Five words for five different businesses
Payment facilitator, ISO, merchant of record, aggregator and PayFac-as-a-service get used as if they were synonyms for one thing: a company standing between a business and the card networks. They are not synonyms. They describe five different legal and commercial positions, and the difference decides who loses money when a customer disputes a charge, whose name appears on the cardholder's statement, and who can close an account overnight.
The vocabulary is muddled partly because one company can occupy several positions at once. Stripe is a payment facilitator for most of its merchants and sells facilitator-like infrastructure to platforms through Connect. Fiserv is an acquirer, and also the parent of CardConnect, a registered ISO. The label on the website tells you less than the contract does.
The mistake most software companies make here is choosing a model from a pitch deck rather than from a risk register. Four questions separate the five terms cleanly.
The four questions that separate them
Any arrangement in card acceptance can be located by asking who performs four functions. Who underwrites — who assesses whether this business is legitimate and solvent, and accepts being wrong. Who holds the merchant account — whose merchant identification number (MID), the account number an acquiring bank uses to identify a merchant to the card networks, do transactions settle under. Who is liable for a chargeback — when the cardholder wins and the sub-merchant has no money, whose balance sheet absorbs it. Who is the legal seller — who contracted with the buyer, owes the refund, and is registered for the sales tax.
| Model | Underwrites | Holds the MID | Bears unrecoverable chargebacks | Legal party to the sale |
|---|---|---|---|---|
| ISO | Acquirer | Each merchant, individually | Acquirer, with contractual recourse to the merchant; some ISOs carry loss-sharing | The merchant |
| Payment facilitator | The PayFac | The PayFac (master MID) | The PayFac | The merchant |
| Aggregator | The aggregator | The aggregator | The aggregator | The merchant |
| Merchant of record | The MoR (of its suppliers) | The MoR | The MoR, usually with contractual pass-through to the supplier | The MoR itself |
| PayFac-as-a-service | The provider, or shared | The provider, unless the platform is itself registered | The provider, with recourse to the platform | The merchant |
Notice that only one row changes the answer to the fourth question. That is the most consequential distinction on this page, and the one most often lost.
Sponsorship: the relationship that makes a PayFac possible
A payment facilitator is not a licensed institution. It operates inside the permissions of a sponsor: an acquiring bank that is a principal member of the card networks, which registers the facilitator with Visa and Mastercard, submits its transactions, and stays answerable for everything the facilitator and its sub-merchants do. Sponsorship is why a PayFac can exist without a banking license — and why it can be shut down without notice. The networks enforce against the member bank, and the member bank enforces against the facilitator.
Sponsor relationships are visible if you look. Rainforest names First Citizens Bank and Trust Company and JPMorgan Chase Bank, N.A. as its sponsor banks. Moov's merchant processing terms name Pathward and Lincoln Savings Bank as the acquirers sponsoring it as a third-party agent. Finix names Pathward as its bank partner and has held direct registered acquirer-processor connections since 2023. Payrix settles through Worldpay's acquiring licenses — a materially different proposition from a startup's single sponsor bank, and exactly what it sells on.
Ask any prospective partner to name its sponsor bank and its network registration status in writing. A provider that will not put the sponsor's name in a contract is asking you to build a revenue line on a relationship you cannot inspect.
The networks also cap how large a sub-merchant may grow inside a master account. Above a published annual volume threshold, a sub-merchant is expected to hold its own direct merchant agreement. That threshold has been revised more than once, so check the current operating rules — and plan for your best sub-merchants outgrowing the model that acquired them.
What an ISO actually is
An independent sales organization (ISO) is a reseller. It is registered with the card networks through a sponsoring member bank, it sells merchant accounts, and it earns a residual — an ongoing share of the processing margin on the accounts it boarded — for as long as those merchants keep processing. What it does not do is issue the merchant account. Each merchant it signs gets its own MID under its own processing agreement, underwritten by the acquirer.
CardConnect states plainly that it is a registered ISO of Citizens Bank, N.A., KeyBank N.A., Pathward N.A., PNC Bank, N.A. and Wells Fargo Bank, N.A., with underwriting, risk and settlement sitting with Fiserv and those banks. Durango Merchant Services is a small Colorado ISO sponsored domestically by Fifth Third Bank, N.A. that places merchants mainstream acquirers decline. Helcim is registered as an ISO/MSP but built its own processing infrastructure behind that registration, which shows how far the label stretches.
The commercial consequence is slower onboarding and sturdier accounts. A merchant waits days for underwriting rather than minutes, but owns a MID no reseller can switch off unilaterally. For a business that would be crippled by a sudden hold on settlement, that is worth the wait.
