Embedded Payments for SaaS and ISVs

Why software companies ended up in the payments business

An independent software vendor (ISV) is a company that sells software it wrote to businesses that use it to run something else — a dental practice, a haulage fleet, a gym, a property portfolio. For most of the last two decades an ISV's revenue was a monthly license fee, and payments happened off to the side, through a processor the customer found on its own.

That arrangement has been dismantled, for two reasons. The first is arithmetic: the money moving through a vertical software product is usually far larger than the subscription charged for it. A field-services platform billing a contractor a few hundred dollars a month may be watching that contractor collect hundreds of thousands. Capturing even a thin slice of the payment margin can exceed the software revenue outright. Toast is the clearest demonstration — processing revenue is the large majority of what the company earns, and the point-of-sale software is what makes it possible.

The second reason is that the customer prefers it. A merchant who is onboarded inside the software they already use, with reconciliation that matches their invoices automatically, does not want a separate merchant account application and a separate gateway login. Embedded payments win on friction before they win on price.

The four models, from least to most commitment

There are only four structural choices, and they form a ladder. Each rung earns more, obliges more, and takes longer to build.

The mistake most ISVs make is skipping rungs. A platform with two hundred merchants and no risk function does not need its own network registration; it needs attach rate. Move up the ladder when the current rung is demonstrably constraining revenue, not when a competitor announces a press release.

Referral: the model that pays least and costs least

In a referral arrangement the ISV introduces its customer to a processor and is paid for the introduction — a one-off bounty, a small ongoing residual, or both. The processor underwrites, prices, funds and supports the merchant. The ISV touches nothing.

The economics are correspondingly modest. A referral typically returns a fraction of the payment margin, and because the ISV does not control pricing it cannot compete on price, cannot bundle payments into its own packaging, and cannot see what its customer is actually paying. Worse, the ISV has no way to prevent its merchants being repriced, and no visibility when they are.

Referral is nonetheless the correct answer in three situations: when the merchant base is small enough that no economic model justifies engineering time; when merchants are large enough to need their own direct merchant accounts anyway; and when the vertical is high-risk enough that the ISV genuinely does not want the underwriting exposure. CardConnect, North and Elavon all run large ISV referral and integrated-payments channels precisely because most software companies belong on this rung longer than they think.

Revenue share: the middle rung, and its hidden term

Revenue share, sometimes sold as integrated payments, keeps the processor as the underwriter and the merchant account issuer, but gives the ISV an ongoing percentage of the processing margin on merchants it brings and sometimes influence over the rate card. The merchant still contracts with the processor. The ISV still does not carry loss.

This is where the term buy rate first appears, and it is the concept that governs everything above this rung. The buy rate is the wholesale cost the provider charges the ISV per transaction — usually interchange (the portion of a card fee that goes to the cardholder's bank, set by the card network and not negotiable by anyone in the chain) plus network assessments plus the provider's own margin. Whatever the ISV charges its merchant above the buy rate is the ISV's revenue. Everything below the buy rate is a cost the ISV cannot influence.

The trap at this rung is exclusivity. Many revenue-share agreements bind the ISV to a single processor for a multi-year term with automatic renewal, no volume-based repricing and no merchant data portability. Signing that is signing away the negotiating leverage the ISV will need at exactly the point its portfolio becomes valuable.

PayFac-as-a-service: where most platforms should stop

PayFac-as-a-service inverts the relationship. The provider holds the network registration, the sponsorship and the master merchant account; the ISV boards its own merchants as sub-merchants through an API, sets what those merchants pay, controls funding timing and split payouts, brands the entire experience, and keeps the spread over the buy rate. The provider still carries the compliance and underwriting machinery — and, critically, still carries the residual loss, usually with contractual recourse to the ISV.

The market here is genuinely competitive, and the providers differ in ways that matter to the model. Payrix, now sold as Worldpay for Platforms, offers both a managed shape where it holds underwriting and risk and a shape for platforms that already carry their own registration; its selling point is settling through a top-tier acquirer's licenses rather than a startup's sponsor bank. Finix charges subscription plus per-transaction fees and states it does not mark up interchange, which produces a very different curve as volume grows than a percentage-of-volume deal. Rainforest competes explicitly on the platform keeping more of the margin, cites a customer whose margin moved from 21 to 54 basis points, and sells portfolio migration and contractual data portability as features. Stax Connect, NMI and Moov address the same buyer from the ISO channel, the gateway layer and the money-movement layer respectively. Stripe Connect and Adyen for Platforms are the large-scale alternatives, with the trade-off that pricing and roadmap are set globally rather than negotiated.

