What a payment facilitator actually does

A payment facilitator (often called a PayFac) is a company that lets other businesses accept card payments without those businesses having to set up their own merchant accounts directly with banks. Instead of a restaurant or boutique signing a contract with a payment processor, they sign with you—the PayFac—and you handle the relationship with the bank, the card networks, and the settlement of funds.

You sit in the middle of the transaction flow. A customer swipes a card at a merchant's register (or online). That transaction data flows through your systems to the card networks and the customer's bank. You collect the payment, take your cut, and send the rest to the merchant. You also hold the liability for fraud, chargebacks, and compliance failures—which is why the barrier to entry is high and regulators watch closely.

This is different from being a payment processor or a merchant services provider. Those roles exist further down the chain and handle technical processing without taking on the same legal and financial responsibility that a PayFac does.

Key Takeaways

  • Becoming a PayFac requires a bank sponsor (an acquiring bank that will underwrite you), significant capital reserves, and the ability to pass compliance audits from Visa and Mastercard.
  • You must build or license payment processing software, integrate with card networks, and establish fraud detection and chargeback management systems before you can process a single transaction.
  • The regulatory burden includes PCI DSS compliance, anti-money laundering (AML) controls, and ongoing monitoring of your sub-merchants for suspicious activity.
  • Most new entrants start by partnering with an existing PayFac or processor rather than building from zero, because the technical and legal setup costs hundreds of thousands of dollars.
  • Your revenue comes from interchange fees, assessment fees, and markups on processing rates—but you also absorb losses from fraud and chargebacks, so unit economics matter more than volume alone.

Finding and securing a bank sponsor

You cannot become a PayFac without a bank. Specifically, you need an acquiring bank (also called a sponsor bank) that is willing to underwrite you, hold your reserve account, and vouch for you to Visa and Mastercard. This bank is taking on risk by sponsoring you, so they will scrutinize your business plan, your team's experience, your capital, and your compliance infrastructure before they sign on.

Banks do not advertise PayFac sponsorship openly. You typically find them through industry networks, consultants who specialize in payments, or by approaching banks that already sponsor PayFacs in your target vertical. A bank that sponsors PayFacs in restaurant payments, for example, may not sponsor those in healthcare or gambling—so fit matters.

The bank will require you to maintain a reserve account (sometimes called a settlement reserve or holdback). This account holds a percentage of your transaction volume as a buffer against chargebacks and fraud losses. The reserve requirement varies but often starts at 5 to 10 percent of monthly processing volume and can be held for 6 to 12 months or longer. You will also pay the bank a sponsorship fee, usually a flat monthly amount or a small percentage of your processing volume.

Expect the sponsorship negotiation to take 3 to 6 months. The bank will want to see your compliance roadmap, your fraud controls, your merchant underwriting process, and proof that your team has payments experience. If you have no payments background, you will need to hire someone who does or partner with a consultant.

Building or licensing your processing infrastructure

You need software that can accept card data, tokenize it, route transactions to the card networks, handle responses, and settle funds to merchant accounts. You have three paths: build it yourself, license it from an existing processor, or partner with a technology provider that handles the heavy lifting while you handle merchant relationships and compliance.

Building from scratch is expensive and slow. You will need to integrate with Visa's and Mastercard's networks (VIP and MasterCard Network Services, respectively), which requires technical certification and ongoing compliance. You will also need to integrate with ACH networks if you want to handle bank transfers, and you will need fraud detection, tokenization, and PCI-compliant data storage. A minimal in-house build takes 12 to 18 months and costs $500,000 to $2 million, depending on scope.

Licensing from an existing processor (sometimes called a white-label or reseller arrangement) is faster and cheaper. Companies like Stripe, Square, or smaller regional processors will license their platform to you, handle the network integration, and let you brand it as your own. You pay them a percentage of your processing volume or a flat monthly fee, and you keep the rest. This path takes 3 to 6 months to launch and costs $50,000 to $200,000 upfront, plus ongoing licensing fees.

Partnering with a technology provider means you focus on merchant acquisition and compliance while they handle the technical plumbing. This is the slowest path to full PayFac status (you may start as a reseller and graduate to PayFac later), but it lets you launch with minimal technical risk and capital outlay.

Meeting compliance and regulatory requirements

Visa and Mastercard set the rules for PayFacs, and they are strict. You must pass a PCI DSS (Payment Card Industry Data Security Standard) audit at Level 1, the highest level. This means your systems, your data storage, your network security, and your employee access controls must meet a detailed checklist. You will hire a may have access to Security Assessor (QSA) to audit you annually, and the cost runs $10,000 to $50,000 per year depending on your transaction volume and system complexity.

You must also implement AML/KYC (anti-money laundering and know-your-customer) controls. This means you screen your merchants against sanctions lists, verify their identity, and monitor their transactions for suspicious patterns. If a merchant is processing unusually high volumes, moving money to high-risk jurisdictions, or showing signs of fraud, you must investigate and potentially terminate them. You will need software to automate this (or hire staff to do it manually, which does not scale). AML compliance costs $20,000 to $100,000 to set up and $5,000 to $20,000 per month to maintain.

Visa and Mastercard also require you to maintain a Risk Management Program. This is a formal process for identifying, monitoring, and mitigating fraud, chargebacks, and compliance violations. You must document your policies, train your staff, and report metrics to your bank sponsor and the card networks quarterly. Mastercard publishes a detailed Acquirer Program Guide and Visa publishes an Acquirer Compliance Program—both are public and both are long.

