Checklist) into a broader merchant risk suite covering fraud, AML, and sanctions screening within a few years, showing real roadmap movement.

Onlayer is a small London-based team (est. 11-50 employees) running a SaaS platform with modest venture funding ($9.2M); it has operational reach into payments/e-commerce but lacks the scale or track record of established GRC vendors.

The company’s rebrand from PCI Checklist to Onlayer alongside expanded product scope (MCC monitoring, fraud, AML) signals active growth, though public funding and customer-count disclosures are sparse, limiting visibility into the pace of adoption.

Bundling PCI DSS attestation tracking with merchant fraud and AML/sanctions screening in one workflow is a meaningful convenience play for PSPs and acquirers who otherwise stitch together multiple point tools, though the underlying compliance and scanning techniques are not novel.

Vendor-published figures (e.g., claimed reductions in false positives and server load versus conventional scanning) have not been corroborated by independent testing or named customer case studies found in public sources, so efficacy evidence is limited to self-reported claims.

Highly relevant to a specific niche — payment service providers and e-commerce platforms managing PCI DSS obligations across merchant portfolios — but narrower in applicability than enterprise-wide GRC platforms.