What CardConnect actually is
CardConnect is a merchant acquirer and independent sales organization operating as a wholly owned brand inside Fiserv, Inc. It signs US businesses to card acceptance under merchant processing agreements and supplies the software layer merchants actually touch: the CardPointe gateway and merchant portal, the CardSecure encryption and tokenization service, its own integrated and semi-integrated terminals, and Clover point-of-sale hardware resold from its parent.
What it is not is a bank, and it is not the entity that ultimately decides whether an account lives or dies. Its own About page discloses that it is a registered ISO of Citizens Bank, N.A., KeyBank N.A., Pathward N.A., PNC Bank, N.A. and Wells Fargo Bank, N.A. Five sponsor banks, not one. Which stands behind a given merchant is settled during underwriting, and the merchant usually learns it after the fact.
The second thing the website does not make obvious is that most CardConnect accounts are not sold by CardConnect. A large share of its distribution runs through independent agents, smaller ISOs and software vendors who sell the accounts and manage their portfolios through a separate partner portal called CoPilot. That matters more than it sounds: the merchant's day-to-day relationship belongs to a reseller whose economics are the spread between what Fiserv charges and what the merchant pays.
How the money and the risk actually move
Follow a single card sale and the structure becomes clear. The transaction is captured by the CardPointe gateway, a Clover device or an integrated terminal running CardSecure; authorized through Fiserv's acquiring platform; cleared through the card network to the issuing bank; and settled back through the sponsor bank to the merchant. CardConnect touches the front end and reports on it, but holds neither the settlement account nor the network membership.
Risk follows the same chain. When a cardholder disputes a charge, the issuer raises a chargeback, the acquiring side debits the merchant, and if the merchant cannot cover the loss the sponsoring bank absorbs it. That is why the bank, not CardConnect, has the last word on underwriting, reserves and termination — and why a merchant should care which of the five banks it lands with, since the bank sets the risk appetite that governs how a volume spike or a run of disputes is treated.
Card-not-present merchants sit on the CardPointe gateway, which exposes REST APIs, a hosted iFrame tokenizer and hosted payment pages so raw card numbers never land on the merchant's servers. Card-present merchants sit on CardSecure, which CardConnect describes as a PCI-validated point-to-point encryption and tokenization solution: card data is encrypted inside the terminal and never exists in readable form on the merchant's network. Both shrink the set of systems falling inside PCI DSS scope, the regime governing anyone who stores, processes or transmits card data.
ACH runs through the same gateway, with a Fiserv ACH developer guide and an account-validation service published alongside the card APIs. Real-time rails are a different story: Fiserv operates real-time payment services on the bank side, but CardConnect's merchant materials document neither RTP nor FedNow availability to CardPointe merchants.
How CardConnect prices, and why two identical merchants pay differently
CardConnect publishes nothing: no rate card, no fee schedule, no sample statement, no contract length, no cancellation policy, no merchant agreement. A prospective merchant cannot determine from the public site what an account will cost or what it will take to leave — a feature of the agent-sold model rather than an oversight.
Pricing is quoted deal by deal, frequently by the reselling agent rather than by CardConnect, and the agent chooses the model. It may be interchange-plus, where interchange passes through at cost and the markup is stated separately, or tiered, where transactions are sorted into loosely defined qualified, mid-qualified and non-qualified buckets whose boundaries the merchant cannot audit. Two businesses with identical volume, card mix and risk profile can sit on the same Fiserv platform under very different economics purely because different agents wrote the deals.
Beyond the headline processing cost, ask individually about PCI compliance and non-compliance fees, chargeback handling fees, gateway and terminal fees, and any annual security bundle. Whether an early-termination fee applies depends entirely on the agreement the selling agent wrote.
Where CardConnect is genuinely strong
Three capabilities have substance behind them rather than marketing.
- Enterprise ERP payments. This is the most defensible niche CardConnect has. Its payment solution was certified as Powered by SAP NetWeaver in 2017, and it announced a packaged implementation for Oracle E-Business Suite in 2016. For a company running finance on SAP or Oracle, having card data tokenized inside the ERP rather than bolted on through a middleware layer is a genuine reduction in PCI scope and reconciliation work. Very few acquirers hold both certifications.