Aggregation: the older word, and what it costs the merchant
Aggregator was the original term for what the networks later formalized as payment facilitation. It survives mainly as a description of the merchant-facing experience: many small sellers sharing one master merchant account, boarded in minutes on a light-touch application, with the aggregator carrying risk it had no time to assess. Square, PayPal and Stripe all work this way for most of their small-business customers. The seller never obtains its own MID.
Speed is the product. The cost is that every control an aggregator needs to survive the model points the same direction: reserves, rolling holds on settlement, account limitation, unilateral termination. Square's risk position is the basis for both its instant onboarding and its ability to hold funds or deactivate a seller. Shopify Payments reserves the right to close an account at any time, for any reason, on notice, and passes chargeback liability to the merchant by indemnity.
None of this is misconduct; it is the arithmetic of underwriting a business in ninety seconds. The mistake merchants make is treating an aggregated account as equivalent to a merchant account because the checkout looks the same. It is not, and the difference becomes visible only on the day the money stops.
Merchant of record is a legal position, not a payments product
A merchant of record (MoR) does something none of the other four models do: it buys and resells the product. Paddle's master services agreement makes the structure explicit — the software vendor supplies the product, but Paddle contracts with the end customer, takes the payment, issues the invoice, and is the seller on the record. The vendor cannot invoice the buyer directly. Because Paddle is the seller, it carries sales tax, VAT and GST registration and remittance in the jurisdictions it sells into, decides refunds, and defends chargebacks — while contractually passing the cost of those chargebacks back to the vendor.
That last clause is the one people miss. Merchant of record moves the legal liability; the economic liability often travels back to you by contract. Read the indemnity before assuming you have bought protection.
What you have genuinely bought is tax compliance. A software business selling into forty countries faces registration thresholds, filing calendars and rate changes in each; an MoR absorbs that whole function. This is why an all-in MoR rate sits well above a bare card-processing rate, and why comparing the two as competing prices is a category error. One is a payment fee; the other is a payment fee plus an outsourced tax department, buyer support and fraud liability.
PayFac-as-a-service: renting the registration
PayFac-as-a-service is what the market built once it was clear that most software companies wanted the economics of facilitation without the licensing, capital and staffing. The provider holds the registration, the sponsorship and the master merchant account; the platform gets an API for sub-merchant onboarding, split funding and payouts, sets the pricing its merchants see, and keeps the spread over a negotiated buy rate.
There is real variety inside the category. Payrix — now marketed as Worldpay for Platforms — sells both a managed shape, where it carries underwriting and risk, and a shape for platforms that already hold their own registration and want more margin. Finix charges for software and per transaction rather than a percentage of platform volume, which changes the economics as a portfolio scales. Rainforest competes on platform margin, on migrating an existing portfolio off an incumbent with minimal re-onboarding, and on contractual data portability. Stax Connect and NMI sell comparable programs into the ISO and ISV channel.
Two contract terms decide whether these deals age well. Portability: can you take your merchant records, transaction history and tokens with you, and is that right written down? Stability: Payrix has changed corporate owner three times since 2022 and retired its own brand in 2025 — a reminder that the counterparty you sign is not necessarily the one servicing you in five years.
What a PayFac must actually do to a sub-merchant
Becoming a facilitator means inheriting a compliance function, not just a revenue line. The obligations are continuous, and the sponsor bank enforces them long before the networks get involved.
- Know your business. Verify the legal entity, its beneficial owners, its principals and its actual line of trade — not the line of trade on the application form.
- Screen against sanctions and the terminated merchant file. Applicants must be checked against OFAC lists and the industry file of previously terminated merchants Mastercard operates — repeatedly, not once.
- Underwrite delivery risk, not just credit risk. The exposure in card acceptance is the gap between payment and fulfillment. A business taking deposits months before delivering is a far larger risk than its balance sheet suggests.
- Monitor continuously. Watch for volume spikes, average-ticket drift, refund abuse and transaction laundering — a sub-merchant running someone else's payments through its own account, the fastest route to losing a sponsorship.
- Own PCI scope and disputes. The facilitator answers for its sub-merchants' security posture and for keeping the portfolio out of the networks' excessive-chargeback programs.
- Fund correctly. Settlement must reach the right sub-merchant on the disclosed timetable, with reserves applied under a documented policy rather than by improvisation.
Every bullet is a person, a system, or both. Model them as headcount before modeling the revenue.
The point at which becoming a PayFac stops being worth it
Full facilitation earns its keep in one situation: the payment margin retained exceeds the fully loaded cost of retaining it, with headroom to absorb a bad year. Revenue scales with volume. Cost mostly does not — network registration and annual renewal, a PCI DSS Level 1 assessment, a sponsor relationship with its own diligence cycle, underwriting and risk staff, dispute operations, settlement engineering, and reserves against portfolio losses. Those are largely fixed, which is why the model punishes at small scale and compels at large scale.
