Acquirers, ISOs, and their sponsor banks make money by moving Merchant transactions. The higher the Merchant’s risk, the higher the margin, and that is exactly why medium- and high-risk portfolios are so attractive. But when you underwrite a Merchant, you don’t just take on their volume. You take on their behavior: their products, their marketing, their affiliates, their fulfillment, and their customer service. You own the result.
Your exposure falls into five areas: regulatory, litigation, compliance, financial, and reputational risk. Each one is driven by Merchant activity, each one lands on the acquirer or ISO, and each one has already cost real institutions real money. Let’s unpack them one at a time.
1. Regulatory Risk: Staying in Line with the Law
Regulators have made their position clear: if you give a bad actor access to the card networks, you can be held responsible for what that Merchant does with it. The FTC, CFPB, state attorneys general, and banking regulators increasingly look past the Merchant to the acquirer, ISO, or payment facilitator that processed the payments. Pleading ignorance to merchant malfeasance is no defense.
Merchants create regulatory risk when they use deceptive marketing, hide negative-option or subscription terms, misrepresent products, sell into restricted verticals, or rely on affiliates who do any of the above. Laws like the FTC Act, the Telemarketing Sales Rule, the Restore Online Shoppers’ Confidence Act, state automatic-renewal laws, and BSA/AML rules apply to what the Merchant does, but enforcement increasingly reaches the institution that made it possible.
Real-world example: In June 2025, payment processor Paddle agreed to pay $5 million to settle FTC allegations that it processed payments for deceptive tech-support schemes. According to the FTC, the Merchants used fake virus alerts impersonating well-known brands to push auto-renewing subscriptions on U.S. consumers, many of them older adults. The FTC alleged that Paddle’s model helped overseas operators access the card system while evading detection by merchant banks and card networks. Beyond the payment, Paddle is permanently banned from processing for an entire category of Merchants.
Impact on your business: civil penalties, redress payments, legal fees to respond to Civil Investigative Demands (CIDs), consent orders that can run for years, restrictions on the verticals you can serve, and a sponsor bank that suddenly wants to see everything.
2. Litigation Risk: Protecting Your Wallet
Regulators aren’t the only ones watching. Plaintiffs’ attorneys follow the money, and the money flows through you. Class actions can name the acquirer, the ISO, and the sponsor bank alongside the Merchant, using theories like RICO, aiding and abetting fraud, negligence, and unjust enrichment. And the Merchant that caused the harm is often insolvent, offshore, or gone by the time the lawsuit is filed, which leaves the institution with the deepest pockets.
Even a lawsuit you ultimately win can cost hundreds of thousands of dollars to defend, pull your team off revenue-generating work, and surface internal emails and risk reports in discovery.
Real-world example: In 2016, Zions First National Bank and two subsidiaries agreed to pay $37.5 million to settle a RICO class action (Reyes v. Zions First National Bank). The plaintiffs alleged that Zions provided payment processing to fraudulent telemarketing and web-marketing companies, and that more than 500,000 consumer accounts were debited without authorization. The case drew friend-of-court briefs from AARP, consumer groups, and three U.S. Senators, and it was fought all the way to the Third Circuit before settling.
Impact on your business: settlement costs, legal fees, years of distraction, public discovery of your own risk files, and the precedent that your institution is a viable target.
3. Compliance Risk: Staying in Line with the Networks
Where regulatory risk comes from the government, compliance risk comes from the rules you agreed to follow as a member of the card networks. Visa and Mastercard hold the acquirer responsible for every Merchant in their portfolio. When Merchants breach dispute and fraud thresholds, fail PCI DSS requirements, launder transactions, or misrepresent their MCC, the network assessments are issued to the acquirer, not the Merchant.
That exposure is growing. Visa’s VAMP and Mastercard’s upcoming GMAP now measure fraud and disputes together and score the acquirer on the health of the whole portfolio. A handful of out-of-control Merchants can push an entire portfolio into a monitoring program.
Examples of compliance risk include rising chargeback and fraud ratios, enumeration attacks, transaction laundering, PCI failures, and weak KYC or AML controls.
Real-world example: Arizona-based processor Humboldt Merchant Services built a large “Performance Marketing” portfolio of subscription Merchants selling diet pills, anti-aging creams, teeth whiteners, CBD products, and other nutraceuticals through trial offers. According to the FTC’s complaint, Mastercard got there first. Mastercard reviews in 2017, March 2018, and February 2019 found widespread load balancing and card sharing across thousands of Humboldt accounts coded as MCC 5968 (continuity/subscription Merchants). Mastercard also issued fines on “travel pack” accounts it found running unapproved negative-option billing. By October 2019, Humboldt’s president reported that thousands of its Performance Marketing Merchants had been closed as a result of Mastercard’s reviews, with more than $80 million in lost sales volume projected for that year alone.
The card network took down a major line of business long before any regulator did. When the FTC arrived years later, it cited more than 1,000 shell merchants with chargeback rates almost 10 times what the card brands consider excessive. In September 2026, a federal court entered a $12 million judgment and permanently banned Humboldt from processing for negative-option and other high-risk Merchants. Humboldt settled without admitting or denying the allegations.
Impact on your business: network fines and assessments, higher program fees, mandated remediation plans, and in the worst cases, restrictions on your ability to board new Merchants or issue MIDs in certain MCCs or loss of your network relationships.
