Three different businesses hide behind one job title
Almost everyone who says they are starting a payment processing company is describing one of three businesses, and the three have almost nothing in common. They differ in who signs the merchant, who eats the loss when that merchant vanishes owing chargebacks, who must be registered with the card networks, and how much capital has to be in the bank before anyone will talk to you.
| ISO / MSP | Payment facilitator | Acquirer-processor | |
|---|---|---|---|
| Holds the merchant agreement | The sponsoring acquirer | You, on a sub-merchant agreement | You, or the acquirer you process for |
| Underwrites the merchant | The acquirer | You, within the acquirer's rules | Depends on the model |
| Absorbs unrecovered chargebacks | The acquirer, with recourse to you | You, first and in full | Per contract |
| Network registration | Registered ISO/MSP, sponsored | Registered PayFac, sponsored | Registration plus certification |
| Time to first live merchant | Months | Months to a year | Years |
| Capital requirement | Low | Moderate to high | High |
The mistake most founders make is choosing the label before understanding the liability. PayFac is the fashionable answer, and it is the one that puts your own balance sheet directly behind merchant fraud.
Registering as an ISO or MSP, and what sponsorship really is
ISO is Visa's term, MSP (Member Service Provider) is Mastercard's, and American usage collapses them into one thing: a registered ISO/MSP. Registration is not something you apply for directly. Only a member bank of the network can register you, so the first thing you need is not a business plan but a sponsor.
Sponsorship is the whole gate. The bank underwrites you, not just your merchants, because network rules make the sponsoring member answerable for its registered agents. Expect diligence on your principals, your capitalization, your target verticals, your BSA/AML program and your ability to indemnify the bank. High-risk verticals make this harder rather than impossible: Durango Merchant Services discloses that it is a registered ISO for Fifth Third Bank, N.A., and specializes in exactly the categories mainstream acquirers decline.
Registration is per network, carries an initial and an annual fee set by each network, and puts you on a public list. Network rules also require a registered ISO to disclose its sponsoring member, which makes a useful diagnostic on competitors: CardConnect names Citizens Bank, KeyBank, Pathward, PNC and Wells Fargo on its own About page, while PaymentCloud publishes no ISO/MSP disclosure and no sponsor bank at all.
What the route buys is speed and low capital intensity. What it costs is control: the bank owns the merchant agreement, the processor owns the boarding platform, and you own a sales function whose economics live inside a contract you did not draft.
The payment facilitator route and the liability you are buying
A payment facilitator holds a single master merchant account with an acquirer and boards its own customers underneath it as sub-merchants. This is the model behind every platform that lets a business start accepting cards in minutes rather than days, because the facilitator has pre-cleared the underwriting question on its own paper.
Two things follow, and only one is fun. You control onboarding, pricing and the customer relationship. And when a sub-merchant takes deposits for goods it never ships and vanishes, the chargebacks land on you. A PayFac is structurally an underwriting and risk business wearing a software company's clothes. Any founder who models the spread between what sub-merchants pay and what the acquirer charges, without modeling fraud loss and reserves, is modeling the wrong business.
Registration works as it does for an ISO: a sponsoring acquirer submits it, and you inherit rule obligations covering sub-merchant screening, ongoing monitoring, and network-set limits on how much volume a sub-merchant may do before it must be contracted directly with the acquirer. Those thresholds sit in the network rules and have been revised over time; read the current edition rather than a blog post.
The practical alternative is renting someone else's registration. Rainforest holds the acquiring relationship for its platforms, sponsored by First Citizens Bank & Trust and JPMorgan Chase. Payrix, now marketed within Worldpay for Platforms, sells both shapes: platforms under Payrix's registration with Payrix carrying underwriting and risk, and platforms already registered as facilitators that want more of the margin. The trade never changes — basis points in exchange for not holding the risk, the registration or the reserve.
Becoming an actual processor is a different order of problem
Processing means running the authorization, clearing and settlement path yourself: certified network connections, message formatting, reconciliation logic, settlement files, chargeback processing, and the discipline to do it daily without dropping transactions. Certification alone is a multi-quarter engineering project with a fixed test script and no shortcuts.
Not impossible for a new company, but the timeline runs in years. Finix is the instructive case: founded in the mid-2010s, it did not become a registered acquirer-processor with direct connections to Visa, Mastercard, American Express and Discover until May 2023, with Pathward as its bank partner. Helcim's founder has described three years spent building the internals, and Helcim is still a registered ISO/MSP relying on member-bank sponsorship — because sponsorship and ultimate acquiring risk sit with a bank whatever software you have written.
