PayFac, ISO and Merchant of Record: Who Carries the Risk in Acquiring

Four Roles the Market Calls by One Name

When a product team says "we built payments," the phrase covers several legally distinct constructions, and the difference is not the integration — it is whose balance sheet absorbs someone else's refund and whose name sits on the licence. The scheme rulebooks say so literally. The public edition of the Visa Core Rules and Visa Product and Service Rules dated 18 April 2026 runs to 923 pages; in it the term Payment Facilitator appears 217 times, Marketplace 138, Ramp Provider 94, Third Party Agent 139. Independent Sales Organization appears exactly once, in the list of entities an acquirer must add to the Visa Merchant Screening Service on termination for cause. Merchant of record appears zero times.

That is not a vocabulary quibble. A role with its own chapter in the rules is a role with defined liability, a registration, an assessment schedule and a scheme right to disqualify it. A role absent from the rules lives in tax law, contract law and money transmission statutes — where its consequences are no softer, merely addressed to a different regulator. What follows is the map: who contracts with whom, who funds a chargeback, who needs a licence, and what the schemes rewrote between 2024 and 2026.

Who Contracts With Whom, and Who Answers to Whom

The contractual chain in a card payment does not match the money chain. The cardholder contracts with the issuer, the merchant with the acquirer, and issuer and acquirer each with the scheme — with each other only through it. Nothing links merchant to issuer except the Visa and Mastercard rules, which is why a dispute is resolved by scheme procedure rather than in court, and why funds are debited from the acquirer without its consent.

Intermediary roles slot in between merchant and acquirer and differ on two axes: whether settlement passes through them, and whether they inherit the merchant's liability. A payment facilitator inherits both. Under section 5.3.1.2 of the Visa Rules a sponsored merchant is treated as a merchant of the PayFac's acquirer; the acts and omissions of the sponsored merchant are treated as those of the PayFac, and those of the PayFac as those of the acquirer. Liability is not shared but transmitted upward in full, including related legal costs and settlement obligations for funds disbursement and P2P programmes. An ISO inherits neither: it sells acquiring and takes a commission while the merchant contracts directly with the bank.

The most interesting row is "licence needed": it is the only one whose answer is set not by the schemes but by the law of a specific jurisdiction — and it is where most product plans break. We return to it below; the map of regimes sits in financial licences by jurisdiction.

PayFac: the Master MID, the One-Million Threshold and Duties You Cannot Delegate

Visa defines a payment facilitator as an entity that contracts with an acquirer to deposit transactions, receive settlement from, or contract with an acquirer on behalf of a sponsored merchant. Economically it is a single master merchant account carrying thousands of sellers, each with its own identifier in the authorisation message and none of its own in the clearing record.

The threshold at which the model breaks has not moved for 2026. Under section 5.3.1.4 the acquirer must enter a direct merchant agreement with any sponsored merchant exceeding USD 1 million in annual transaction volume: before processing any transactions for a merchant new to the PayFac, and within two years of the breach for an existing one. The PayFac may keep providing payment services, settlement included — nothing breaks operationally, only the counterparty to the agreement changes. Mastercard raised its own threshold from USD 100,000 to USD 1 million back in an October 2014 acquirer bulletin, dropping at the same time the requirement to settle large sub-merchants directly.

More consequential than the threshold are the two carve-outs Visa attached to it, which few read. No direct agreement is required where the PayFac has held the relationship with that seller for at least two years with the same acquirer, reports regularly on volume, disputes and fraud activity, and the acquirer continues to oversee the pair. The second carve-out is a closed MCC list: utilities (4900), financial institutions (6012), non-financial institutions including cryptocurrency (6051), real estate rentals (6513), healthcare (8011, 8050, 8062, 8099), education (8211–8299), tax payments (9311), court costs, fines and bail (9211, 9222, 9223). Both switch off if the acquirer, the PayFac or the merchant has been identified in a Visa risk programme or had excessive violations in the preceding three years.