- A documented gateway with real developer material. Fiserv publishes full CardPointe Gateway REST API documentation, SDKs and the hosted iFrame tokenizer on its Developer Studio, and community-maintained integrations exist for React, WooCommerce and Drupal. A developer can evaluate the integration before a salesperson is involved.
- One gateway across card-present and card-not-present. A multi-location retailer or restaurant group can run Clover devices, CardPointe terminals and the Bolt semi-integrated solution in store while taking online and phone orders through the same gateway, with one reporting portal across channels.
Two lesser strengths round it out: tokenized card credentials support scheduled and repeat billing, and hosted payment pages plus a browser-based virtual terminal let a merchant take card-not-present payments without building anything.
Where it falls short
Fee transparency is the headline failure, and there is nothing on the public site to be transparent about. For a merchant whose main criterion is cost certainty, that alone is disqualifying. The comparison that makes the point is not another ISO — it is Clover bought directly from Fiserv: the same acquiring and the same hardware, without a reseller layer setting its own margin on top.
High-risk underwriting is absent. CardConnect is a mainstream acquirer sponsored by large US banks and does not market restricted-vertical underwriting; a CBD retailer, a nutraceutical subscription business or a firearms dealer should not spend time here.
Cross-border acquiring is effectively unavailable. Every sponsor bank named is a US institution and the merchant materials describe US businesses; there is no multi-currency settlement and no marketed international acquiring.
Orchestration is absent, and that is structural. CardConnect routes to Fiserv's acquiring platform, full stop — no multi-acquirer routing, no failover to a third-party processor, no cascading retry. A merchant whose authorization rates depend on trying a second acquirer when the first declines will not get that here.
Embedded payments sit in an awkward middle. CardConnect serves software vendors through integrated-payments referral and revenue-share arrangements — a commercial relationship rather than a product. A software company that wants programmatic sub-merchant onboarding, the way a payment facilitator platform works, will not find documentation for it.
Finally, accountability is diffuse by design: service, repricing and cancellation run through a reseller, and the sponsor bank may be any of five institutions. When something goes wrong, the merchant has to work out who to escalate to before they can escalate.
Ownership, history and the Fiserv overhang
CardConnect dates to 2006, per its own About page. It went public in 2016 by merging with FinTech Acquisition Corp., a special-purpose acquisition company, and was bought the following year by First Data for about $750 million in cash — at which point it was reported to have roughly 67,000 merchants and about $26 billion in annual processing volume. Those remain the most recent published figures; Fiserv does not break CardConnect out in its reporting.
First Data merged into Fiserv in 2019 in a transaction valued at about $22 billion. The brand remains active — Fiserv and CardConnect jointly announced partner awards in January 2026 — and CardPointe documentation now lives on Fiserv's Developer Studio.
The parent-company picture deserves attention from anyone signing a multi-year agreement. Fiserv shares fell roughly 44% in late October 2025 after weak third-quarter results and a guidance cut, with the company itself citing merchant complaints about Clover-related fees. Securities fraud class actions followed, alleging management misrepresented Clover's prospects, and lawmakers took an interest after Fiserv acknowledged its mid-2025 guidance rested on assumptions objectively difficult to achieve. None of that is an allegation about CardConnect's merchant operations. But a processor under pressure to defend margins has a reason to reprice.
No enforcement action, consent order or CFPB or FTC matter against CardConnect itself was found in this research.
How to evaluate a CardConnect proposal
Because nothing is published, everything has to be extracted in writing before signing.
- Who is the counterparty? Ask which of the five sponsor banks will hold the account and get it named in the agreement. Establish whether you are contracting with CardConnect, with Fiserv or with the agent's own entity — and who you call when the account is frozen.
- Which pricing model? Insist on interchange-plus with the markup stated as a separate line and refuse tiered pricing. Tiered buckets cannot be audited against a network fee schedule, which is the point of them.
- Can fees change unilaterally? Read the change-of-terms clause. Ask whether new fees can be added on an opt-out basis, what notice you get, and whether you may terminate without penalty if terms change.
- What does exit cost? Get the term, the auto-renewal mechanism, the notice period and the early-termination fee in writing. None is published, and the term you are offered is the agent's choice.
- Who owns the tokens? CardSecure tokenization is well documented, but no vault-portability policy is published. Ask in writing whether you can export your tokenized card vault on exit; if not, your card-on-file customers are the switching cost.