The only route that removes sponsorship entirely is owning the bank. Elavon illustrates it: because U.S. Bank is both the acquiring member and the corporate parent, sponsor and processor are the same group — precisely what non-bank acquirers are renting when they pay for sponsorship.
Money transmitter licensing, state by state, and what it costs in time
This is where most business plans quietly break. Whether you need money transmitter licenses turns on one question: do you take custody of funds that belong to someone else?
Classic card acquiring generally does not: funds move from the issuer through the networks to the acquiring bank and settle to the merchant, and the ISO never touches them. The money transmitter definition at 31 CFR 1010.100 excludes payment processors that facilitate purchases or bill payments, act under a formal agreement with the seller or creditor, operate through clearance and settlement systems admitting only BSA-regulated financial institutions, and settle for goods or services rather than transmitting money as the product itself. All four conditions must hold. Break one — usually by settling into your own account and paying merchants out of it, or by adding payouts, wallets or stored balances — and the exclusion stops applying.
The federal piece is the cheap piece: an MSB registers with FinCEN on Form 107 within 180 days of being established and renews every two years. State licensing is the expensive piece. Money transmission is licensed state by state across roughly fifty-odd US jurisdictions once the District of Columbia and the territories are counted, filed through NMLS, with each state setting its own minimum net worth, surety bond, permissible-investment rules, background checks and AML requirements. The Money Transmission Modernization Act from the Conference of State Bank Supervisors has harmonized much of this across adopting states, but harmonized is not single.
Plan the calendar, not just the budget. A near-nationwide footprint is a multi-year program, not a filing. Review times run from months to more than a year, states queue behind each other, and every change of control reopens settled questions. Hundreds of thousands of dollars across counsel, bonds and audited financials is a realistic order-of-magnitude planning figure — a floor, not a quote.
So most new entrants either design the money movement so the exclusion applies, or sit under a partner that already holds the licenses. Stripe holds state money transmitter licenses through Stripe Payments Company; Dwolla exists largely so platforms can move money over bank rails without registering as transmitters themselves. Note what is not published, too: neither Dwolla nor Moov lists an NMLS identifier on its website, a reminder to ask for licensing detail in diligence rather than assume it.
PCI DSS is a condition of doing business, not a badge
Any entity that stores, processes or transmits cardholder data falls under the PCI Data Security Standard, and service providers face a stricter validation regime than merchants. The standard is in its 4.x line, and the future-dated requirements introduced with version 4.0 became mandatory in March 2025 — confirm the current revision against the PCI Security Standards Council document library rather than trusting a summary.
Validation depends on volume and role. Service providers above the network-set transaction threshold have historically undergone an annual on-site assessment by a Qualified Security Assessor producing a Report on Compliance; smaller ones may self-assess. Validated status is frequently a precondition of sponsorship, because your sponsor bank inherits your failures.
The commercially important move is scope reduction. Point-to-point encryption and tokenization keep raw card data out of your systems, shrinking the assessment, the breach surface and the annual bill at once — CardConnect markets CardSecure as a PCI-validated P2PE and tokenization solution for exactly that reason. The mistake most new processors make is treating PCI as an annual audit to survive rather than an architecture decision, made once and early, that sets the cost of every year after.
Residuals, portfolio economics, and who actually owns them
Residuals are the recurring share of processing revenue an ISO or agent earns on the merchants it boards, paid for as long as those merchants keep processing. They are the entire asset value of a sales-led payments business, and the terms governing them are drafted by the party that pays them.
Two structures dominate. Under a buy rate, the processor quotes a wholesale cost and you keep whatever you can price above it. Under a revenue share, you split defined revenue at a stated percentage. Buy rate rewards pricing skill and punishes portfolios with volatile interchange mix; revenue share is more predictable and caps your upside. Neither is inherently better, but only one makes your margin transparent to the processor.
The clauses that decide whether you own an asset or a job deserve more scrutiny than the headline split:
- Survival on termination. Do residuals continue if you stop selling, or if the agreement ends for convenience?
- Vesting and minimums. Conditioning residuals on continuing production turns an asset into a treadmill.
- Portability. Can you move the portfolio, and on what notice? Without portability you cannot price-shop, and market value collapses.
- Assignment. Can you sell or pledge the stream, and does the processor hold a right of first refusal at a formula price?
- Offset. What losses may be deducted from your residuals, and is there a cap?
- Audit. Can you inspect the calculation? Residual reports are opaque by default.
Portfolios trade on a multiple of monthly residual, adjusted for attrition, concentration and vertical mix, which makes attrition the number to manage: a portfolio bleeding merchants is worth materially less per dollar of current residual than a stable one of the same size. Residual management is enough of a discipline to be its own product category — NMI acquired IRIS CRM specifically for merchant lifecycle and residual management for ISOs.