The PayFac's duties are drafted as the acquirer's duties, and that framing matters. Under section 5.3.1.1 the agreement must contain express statements: the PayFac is financially liable for each transaction processed on behalf of a sponsored merchant, may not shift that liability by asking cardholders to waive dispute rights, may not deposit transactions for another PayFac, and must ensure its sellers comply with PCI DSS and the PCI Software Security Framework. Section 5.3.1.3 adds the operational layer: registration with an attestation of due diligence must be confirmed by Visa before the first transaction, settlement proceeds go to an account in the acquirer's jurisdiction, and the acquirer must report monthly transaction and dispute counts per sponsored merchant on request. For high-integrity risk, section 10.4.5.2 requires daily monitoring of each merchant from the 31st calendar day after its first deposit, weekly recalibration of the normal-activity profile, and delivery of the original underwriting package within seven calendar days of a Visa request.

Scheme registration fees are modest: Visa's published third party agent registration FAQ puts PayFac registration and annual renewal at USD 5,000 each (actual rates are set by regional fee guides and change); Mastercard, per announced changes, raised its initial bundle fee to USD 5,200 and the discovery fee for an unregistered PayFac to USD 15,600 on top of registration. The expensive parts are elsewhere: service-provider-level PCI validation, the underwriting and monitoring stack, reserves and time. Market estimates for a full in-house PayFac build in 2026 cluster around 12–18 months and seven figures in year one. Hence most platforms take managed PayFac and keep only brand and onboarding; what stays rented in that arrangement is set out in licence for rent.

What the Schemes Rewrote in 2024–2026: Wallets, Ramp Providers and the Ban on Stacking

The ISO has all but vanished from the rulebook — not because the model died, but because there is nothing to regulate: an intermediary with no money and no risk remains a Third Party Agent registration category, and that is all. The opposite happened to roles that hold other people's money. In two years Visa gave separate chapters to Marketplace (5.3.4), Digital Wallet Operator split into stored value and staged (5.3.3) and Ramp Provider with its conversion affiliates (5.3.5, April 2024 and April 2025 editions), and added Agentic neobank and Agentic Payment Enabler — AI payment agents — to the glossary in the October 2025 edition. The duty to answer a Visa Integrity Risk Program information request within seven business days now extends to them under section 1.9.2.2.

The through-line of these edits is a ban on stacking. A PayFac may not contract with another PayFac, a staged wallet operator or a ramp provider (5.3.1.5). A digital wallet operator may not contract with a PayFac, another DWO or a ramp provider (5.3.3.2). A ramp provider may not deposit transactions for another ramp provider, a PayFac or a staged wallet (5.3.5.1). The schemes are closing structures where two or more intermediaries sit between acquirer and real seller: liability blurs there, and monitoring loses sight of who ultimately owns the flow.

The second theme is concentration. To be classified by Visa as a Marketplace, a platform must not only display its brand more prominently than its sellers' and receive settlement on their behalf, but also be financially liable for disputes — with a mandatory resolution mechanism: a decision binding on both cardholder and retailer, or a money-back guarantee funded by the marketplace itself (5.3.4.1). And no retailer located outside the marketplace's jurisdiction may exceed both USD 10 million in annual Visa volume through the platform and 10% of the platform's annual Visa volume. A marketplace connected through a PayFac must additionally keep at least 75% of its sellers in its own country (5.3.1.5). Franchisees without the franchisor's express permission, travel agents, high-integrity risk merchants, and charitable and crowdfunding merchants cannot be marketplaces at all.

The third is new assessment schedules. For failure to meet marketplace requirements, section 12.3.2.1 lays out a ladder from USD 25,000 to USD 250,000 escalating every 30 days and rising thereafter at Visa's discretion. For failure to register a high-integrity risk PayFac, USD 25,000 per month each, and after three violations in a calendar year USD 100,000 for each 30-day period (12.3.1.1). For an acquirer's own failure to register as high-integrity risk, USD 100,000 per month for Tier 1 and Tier 2 merchants, USD 25,000 for Tier 3, plus USD 2,000 per identified merchant per month (12.5.5.1). For altering merchant names or data to circumvent monitoring, USD 25,000 per merchant per month and permanent disqualification of the merchant and its principals (12.5.3.2). From 9 April 2026 the Asia-Pacific region gained the Merchant Elevated Risk Program, with USD 25,000 on first identification and USD 50,000 on repeat (12.5.8.1) — the newest programme in the book.