- Compare against buying direct. If the appeal is Clover hardware, price the same setup from Fiserv. The acquiring is identical; the difference is a layer of margin and a named local representative. Sometimes that representative is worth it — decide deliberately.
Capability assessment
Every company profiled on this site is assessed against the same eighteen dimensions, so the profiles can be read against one another. Each rating carries one sentence of evidence. There is no score out of ten, because a score is not defensible and a sentence is.
Core strength means a primary, differentiating capability. Supported means genuinely offered and documented, but not a differentiator. Limited means partial, geographically restricted, gated behind an enterprise tier, or delivered through a third party. Not offered means what it says. Unclear means the company markets the capability but does not document it well enough to judge — which is itself a finding.
Who CardConnect suits
- US businesses running SAP or Oracle E-Business Suite that want card data tokenised inside the ERP rather than bolted on — CardConnect holds certified integrations for both.
- Merchants who want Clover hardware but prefer buying through an ISO or agent with a named local rep rather than direct from Fiserv.
- Independent software vendors adding card acceptance to their product with a documented gateway API and a revenue share, without becoming a payment facilitator themselves.
- Multi-location US retailers and restaurants that want one gateway across card-present and card-not-present channels with point-to-point encryption at the terminal.
Who CardConnect is a poor fit for
- Merchants who need to know their cost before they sign. CardConnect publishes no rates, no fee schedule and no standard contract term anywhere on its public site; the deal is written by whichever agent or ISO sells it, so two merchants on the same platform can sit on very different economics.
- Merchants who object to fees being added to a live account by default. Trade publication Reforming Retail reported in October 2023 that Fiserv would add a $285 annual 'Security Bundle' fee to CardConnect merchants from November 2023 on an opt-out basis, with ISOs able to remove merchants after the fact rather than merchants being asked to opt in.
- Businesses in high-risk or restricted categories — CardConnect is a mainstream Fiserv acquirer and does not underwrite them.
- Merchants who want a single accountable counterparty. Because most CardConnect accounts are sold through agents and ISOs, service, repricing and cancellation typically run through a reseller whose incentives differ from the merchant's, and the underlying sponsor bank may be any of five different institutions.
- Non-US and multi-currency businesses — CardConnect's published bank sponsorships and product materials are US-only and it does not market cross-border acquiring.
- Merchants who weigh parent-company stability: Fiserv shares fell roughly 44% in late October 2025 after it cut guidance and cited merchant complaints about Clover-related fees, and it subsequently faced securities class actions and lawmaker scrutiny.
Competitors and alternatives
| Company | Why a business would choose it instead |
|---|---|
| Clover (bought direct from Fiserv) | Identical underlying acquiring and hardware without the ISO layer that sets its own pricing. |
| Stripe | Published flat pricing and self-serve onboarding, versus CardConnect's quote-only, agent-sold model. |
| Square | Published rates and no long-form merchant processing agreement or reseller in the middle, for small US retail and restaurants. |
| Global Payments / Heartland | Comparable ISO- and agent-sold US acquiring with its own integrated POS estate. |
| Shift4 | Directly competitive in integrated restaurant and hospitality payments with its own gateway and P2PE. |
| Payroc | An alternative ISO relationship for merchants who want to keep an agent but change the underlying processor. |
CardConnect — frequently asked questions
Is CardConnect the same company as Fiserv?
CardConnect is a brand and wholly owned subsidiary within Fiserv, Inc., not a separate company. First Data acquired CardConnect in 2017 for about $750 million, and First Data merged into Fiserv in 2019. The CardConnect and CardPointe brands remain in active use as of 2026, and CardPointe's developer documentation is hosted on Fiserv's Developer Studio.
Who is CardConnect's acquiring bank?
There is no single one. CardConnect's own About page states that it is a registered ISO of Citizens Bank, N.A., KeyBank N.A., Pathward N.A., PNC Bank, N.A. and Wells Fargo Bank, N.A. Which of those banks sponsors a given merchant is decided during underwriting rather than disclosed in advance, so a merchant should ask for the sponsor bank to be named in the agreement.
What is CardPointe, and how is it different from CardConnect?