Which of these routes is realistic for a new entrant in 2026
An honest assessment, given how consolidated acquiring has become.
Becoming a processor is not realistic unless you are funded to spend years before first revenue and have a specific reason the incumbent stacks cannot serve you. Fiserv, Global Payments and Worldpay, and FIS have absorbed most of the independent processing estate, and recent successful entrants took the better part of a decade to reach direct network connectivity.
Registering as a payment facilitator from a standing start is rarely the right first move. The registration is obtainable; underwriting competence, fraud tooling, reserve capital and risk staffing are what actually gate it. Most platforms that should eventually be facilitators are better off launching on someone else's registration, learning their own loss curve with real merchants, and migrating later — which is why PayFac-as-a-service exists and why its providers compete on portfolio migration and data portability.
The ISO route remains genuinely open, on one condition: you have distribution the incumbents do not. A generic ISO reselling generic processing, into a market where a merchant can self-onboard in ten minutes, has no reason to exist. ISOs with a vertical, a software integration, an underserved risk category or a real service capability are still being built and still being sold. Durango has survived two decades on high-risk underwriting; North built a top-ten non-bank acquirer by buying processors, gateways and POS companies and running them as one platform.
The sequence that works is boring. Pick a vertical. Get sponsorship, or ride a facilitator's. Board merchants. Learn the loss curve. Negotiate residual terms as though you intend to sell the portfolio, because one day you will. Take on registration, licensing and processing infrastructure only when the volume you already control makes owning them cheaper than renting. Founders who reverse that order buy infrastructure first, then go looking for merchants to justify it.
Frequently asked questions
Do I need a money transmitter license to start a payment processing company?
Not always. Traditional card acquiring, where funds settle from the acquiring bank to the merchant and the ISO never takes custody, generally falls within the federal payment processor exclusion from the money transmitter definition. You typically do need licensing once you take custody of other people's funds, settle into your own account and pay merchants out of it, or add payouts, wallets or stored balances. Money transmission is licensed state by state through NMLS, and a near-nationwide footprint is a multi-year program.
What is the difference between an ISO and a payment facilitator?
An ISO sells and services merchant accounts that a sponsoring acquiring bank underwrites and owns, so the bank holds the merchant agreement and carries the primary loss. A payment facilitator holds one master merchant account and boards its customers underneath it as sub-merchants on its own paper, which means it controls onboarding and pricing but absorbs sub-merchant chargebacks and fraud losses directly. Both roles must be registered with the card networks through a sponsoring member bank.
Can I register directly with Visa and Mastercard?
No. Registration as an ISO/MSP, payment facilitator or service provider is submitted on your behalf by a bank that is a licensed member of the network, and that bank accepts responsibility to the network for your conduct. Finding a sponsoring acquirer is therefore the first gate, not a later formality, and the bank will underwrite your principals, capitalization, target verticals and AML program before it agrees.
How much capital do you need to start a payment processing company?
It depends entirely on the model. An ISO selling under a sponsor's registration can start with working capital for sales and service. A payment facilitator needs reserves and loss-absorption capacity because sub-merchant fraud lands on its balance sheet. Building an acquirer-processor requires funding a multi-year engineering and certification program before the first transaction, and pursuing state money transmitter licensing adds bonds, minimum net worth, audited financials and counsel as standing costs.
Who owns the residuals in an ISO agreement?
Whoever the contract says, which is usually not the default you assume. The decisive clauses are whether residuals survive termination, whether they vest or depend on continuing production, whether you can move or sell the portfolio, what losses the processor may offset against them, and whether you have an audit right over the calculation. Portfolios trade on a multiple of monthly residual, so those clauses determine whether you have built an asset or a job.
Is PCI DSS compliance required for a payment company?
Yes, for any entity that stores, processes or transmits cardholder data, and service providers face stricter validation than merchants. Larger service providers generally undergo an annual assessment by a Qualified Security Assessor producing a Report on Compliance, while smaller ones may self-assess. Sponsor banks commonly make validated compliance a condition of the relationship, and using point-to-point encryption and tokenization to keep raw card data out of your systems is the single most effective way to reduce both the assessment scope and the cost.
Is PayFac-as-a-service better than becoming a registered payment facilitator?
For most new platforms, yes, at least initially. Running sub-merchants under an existing facilitator's registration and sponsorship removes the registration, reserve and underwriting burden while you learn what your actual loss curve looks like with real merchants. You give up basis points for that, so the economics favor migrating to your own registration later, once volume makes the fixed costs of registration and risk operations cheaper than the margin you are surrendering.