Full PayFac: what the last rung actually costs

Becoming a registered payment facilitator means the ISV holds its own merchant agreement with an acquiring bank and boards merchants as sub-merchants under it. The margin is no longer a spread over someone's buy rate; it is the whole spread between interchange plus assessments and what merchants pay, less what the ISV spends to earn it.

What it spends is the point. Network registration with Visa and Mastercard and its annual renewal. A sponsor bank relationship, with the diligence and reporting cycle that comes with it. A PCI DSS Level 1 assessment. Underwriting staff who can decline business the sales team wants. Sanctions and terminated-merchant-file screening, repeated, not performed once. Transaction monitoring capable of spotting laundering and average-ticket drift. Dispute operations. Settlement and reserve engineering. Capital held against portfolio losses, because when a sub-merchant fails and its customers charge back, the facilitator pays.

Almost all of that is fixed cost. That is the whole shape of the decision: the revenue line scales with volume and the cost line does not, so the model is punishing below a certain portfolio size and compelling above it.

What the economics actually look like

Work a hypothetical. A vertical platform has 600 customers. Half accept payments through the product — a 50% attach rate, realistic for a well-integrated product and optimistic for a bolt-on. Each processes $25,000 a month, so the portfolio is $7.5m a month, or $90m a year.

Now apply retained margin, expressed in basis points (hundredths of a percent) of processed volume:

• At 10 bps — a thin referral or early revenue share — the platform earns $90,000 a year. That is a rounding error against payroll, and correctly treated as incidental.
• At 40 bps — a competently negotiated PayFac-as-a-service spread — it earns $360,000, at which point payments is a product line with an owner and a roadmap.
• At 75 bps — the upper end of what full facilitation retains in a favorable mix — it earns $675,000, against a fixed compliance and risk cost base that could consume most of the difference between that and the 40 bps figure.

These numbers are illustrative, not quotes. The structure they reveal is real and holds at any scale: attach rate moves the outcome more than basis points do. Lifting attach from 50% to 70% at 40 bps beats lifting margin from 40 to 50 bps at 50% attach, and it requires no registration, no sponsor bank and no risk hire. The highest-return investment in most embedded payments programs is making payments the default in onboarding rather than an option in settings.

The obligations nobody puts in the pitch deck

Payment revenue arrives attached to work. Some of that work lands on the ISV no matter which rung it occupies.

• Support becomes yours the moment your logo is on the checkout. Merchants call the software they use daily, not the processor whose name they have never seen. Budget the headcount before the launch, not after the first month-end.
• PCI scope expands. Even with hosted fields and tokenization, the ISV inherits obligations around how card data is captured, how the page is served, and how integrations are maintained.
• Underwriting decisions become product decisions. Once you set merchant pricing and control onboarding, declining a customer is a revenue decision your sales team will contest.
• Chargeback exposure follows the money. Even where the provider carries first-loss, recourse clauses typically push portfolio losses back to the platform. Read them before assuming the risk sits elsewhere.
• Holding funds is a regulated activity. The moment a platform holds balances rather than passing settlement straight through, money transmission licensing questions arise. Structure this with counsel, not with an engineer's intuition about escrow.
• Onboarding quality is a compliance artefact. Beneficial ownership, sanctions screening and line-of-business verification are checks your sponsor will audit, not fields on a form.

How to choose, and what to put in the contract

Pick the rung by answering three questions honestly. What is your realistic attach rate — measured, not hoped? Do your merchants process enough volume for basis points to matter? And do you have, or will you hire, someone whose job is payment risk rather than payment revenue? If the answer to the third is no, PayFac-as-a-service is your ceiling, and that is a perfectly good place to run a large business.

Whatever you sign, four clauses decide whether the deal survives contact with success. Portability: an explicit right to export merchant records, transaction history and payment tokens in a usable format, because tokens that cannot leave the vault convert every future negotiation into a re-onboarding project. Repricing: a volume-based mechanism that improves the buy rate as the portfolio grows, rather than a fixed rate for a five-year term. Exclusivity and term: shorter than feels comfortable, with a defined exit. Change of control: the right to renegotiate or exit if your provider is acquired — Payrix changed corporate owner three times between 2022 and 2026 and retired its own brand along the way, which is not unusual in this market.

Then measure one number monthly: payment revenue per active customer. It exposes attach rate, margin and churn in a single figure, and it is the metric that tells you whether to climb the ladder or stay where you are.

Frequently asked questions