You will also need to register with FinCEN (the Financial Crimes Enforcement Network) as a Money Services Business if you handle certain types of transactions, and you may need state money transmitter licenses depending on where you operate and what services you offer. These licenses vary by state and can take 3 to 12 months to obtain.

Underwriting and onboarding merchants

Every merchant you sign is a liability. If they commit fraud, process stolen cards, or launder money, you are responsible—not just legally, but financially. Your bank sponsor will hold you accountable, and Visa and Mastercard will fine you or revoke your license if you fail to police your merchants.

You need a formal merchant underwriting process. This means you collect information from every applicant: business registration documents, tax returns, bank statements, beneficial ownership information, and details about their business model. You run background checks, verify their identity, and assess their risk profile. High-risk merchants (those in gambling, adult services, or high-chargeback categories) require more scrutiny and may be rejected outright.

You also need ongoing monitoring. After a merchant is live, you watch their transaction patterns. If they suddenly spike in volume, process unusually large transactions, or show signs of fraud, you investigate. You set velocity limits (maximum transaction amounts or daily volumes) and chargeback thresholds. If a merchant exceeds them, you freeze their account and investigate before unfreezing.

This process is labor-intensive. Most PayFacs hire a compliance team of 3 to 10 people (depending on merchant volume) to handle underwriting and monitoring. Alternatively, you can use third-party underwriting services, but you still bear the final responsibility.

Managing fraud, chargebacks, and reserves

Every transaction carries risk. A customer disputes a charge, their bank issues a chargeback, and the money comes out of your reserve account. If your chargeback rate exceeds Visa's or Mastercard's thresholds (typically 0.5 to 1 percent of transactions), you face fines, mandatory reserve increases, or termination.

You need fraud detection software that flags suspicious transactions in real time. This might be a third-party service like Kount or Sift, or it might be built into your processing platform. The software uses machine learning to spot patterns: a card used in two countries in 10 minutes, a sudden spike in transaction volume, a card number that matches known fraud databases. You set rules for what gets approved, declined, or sent to manual review.

You also need a chargeback management process. When a customer disputes a charge, you have evidence to submit: the transaction receipt, proof of delivery, customer communication, or other documentation. If you can prove the transaction was legitimate, you can win the chargeback and keep the money. If you lose, the money stays gone and you may face a fine from the card network.

Your reserve account absorbs these losses. If you process $1 million per month and your reserve requirement is 10 percent, you hold $100,000 in reserve. If chargebacks and fraud losses total $5,000 that month, the reserve drops to $95,000. The bank may require you to replenish it, or they may hold it longer before releasing it to you. This is why unit economics matter: if your margin per transaction is too thin, chargebacks and fraud will wipe out your profit.

Choosing your merchant vertical and go-to-market strategy

You cannot serve every merchant type profitably. PayFacs typically specialize: some focus on restaurants and food delivery, others on e-commerce, others on SaaS platforms, others on healthcare. Your choice affects your compliance burden, your fraud risk, your pricing power, and your ability to compete.

If you target restaurants, you compete with Square, Toast, and Clover—all of which have massive scale and brand recognition. If you target niche verticals (say, yoga studios or pet groomers), you face less competition but smaller addressable markets. If you target SaaS platforms (letting them embed payments into their software), you can charge higher fees but you need deeper technical integration.

Your go-to-market strategy depends on your vertical and your capital. Direct sales (hiring a sales team to call merchants) is expensive but gives you control. Partnerships (working with software vendors, consultants, or resellers who refer merchants to you) are cheaper but you share revenue. Self-service (a website where merchants sign up and go live in minutes) requires sophisticated fraud detection and compliance automation but scales without sales overhead.

Most new PayFacs start with partnerships or a narrow vertical where they have existing relationships. As you grow, you can expand to other verticals or add direct sales. The key is to pick a vertical where you can build expertise, underwrite merchants efficiently, and manage fraud and chargebacks profitably.

Frequently Asked Questions

Do I need payments experience to become a PayFac?

Not strictly, but it helps enormously. If you have no payments background, you will need to hire someone who does—ideally someone who has worked at a processor, bank, or existing PayFac. Your bank sponsor will want to see payments expertise on your team before they underwrite you. You can also hire a payments consultant to guide you through the setup, though that adds cost.

How much capital do I need to start?

Minimum $250,000 to $500,000, and often more. This covers your bank sponsor's reserve requirements, compliance setup (PCI audits, AML software, legal), technology licensing or development, and operating expenses for 12 to 18 months before you reach profitability. If you build your own technology instead of licensing, add another $500,000 to $2 million.

Can I start as a reseller and become a PayFac later?

Yes. Many companies start by reselling another PayFac's platform (taking a cut of processing volume) and graduate to PayFac status once they have merchant volume, compliance infrastructure, and a bank sponsor lined up. This path is slower but lower-risk and lower-cost upfront.

What happens if my chargeback rate gets too high?

Visa and Mastercard will fine you, require you to increase your reserve account, and may terminate your license if you do not improve. You will need to tighten your fraud controls, improve your merchant underwriting, or exit high-risk merchant categories. If you cannot bring your chargeback rate down, you lose your PayFac status and your business.

How long does it take to launch as a PayFac?

If you license technology and partner with an existing processor, 6 to 12 months from first conversation with a bank sponsor to processing your first transaction. If you build your own technology, add 12 to 18 months. Most of the time is spent on compliance setup, bank underwriting, and network certification—not on the business itself.