Merchant of Record: Absent From the Rulebook, Present in the Tax Code

Merchant of record is not a card construct but a commercial and tax one: the entity that legally sells the good or service to the end buyer, books the revenue, issues the invoice, handles returns and owes the sales tax. Zero mentions in the Visa Rules follows directly from that: the scheme does not ask who the MoR is, it applies its own test. Under section 5.3.2.2 an entity is classified as a Merchant or Sponsored Merchant if it simultaneously sells the goods or services to the cardholder, uses its name primarily to identify the merchant outlet to the cardholder, and provides recourse to the cardholder in a dispute. Fail the test and you become a Digital Wallet Operator, Marketplace, Payment Facilitator or Ramp Provider — and Visa reserves the right to decide which. The supplementary criteria in the same section — the name on the transaction receipt, ownership of the goods, booking the sale as revenue, customer service and returns — track the accounting principal-versus-agent test almost word for word.

The practical consequence is often learned late: becoming merchant of record means becoming the seller for tax purposes in every buyer jurisdiction. In the EU an intermediating platform may already be a deemed supplier under Article 14a of the VAT Directive, the electronic-interface regime in force since 1 July 2021. The VAT in the Digital Age package was adopted on 11 March 2025 and extends the same logic to the platform economy: from 1 July 2028 short-term accommodation rental and road passenger transport platforms must account for VAT where the underlying supplier does not; single VAT registration switches on at the same point, with final alignment deferred to 1 January 2035.

In the US the same logic arrived earlier and harder. Marketplace facilitator laws now operate in all fifty states and the District of Columbia: Washington imposed the duty first, from 1 January 2018, and the rest followed the Wayfair decision. The typical trigger is USD 100,000 in sales or 200 transactions a year, USD 500,000 in California and New York, USD 10,000 in Pennsylvania and Oklahoma. The platform collects and remits sales tax for its sellers whether or not it considers itself the MoR.

The second consequence of MoR status is monetary, and it runs counter to intuition. If a platform receives the buyer's money and passes it to a third party — a seller, a driver, a creator — it is moving someone else's funds, and the licensing question in the US is answered state by state. If instead the MoR sells in its own name and pays its supplier under an ordinary commercial contract, no third-party funds move: there is revenue and there is cost of sales. The distinction looks like bookkeeping, but it is exactly what separates a money transmitter from a trading company. The regime sits in money transmitter licenses in the US; the federal registration that does not replace a state licence is in FinCEN MSB.

Where the Licence Starts: Commercial Agent in the EU and UK, Agent of the Payee in the US

The European construction rests on the commercial agent exclusion in Article 3(b) of PSD2. It takes payment transactions outside the directive where the platform is authorised by agreement to negotiate or conclude the sale or purchase of goods or services and acts on behalf of only one side — the payer or the payee. The EBA put it plainly in its Single Rulebook Q&A 2020_5355: a B2C platform may rely on the exclusion only if it acts exclusively for the seller and does not simultaneously represent the buyer; PSD2 supplies no criteria, so the national competent authority must assess each model.

The FCA translated the same test into an observable fact pattern. On its commercial agent exclusion page the regulator states that a firm is likely acting for both sides where payments are transferred into an account it controls or manages before being sent to the payee, and the payer's debt is discharged only once the payee has received payment. That is a description of standard marketplace escrow with a hold until delivery is confirmed — and the FCA's conclusion is unambiguous: authorisation or registration is needed. The workaround is the payment agent model under a licensed principal, set out in payment agents and passporting.

Alongside sits a second exclusion: the limited network exclusion for a closed set of merchants or a narrow range of goods. It operates under the EBA guidelines EBA/GL/2022/02, applicable since 1 June 2022, and it is not free: once the total value of payment transactions over the preceding twelve months exceeds EUR 1 million, the issuer must notify its competent authority under Article 37(2) of PSD2. For gift cards, fuel programmes and in-app wallets this is a workable construction; for general acceptance it is not.

PSD3 and the PSR narrow both. The Council published the final compromise texts on 23 April 2026, ECON endorsed them on 5 May, and the indicative plenary vote is 14 December 2026; per Arthur Cox the PSR applies 21 months after entry into force, with the verification-of-payee articles and the end of the transition window for existing institutions at 27 months. The compromise expressly tightens the commercial agent exclusion so platforms and intermediaries cannot sidestep PSP status, and constrains the specific-purpose instrument exclusion so large consumer-facing services cannot shelter behind it. The full calendar and capital floors are in PSD3 and PSR.