Work it as arithmetic. Take a hypothetical platform whose merchants process $40m a year through it. If moving from revenue share to its own registration improved retained margin by, say, 20 basis points, that is $80,000 a year of additional gross margin — before a single hire. A serious risk and compliance function costs more than that, so the answer is no. Run the same calculation at $400m and the gain is $800,000, and the answer changes. The break-even is not a volume number anyone can quote you; it is your fixed cost divided by your margin uplift.
Three failure patterns recur. Platforms model the uplift and not the loss line, then meet their first serious fraud event with no reserve. Platforms underestimate support, discovering that payment questions reach their helpdesk regardless of whose registration the funds moved under. And platforms sign exclusive multi-year agreements with no portability clause, turning a later pricing negotiation into a migration they cannot afford to run. Before choosing a model, write down what happens to your merchants, your tokens and your settlement on the day you want to leave it.
Frequently asked questions
What is the difference between a PayFac and an ISO?
A payment facilitator holds its own merchant account with an acquiring bank and boards other businesses as sub-merchants underneath it, underwriting them and carrying their chargeback losses. An independent sales organization sells merchant accounts but does not issue them: each merchant it signs receives its own merchant identification number, underwritten by the acquirer, which also carries the risk. The practical difference is speed versus control — a PayFac can onboard a merchant in minutes, while an ISO merchant waits for underwriting but owns an account no reseller can switch off.
Is a merchant of record the same as a payment facilitator?
No. A merchant of record is the legal seller of the product: it contracts with the end customer, issues the invoice, and is the party registered to collect and remit sales tax, VAT or GST on the sale. A payment facilitator is never the seller — it facilitates payment for a merchant that remains the legal party to the transaction. Merchant of record providers such as Paddle typically absorb tax compliance and dispute handling, but many pass the economic cost of chargebacks back to the supplier by contract.
Does a payment facilitator need a banking license?
No. A payment facilitator operates under sponsorship from an acquiring bank that is a principal member of the card networks, and is registered with Visa and Mastercard through that sponsor. The sponsor remains answerable to the networks for the facilitator's conduct and its sub-merchants' conduct, which is why sponsor banks impose their own underwriting, monitoring and reserve requirements. Depending on how funds are held and moved, separate money transmission licensing may still apply.
Who is liable when a sub-merchant cannot pay a chargeback?
The payment facilitator. Under the facilitator model the sub-merchant has no direct merchant agreement with the acquiring bank, so when a dispute is lost and the sub-merchant has no funds and no assets to recover from, the loss lands on the facilitator's balance sheet. This is the single largest reason facilitators impose reserves, delay funding for higher-risk merchants and terminate accounts quickly. Under an ISO model the same loss sits with the acquirer instead.
What is PayFac-as-a-service?
PayFac-as-a-service is an arrangement in which a registered payment facilitator provides its registration, sponsorship, master merchant account and onboarding technology to a software platform, so the platform can board and monetize its own merchants without registering with the card networks itself. The platform sets what its merchants pay and keeps the spread over a negotiated buy rate. Providers in this category include Payrix, Finix, Rainforest, Stax Connect, NMI and Moov, and their commercial terms differ considerably in how the margin is split.
At what volume should a company become its own payment facilitator?
There is no universal threshold, because the answer is a company's own fixed cost divided by its own margin uplift. Registration, a PCI DSS Level 1 assessment, sponsor bank diligence, underwriting and risk staff, dispute operations and loss reserves are largely fixed costs, while the retained payment margin scales with volume. Most software platforms find that PayFac-as-a-service remains cheaper than full registration until portfolio volume is well into the hundreds of millions of dollars a year.
Can a sub-merchant grow too large for a payment facilitator?
Yes. The card networks set an annual processing volume above which a sub-merchant is expected to hold its own direct merchant agreement with an acquirer rather than remaining inside a facilitator's master account. That threshold has been revised more than once, so the current network operating rules are the only reliable source. Platforms should plan for their largest merchants eventually needing to be moved onto direct accounts.
Why can an aggregator freeze a merchant's funds so easily?
Because the merchant is a sub-merchant on the aggregator's own merchant account, the aggregator carries the loss if that business fails to deliver or attracts disputes, and it typically underwrote the business in minutes rather than days. Reserves, rolling holds, account limitation and unilateral termination are the controls that make instant onboarding survivable. Merchants who cannot tolerate an interruption to settlement should hold their own merchant identification number rather than trade under someone else's.