CardPointe is CardConnect's gateway and merchant portal: REST APIs, a hosted iFrame tokenizer, hosted payment pages, a virtual terminal, integrated and Bolt terminals, and reporting. CardSecure is the associated point-to-point encryption and tokenization layer, and CoPilot is the separate portal that agents and ISOs use to manage their merchant portfolios. CardConnect is the company; CardPointe is its product.
Does CardConnect publish its pricing?
No. CardConnect publishes no rates, no fee schedule, no monthly minimum, no standard contract length and no merchant agreement anywhere on its public website. Pricing is quoted per merchant and is frequently set by the agent or ISO selling the account, which may be interchange-plus or tiered, so two merchants on the same platform can pay materially different amounts.
Does CardConnect work with high-risk businesses?
No. CardConnect is a mainstream Fiserv acquirer sponsored by large US banks and does not market high-risk or restricted-vertical underwriting. Businesses in categories such as CBD, nutraceuticals, adult, firearms or debt relief should approach an ISO that specializes in placing those accounts rather than applying here.
Can CardConnect process payments inside SAP or Oracle?
Yes, and this is one of its genuinely distinguishing capabilities. CardConnect's payment solution was certified as Powered by SAP NetWeaver in 2017, and it announced a packaged implementation for Oracle E-Business Suite in 2016. For enterprises running finance on either system, tokenizing card data inside the ERP reduces PCI scope compared with a bolted-on integration.
Is CardConnect a gateway or a payment processor?
Both descriptions are partly true, which is why the company confuses buyers. CardPointe is a genuine payment gateway with its own APIs and tokenization. CardConnect itself is a registered ISO reselling Fiserv acquiring — underwriting, settlement and risk decisions sit with Fiserv and the sponsoring bank, not with CardConnect.
Sources
This profile was built from the following primary and secondary sources. Where sources disagreed, the disagreement is stated in the text rather than resolved silently.
- https://www.cardconnect.com/company/about/
- https://www.cardconnect.com/
- https://www.finextra.com/newsarticle/30633/first-data-acquires-cardconnect
- https://www.pymnts.com/news/partnerships-acquisitions/2017/first-data-to-buy-card-connect-for-750m/
- https://ftvcapital.com/2016/cardconnect-and-fintech-acquisition-corp-announce-merger-agreement-combining-busin
- https://developer.fiserv.com/product/CardPointe
- https://developer.fiserv.com/product/CardPointe/docs/documentation/HostediFrameTokenizer.md?branch=active
- https://developer.fiserv.com/product/CardPointe/docs/?path=docs/documentation/FiservACHDeveloperGuide.md&branc
- https://support.cardpointe.com/cardsecure/
- https://support.cardpointe.com/compliance/fiserv-ach-account-validation/
- https://www.globenewswire.com/news-release/2017/05/15/984843/0/en/cardconnect-payment-solutions-is-certified-a
- https://www.globenewswire.com/news-release/2016/09/19/872874/0/en/CardConnect-Introduces-30-Day-Payments-Imple
- https://reformingretail.com/index.php/2023/10/24/to-catch-a-predator-fiserv-via-cardconnect-november-2023/
- https://en.wikipedia.org/wiki/Fiserv
- Founders and original founding entity. The About page gives 2006 as the founding year but names no founders; the predecessor business was backed by FTV Capital, but the founding individuals could not be confirmed from a primary source.
- Current merchant count, processing volume and employee headcount. The most recent published figures found date to the 2017 First Data acquisition (~67,000 merchants, ~$26bn annual volume, $589m revenue); Fiserv does not break CardConnect out in its financial reporting.
- Standard contract length, auto-renewal and early-termination terms. No CardConnect merchant processing agreement is published on its public site and none was located; reported terms vary because deals are written by agents and ISOs.
- The $285 'Security Bundle' fee and the accompanying basis-point increases rest on a single trade-blog source (Reforming Retail) and were not confirmed by a Fiserv statement or filing.
- Fiserv's current ticker and exchange. Fiserv's own investor-relations company-information page and Wikipedia both showed Nasdaq: FISV at the time of research, after a June 2023 move to NYSE: FI; confirm against a current SEC filing before publishing.
- Real-time payment rail (RTP/FedNow) availability to CardPointe merchants — not documented in CardConnect's public materials.
- Whether CardConnect merchants can export a tokenised card vault on exit. CardSecure tokenisation is documented but no public vault-portability policy was found.