The US has neither a commercial agent concept nor a single regulator. What it has is agent-of-the-payee: where the platform is the payee's agent under a written agreement, holds itself out publicly as such, and receipt by the platform is treated as receipt by the seller, no third-party funds are transmitted. Per Troutman's 2026 outlook the exemption is recognised in 39 states and the agent-of-the-bank exemption in 35; the wording differs, so the opinion has to be written state by state. Harmonisation is slow: per the CSBS legislative update of June 2026 roughly thirty states have enacted the Money Transmission Modernization Act in whole or substantial part, with 2026 bills moving in Alaska, Delaware and Michigan, and Louisiana, Maryland and Oklahoma taking effect on 1 July, 1 October and 1 November 2026 respectively. The federal layer has thinned: a Congressional Review Act resolution repealed the CFPB's larger-participant rule for digital wallets and payment apps, and the Bureau is not prioritising supervision or enforcement in that segment. The perimeter has not disappeared; it moved to the states and to the schemes, as mapped in regulatory perimeter trends.

Risk and Capital: Reserves, Monitoring and PCI DSS

Credit risk in acquiring is not the risk that a merchant fails to pay; it is the risk that a merchant disappears between the sale and the refund. A paid-for but undelivered service — an airline ticket, a membership, a prepaid course — becomes a chargeback weeks or months later, after the money has already been paid out. Whoever sits closest to the vanished party pays: the PayFac funds the gap for its sponsored merchant, the acquirer for the PayFac, and the scheme debits the acquirer. Which is why Visa's section 1.9.1.10 requires an acquirer, on request and within five business days, to disclose its underwriting process, current exposure, collateral taken, the exact collateral volumes held against dispute exposure — particularly for future-service merchants — and its process for withholding funds from any entity it believes cannot meet its obligations. For high-integrity risk, section 1.9.5.1 additionally puts the acquirer through a financial review, requires the prescribed equity capital, investment-grade standing or agreed compensating controls (collateral is named expressly), and where required an on-site Visa Acceptance Risk Standards review. The market norm for a platform rolling reserve is 5–10% of volume, higher and longer in high-risk verticals.

Monitoring thresholds shifted through 2025–2026. Visa merged its separate dispute and fraud programmes into a single Visa Acquirer Monitoring Program: per the VAMP fact sheet the ratio is fraud (TC40) plus disputes (TC15) over settled transactions, card-not-present. For acquirers, above standard starts at 50 basis points and excessive at 70, with a floor of 1,500 events a month. For merchants, excessive was 220 basis points and dropped to 150 on 1 April 2026; enforcement of the acquirer above-standard tier began on 1 January 2026 per the Merchant Risk Council, and enrolled merchants pay USD 8 per fraudulent or disputed transaction. Mastercard kept its existing frame: an excessive chargeback merchant runs 100 to 299 chargebacks at a 1.50–2.99% ratio, high excessive from 300 at 3.00% and above, on a schedule rising from USD 1,000 in month two to USD 100,000 (ECM) and USD 200,000 (HECM) from month nineteen, plus an issuer recovery assessment of USD 5 per chargeback above 300, as documented by Braintree. BRAM lives in the Security Rules and Procedures — Merchant Edition of 3 February 2026, section 8.8: acquirers must respond to Mastercard investigations into merchant risk factors, with the assessment schedule in the same chapter.

PCI DSS allocates along the chain differently from risk. A PayFac validates as a service provider: Level 1 above 300,000 transactions a year with a QSA report, Level 2 below that with an SAQ D self-assessment — though, as the Electronic Transactions Association notes, inclusion in the Visa Global Registry of Service Providers requires a QSA report regardless of level. Merchant levels run from 6 million Visa transactions a year for Level 1 down to 20,000 e-commerce transactions for Level 3. A sub-merchant remains a merchant with its own SAQ — from SAQ A on a fully hosted payment page to SAQ D where card data crosses an API — but it is the PayFac that must ensure compliance: an express requirement of Visa Rules section 5.3.1.1, and a breach at the seller creates liability for both the PayFac and the acquirer. The current standard is v4.0.1; of the 64 new requirements introduced in v4.0, 51 were future-dated and became mandatory on 31 March 2025. Version 5.0 is under discussion — goals stated, no date — and is too early for a 2027 budget line. How this fits the rest of an operator's controls is in the compliance stack.

