How to Accept Online Payments in Uzbekistan: Click, Payme, Uzum and Cards

What acquiring is and why Uzbekistan is different

Accepting online payments on a website or app is a relationship between three roles: your business (the merchant), the payment system or acquiring bank that moves the money, and the customer with their card or wallet. Technically you need to send the payment system an amount and an order ID, let the user pay, and reliably receive confirmation that the money actually arrived.

In Uzbekistan this scheme has several important specifics. First, most cards belong to the national UZCARD and HUMO systems rather than Visa/Mastercard. Second, the market is split between several large players — Click, Payme and Uzum — each with its own wallet, audience and protocol. Third, to accept payments you almost always need a registered business entity: a legal entity or a self-employed individual with a settlement account, because the acquiring contract is signed against company details.

Which payment systems to connect

In practice you must offer customers the methods they already use, otherwise a share of payments drops off at checkout. A minimal set for the Uzbek market looks like this:

• Click — the largest system by reach, with the Click wallet and card payment via their form.
• Payme — a popular wallet and acquirer, part of the Uzum ecosystem.
• Uzum — payment via Uzum Pay plus installments/BNPL, which matters especially for goods and larger baskets.
• UZCARD and HUMO cards — direct card payment without installing a wallet.

International Visa and Mastercard cards are connected separately through an acquiring bank for local businesses and are mainly needed by those serving a foreign audience. For most domestic projects, Click + Payme + Uzum + national cards is enough.

Integration methods

Connecting to each system can be done in three ways that differ in effort. The choice directly affects development time and who is responsible for security.

• Hosted payment form (redirect/checkout). You redirect the customer to the provider's page or open their widget. The fastest path: card data is entered on the payment system's side, you never see or store it.
• Merchant API. The provider calls your server with callbacks and verifies the order. It gives full control over flow, statuses and reconciliation, but requires careful server-side implementation.
• Aggregator. Services like Multicard, Octobank or Paynet give you one integration for several systems at once. It saves wiring time but adds an intermediary to the settlement.

How callbacks and webhooks work technically

The core engineering part is server-side processing. Each system has its own protocol, and understanding these differences saves weeks of debugging.

Payme uses a Merchant API based on JSON-RPC: the provider calls methods on your server such as CheckPerformTransaction, CreateTransaction, PerformTransaction, CancelTransaction and CheckTransaction. You must validate the order, record the transaction and return the correct status. Authorization is done with the merchant key in the header.

Click works on a two-step Prepare/Complete scheme: first the system asks whether you are ready to accept the payment, then it confirms it. Each request is signed with a hash built from the parameters and your secret key — you must recompute and verify the signature on your side.

Keep in mind that "the user clicked pay" and "the money actually arrived" are two different events. Grant access to a product, service or subscription only after a confirmed server callback, not on the customer's redirect back to your site.

Fees and the contract

The acquiring fee is the percentage the payment system withholds from each transaction. Exact rates in Uzbekistan are individual: they depend on turnover, industry, payment method (wallet is cheaper, card is pricier) and the terms of the specific contract, so don't rely on someone else's numbers — request a rate from the provider for your own profile.

For a business, the real cost is not just the percentage but also the speed of money: a settlement delay is a cash-flow gap that, for many, matters more than an extra tenth of a percent in fees.

Security and fiscalization

If you use the provider's hosted form, the card is entered on their side — you don't need PCI DSS certification because you neither store nor transmit card data. This is the main argument for the redirect approach for most projects. If you want to accept the card directly on your own pages, data-protection requirements rise sharply.

Basic hygiene applies in any case: HTTPS on all payment endpoints, secret keys only on the server (never in frontend or mobile app code), callback signature verification, idempotency, and logging of all transactions for dispute resolution.

What to choose in the end