Protecting Yourself Against Unregistered Merchant Account Providers

In this guide you will find

Shopping for a merchant account provider is a complicated process made more complex by the range of providers and options and the chance of fraud. The vast majority of merchant account providers are legitimate businesses, even when operating as Independent Service Operators (ISOs) (Visa’s standard) or Member Service Provider (MSP) (MasterCard’s standard).

At the same time, any industry focused around processing funds is rife with fraud and potential crime, and it is crucial to be aware of the issues and potential grey areas surrounding legality so that you can ensure your merchant account service is legal, registered, and able to provide you with the quality services you need for your business.

EMV merchants (Eurocard, MasterCard, Visa) each use registration or compliance standards to attempt to verify the quality and legality of their resellers and acquirers.

What is Registration or Compliance?

MasterCard and Visa each offer slightly different requirements for member banks and organisations, namely that the organisation must comply with security standards, follow the law in all operating countries, and protect the interest of the merchant and customer as much as possible.

What is an ISO/MSP?

A third-party provider acting on behalf of merchant banks to acquire merchants. These organisations include companies like Paymentsense, Handepay, and Payzone in the UK, and are required by MasterCard and Visa to offer full disclosure to merchants. ISO/MSP organisations must be sponsored by an acquiring bank which operates as a member of Visa and/or MasterCard in order to be registered. Some ISO/MSP operate with multiple sponsors, which they typically list as sponsors and others attempt to operate with none, making them unregistered.

In most cases, ISO/MSP organisations are required to display the name of their sponsoring bank along with their details on the contract and billing. This typically looks like:

“X Merchant Services LLC is a registered ISO/MSP of X bank, street, city, county, country.”

This tells you that the ISO is sponsored by said bank, and that they qualify for registration with Visa/MasterCard. But, sponsorship only implies registration, it doesn’t guarantee it. The Merchant Data Manual provided by Visa lists Visa’s standards, which state that the ISO’s name must appear in conjunction with the sponsor name on receipts, billing statements, and the registration case. It is not necessary to share this information on a website or other marketing material, although it is frequently done in countries outside of the UK.

Payment Facilitator

A Payment Facilitator, sometimes called a sales agent, contracts with an ISO or MSP to resell their services, typically as a fourth party. A Payment Facilitator is not required to offer disclosure and is not required to register directly with the Visa or MasterCard Association or pay fees. However, Payment Facilitators cannot sell products under their own name or brand but must use the ISO and/or MSP. This is the only way to differentiate a Sales Agent from an unregistered ISO/MSP.

Visa/MasterCard Registration

In most cases, ISO/MSP providers are required to register with Visa and MasterCard simultaneously in order to accept either card.

The registration process works a like this:

ISO/MSP finds sponsor(s)
The ISO/MSP proves that it can meet requirements
The sponsor bank reviews the application, background, financial, and operation history
The sponsor bank checks for PCI DSS compliance
Sponsors choose to review business type, services, program risk, how cardholder data is held and processed, etc.
ISO/MSP provides all relevant documents

The ISO/MSP pays a registration fee of up to £5,000 to each Visa and MasterCard (This is yearly) to become registered

ISO/MSP then have to pay a minimum monthly processing fee of £3,500-£7,000 per month – meaning that an ISO must process a minimum of about 80,000 transactions per month to meet basic requirements. Some sponsoring banks also have a minimum acquisition per month requirement.

Is the merchant service provider you are considering registered? You can check by visiting:

If your provider is not on the list, they are not registered.

What Does This Mean for You?

ISOs and MSPs go through rigorous evaluation, pay for registration, and agree to the regulations and requirements of the Visa or MasterCard association they are joining.

Members agree to:

Restrict operations to those approved by Visa/MasterCard
Process transactions safely
Report new merchants and acquisitions on a periodic basis
Respond to and implement new safety standards
Only work with Visa/MasterCard approved businesses and manufacturers
Process transactions in accordance with Visa standards
Submit an Operating Certificate with Interchange Transactions, On-Us Transactions, and non-Visa Transactions
Maintain records of all transactions processed and submit them for review upon request

In short, Visa/MasterCard registered ISO/MSP organisations are required to follow Visa/MasterCard operating policy and regulation in order to remain members. A non-registered member is not bound by these requirements.

Visa and MasterCard each charges fines starting from £10,000 for the first violation and up to £25,000 for non-compliance or non-registration.

Additional Reading:

Reported Issues Arising from Unregistered Operators

Any merchant account provider looking to offer legitimate and quality services to their merchants will go through the steps to gain a sponsor and become a registered service provider. As a result, businesses using unregistered ISO/MSPs for their merchant account services are especially vulnerable to fraud, poor business services, and even scams.

In 2017, the U.S. Commodity Futures Trading Commission issued a warning that unregistered financial organizations could be part of Ponzi schemes.

Unregistered ISO/MSPs are also more likely to participate in transaction laundering, a process where unregistered merchant accounts and illegitimate businesses hide illegal sales by processing them through legitimate businesses, often without that business’ knowledge.

Unregistered providers do not report sales, acquisitions, or rates to MasterCard or Visa. There is nothing to prevent them from charging exorbitant rates, with transaction rates, monthly fees, and other costs well in excess of industry standards.

And, if Visa or MasterCard find an unregistered payment provider offering their services, the company will be fined. You may lose the ability to process Visa and MasterCard payments.

It’s easy to verify that a merchant account provider is registered with Visa and MasterCard, either as an ISO/MSP or as an acquiring bank. You can also look at any paperwork, which should state the provider’s sponsoring bank or that they are a member of the Visa/MasterCard association.