Economics: Interchange, Scheme Fees and What 2026 Changed

The cost of accepting a card has three layers: interchange, paid by acquirer to issuer; scheme fees, paid by both sides to Visa and Mastercard; and the acquirer's markup. In the EU and UK the first layer is capped by Regulation (EU) 2015/751 at 0.2% on consumer debit and 0.3% on consumer credit. In the US the cap covers only large-issuer debit: Regulation II allows USD 0.21 plus 0.05% of value plus a cent for fraud prevention, and issuers below USD 10 billion in assets are exempt. That cap's legal standing is unsettled: in Corner Post the District of North Dakota vacated the Regulation II fee standard on 6 August 2025 while staying its own vacatur pending appeal; the Fed took it to the Eighth Circuit and filed its reply brief in April 2026, so the cap still stands.

On the credit side the defining event of the year is that the long-running swipe-fee litigation has closed. On 9 June 2026 Judge Brian Cogan in the Eastern District of New York approved the settlement, calling it fair, reasonable and adequate in contrast with the version he rejected in 2024: a 10 basis point rate reduction for five years, a 1.25% cap on standard consumer credit cards for eight years, the right to decline certain premium and commercial credit cards, and expanded surcharging and steering rights, covering roughly 12 million merchants. For a platform this changes more than cost of goods: the ability to refuse expensive cards and steer to cheap ones becomes a real lever rather than a theoretical one.

A PayFac's sub-merchant rate is almost always blended — one percentage plus a fixed fee — and the gap between that and interchange++ on a direct merchant account is the PayFac's margin, which funds underwriting, monitoring, disputes and reserve. The economics work on small tickets and large seller counts; approaching the USD 1 million threshold a seller starts doing the arithmetic and moves to a direct agreement, which is what the rules require anyway.

Alternative rails are growing in parallel. In the UK the first wave of commercial variable recurring payments went live on 2 June 2026 under the UK Payments Initiative — the first new UK payment scheme since Faster Payments in 2008 — with a fixed pence-per-transaction fee instead of a percentage, covering utilities, regulated financial services, e-money institutions, government and charities; on 20 January 2026 the FCA and PSR said they would not prioritise a Competition Act investigation into the centralised pricing model. The stablecoin rail has left pilot stage: Visa launched USDC settlement in the US on 16 December 2025 with Cross River Bank and Lead Bank on Solana, at a USD 3.5 billion annualised run rate as of 30 November 2025, then added five blockchains on 29 April 2026 — Arc, Base, Canton, Polygon and Tempo — taking the network count to nine, the run rate to USD 7 billion, and stablecoin-linked card programmes past 130 across more than 50 countries. For a platform this is a settlement layer between acquirer and scheme, not a way around a licence: the issuance framework is in stablecoins.

The Fork: Marketplace, SaaS Vertical, Infrastructure Platform

The choice is driven not by size but by what you do with other people's money and whose name the buyer sees.

A marketplace that pays sellers. Buyer money passes through you to a third party — that is a payment service by default. In the EU and UK there are three honest routes: your own PI licence, agent status under a licensed principal, or an architecture where funds are never under your control for a moment and the commercial agent exclusion is supported by an opinion written against the EBA and FCA tests. In the US it is agent-of-the-payee state by state, or an MTL. Under the Visa Rules you additionally sit the 5.3.4.1 test: brand more prominent than sellers', financial liability for disputes, a resolution mechanism, and the foreign-seller concentration cap. Multi-currency seller payouts are usually handled through specialised accounts such as Payoneer or Airwallex.

A SaaS vertical embedding acceptance. Here the MoR is the customer-merchant; the platform merely gives it card acceptance. The fast route is managed PayFac: someone else's master MID, registration and risk, your brand and onboarding. Building your own PayFac makes sense when payments revenue rivals subscription revenue and the flow is homogeneous — then 12–18 months and a seven-figure budget are repaid by margin. The middle option is the ISO model: resell the bank's acquiring, take a revenue share, carry no transaction risk.

An infrastructure platform: wallet, on-ramp, agentic payments. Here the schemes have already made the choice for you: staged wallet, ramp provider and agentic neobank are separate registration categories with their own duties and an express ban on sitting under one another. Building such a product under someone else's PayFac is not permitted; you need your own acquirer agreement plus a parallel licensing track — CASP under MiCA for an on-ramp, EMI or PI for a wallet, MTL for the US. The banking layer is in banking for a licensed operator, sponsor dependency in BaaS.