4. Financial Risk: Protecting the Balance Sheet
Every approved Merchant is a credit decision. When cardholders dispute transactions, the acquirer pays the issuer first and tries to recover the money from the Merchant second. If the Merchant can’t or won’t pay because it has run out of cash, closed its doors, or disappeared, the loss is yours. In a sponsor bank relationship, that liability flows downhill to the ISO through reserves, indemnification clauses, and lawsuits.
Merchants drive financial risk through volume that outruns approved limits, bust-out fraud, subscription and upsell models that generate refund and chargeback waves, and business models that can collapse overnight when regulators step in. And when the Merchant is shut down or its assets are frozen, the reserves and settlement funds you were counting on can disappear with it.
Real-world example: MOBE (My Online Business Education) sold “get rich quick” online business coaching memberships and upsells ranging from $49 to tens of thousands of dollars, promising customers they could earn hundreds of thousands of dollars a year. According to the FTC, at least seven payment processors turned MOBE down before ISO Qualpay boarded it. Within two months, MOBE was running $6 million in volume, nearly five times its approved $1.25 million limit, and its chargeback ratio climbed to 2.54%. Qualpay processed about $80 million for MOBE before the FTC shut the operation down in June 2018. In 2020, Qualpay settled FTC charges with a $46.8 million judgment that was suspended only because the company could not pay it. It also gave up its claims to MOBE assets held by the court-appointed receiver, and was barred from processing for business coaching companies and other high-risk Merchants. One Merchant produced a liability bigger than the ISO could cover.
Impact on your business: chargeback and refund losses, reserves you can’t reach, judgments that can exceed your ability to pay, permanent loss of the verticals that drove your margin, and write-downs that can erase years of residuals.
5. Reputational Risk: Saving Face
Your reputation is what brings in new business, keeps sponsor bank relationships healthy, and gives regulators and networks confidence in your oversight. It takes years to build and a single headline to damage. Merchants create reputational risk through the products they sell, how they treat consumers, the affiliates they use, and the media and regulatory attention on their vertical or their executives.
The headline rarely stops at the Merchant. Reporters, regulators, and plaintiffs all ask the same question: who processed the payments?
Real-world example: In September 2026, global payments company Nuvei agreed to pay $4.85 million to settle FTC charges that it facilitated merchant fraud. The Merchants the FTC named are the kind every high-risk underwriter knows. One was DK Automation, a get-rich-quick “business opportunity” the FTC had sued for false and baseless earnings claims. Another was Reimage, an offshore tech-support scheme selling auto-renewing subscriptions, for which the FTC says Nuvei processed more than $30 million between 2017 and 2023. A third was American Tax Service, which impersonated government tax authorities. The FTC alleged that Nuvei opened and kept accounts for Merchants it knew or should have known were engaged in deception. Nuvei settled without admitting the allegations.
The settlement amount was modest for a company of Nuvei’s size. The headlines were not. Industry and consumer outlets ran stories under headlines like “Nuvei pays $4.9M to settle FTC case” and “The FTC Is Now Coming for the Payment Processors That Enable AI Fraud,” along with consumer-news versions describing a processor that “kept clearing charges for merchants running fraud and tech-support scams instead of screening them out.” The same week brought equally blunt coverage of Humboldt’s lifetime ban. In each story, the Merchant’s marketing tactics became the processor’s headline, and those stories are now what shows up when a prospect, partner, or sponsor bank searches the company’s name.
Impact on your business: lost sponsor bank and partner relationships, harder conversations with regulators and networks, prospects who choose a competitor, and more regulatory, litigation, and compliance scrutiny for the rest of your portfolio.
The Common Thread: The Warning Signs Were in the Data
Look back at each case. The tech-support schemes showed patterns of deceptive subscriptions and consumer complaints. The telemarketers in Zions generated hundreds of thousands of unauthorized debits. Mastercard flagged load balancing across thousands of Humboldt’s subscription accounts years before the FTC acted. MOBE blew through its approved volume and chargeback thresholds within weeks of boarding. Nuvei’s Merchants carried the classic markers of get-rich-quick and subscription schemes. In almost every case, the Merchant’s behavior was visible in the transaction data well before the fine, the lawsuit, the loss, or the headline arrived.
The problem isn’t a lack of data. It’s that most acquirers and ISOs still underwrite once at boarding, re-review annually, and react when something breaks. With high-risk Merchants, the risk profile you approved can be obsolete within weeks: a new product, a new affiliate, a new traffic source, or a new billing model changes everything. Every day a risky Merchant, affiliate, or campaign goes unnoticed in your portfolio, your exposure across all five risk vectors grows.
How Can Acquirers and ISOs Better Manage Their Risk Exposure?
The answer is continuous underwriting: ongoing, transaction-level monitoring of every Merchant, every day, instead of one-time or episodic reviews. That’s where SLYCE360 comes in.
SLYCE360, with its advanced analytics and automations, continuously analyzes and compares the data against built-in thresholds plus those you set, highlighting growing issues such as rising dispute rates, fraud spikes, billing anomalies, and rogue affiliates before they become a regulatory action, a lawsuit, a network fine, a loss, or a headline.
The five risk vectors aren’t going away. But with the right oversight, they become manageable, and profitable.