Transaction laundering is when a shop accepts payments on behalf of another, often illegal, business. A payment company usually finds out when the other business’s money is already flowing through its merchant. At that point the contract is the main tool. It decides whether you can stop payouts, hold funds, end the relationship and recover a fine. Visa and Mastercard set a minimum list of terms and say plainly that a missing clause does not relieve the acquirer of responsibility. We explain in plain words what the agreement must contain, which terms close this particular scheme and what changes when you work through a PayFac or a marketplace. We checked the conclusions against the scheme rules and the public agreements of Adyen, Stripe, Checkout.com and Nuvei.
Checked on 22 October 2026. Rules and sources are current as of this date.
Why the agreement decides this
The merchant breaks the rules, but the acquirer answers to the card scheme. So the agreement should let you act before a claim arrives.
The acquirer stays responsible
Mastercard requires the agreement to contain a set of mandatory terms (Rule 5.1.2). If something is missing, the acquirer still answers for chargebacks and compliance. The agreement also cannot limit the acquirer’s responsibility. Before signing and renewing, the acquirer must check that the merchant runs a real business.
What laundering means for Mastercard
It is a situation where a merchant processes payments for another business that has no agreement with the acquirer or PayFac (Mastercard Rules, 7.1). The MATCH (Mastercard’s list of terminated merchants) database has a separate reason code 03 for it. So the agreement defines whose payments you may process.
Visa requires a ban on laundering
The mandatory terms of a Visa merchant agreement include a ban on transaction laundering, as well as on resubmitting disputed payments, fraud and data security breaches (VARS, AACQ.C2.1). Agreements signed from 21 October 2024 must refer to VARS.
What the schemes require in the agreement
Below is the mandatory minimum and what the schemes only recommend. Visa terms come from VARS (October 2024), Mastercard terms from the Mastercard Rules of 2 June 2026.
| Term | Visa | Mastercard |
|---|---|---|
| Law and scheme rules | The merchant follows the law, the Visa rules and the acquirer’s policy (AACQ.C2.1) | The agreement repeats the substance of the main Mastercard rules for merchants, such as acceptance, prohibited practices and use of the Marks (Rules 5.5 through 5.15, see 5.1.2) |
| Illegal transactions | The merchant does not knowingly submit illegal transactions and helps with investigations (AACQ.C2.1) | The merchant does not submit transactions that are illegal or damage the brand (5.12.7) |
| Ending acceptance | The acquirer may revoke card acceptance if the merchant’s conduct harms Visa. The merchant is notified in writing (AACQ.C2.1) | The acquirer does not limit its right to terminate (7.6.4). The Marks cannot be used after termination (5.1.2) |
| Reserves and holds | The agreement has a clause on reserves and holds, and the reserve is kept as security (AACQ.C3.1) | The agreement may allow funds to be held as a chargeback reserve (5.4.1) |
| Settlement | Payout without delay, net of refunds, disputes, fees and reserves (AACQ.C4.1) | The duty to pay is met only when the merchant has received the money (5.4.1) |
| MCC (merchant category code) and identifiers | The MCC that best describes the business and consistent merchant identifiers (AACQ.C5.1, C13.1) | Sponsored merchants report their addresses, trade names and a description of goods (7.8.1.1) |
| Records | Agreements are kept and produced on request | The acquirer can quickly find signed agreements and gives copies to Mastercard on request (7.6.3) |
Clauses that address laundering directly
The rules set a minimum. Against a scheme that uses other people’s payments, you need clauses that make it a breach and let you respond at once. Some follow directly from scheme rules and some are market practice.
Own goods and services only
The merchant accepts payments only for its own goods and services and does not process payments for others. Visa’s monitoring requirements (ATPA.C8.1) note that banning sales for another business’s goods and services lowers the risk of laundering.
A closed list of sites and apps
The merchant names all its sites, apps and payment pages and reports new ones in advance. For sponsored merchants Mastercard requires addresses and a description of goods (7.8.1.1), and the monitoring programme assumes checking every site address, including the payment page (SPME 8.9.1). Visa expects the acquirer to check regularly that the site sells what it claims and the cart works (AACQ.C17.1).
Checks, documents and test payments
A right to ask for supply documents, visit the site and make a test payment. Visa separately requires data security inspections to be agreed (AACQ.C14.1). The rest is practice.
Suspending payouts and holding funds
If illegal activity is found, the acquirer must hold the funds available for settlement, but first confirm that the agreement allows it (Visa, AACQ.C8.3). For European acquirers Mastercard advises suspending payouts when warning signs appear (SPME 6.2.2.8). So write the right to suspend payouts so that it does not wait for the outcome of a review.
Immediate termination
A right to terminate without a notice period on suspicion or at the scheme’s request. Mastercard expressly requires this right for sponsored merchants (7.8.1.1), and Visa requires the acquirer’s right to revoke acceptance.
Recovery of fines and losses
Scheme fines are assessed on the acquirer. For breaching the illegal transactions rule Mastercard can assess USD 200,000 or USD 2,500 a day (5.12.7). You cannot pass responsibility to the scheme, but the agreement can let you claim the money back from the merchant.
Data sharing and a warning about registers
A right to share merchant data with the card schemes and a warning that a merchant terminated for cause will be listed in Visa’s Terminated Merchant File (VMSS) or Mastercard’s MATCH. The acquirer must attach the merchant’s application and agreement to its reply in a BRAM (Mastercard’s Business Risk Assessment and Mitigation program) case.
The schemes’ rules name the ban on laundering, the right to revoke acceptance, the reserve and hold clause, the MCC and records. A closed list of sites, test payments and recovery of fines are practice. How it looks at large processors is shown below.
For gambling merchants Mastercard requires further terms (5.1.2.1): a notice on the site, a ban on selling chips usable elsewhere, a ban on crediting winnings as refunds and authentication data in the authorisation. We covered this in our article on illegal gambling through other businesses’ card payments.
How this is written in real agreements
We checked the scheme rules against public agreements read on 22 October 2026. These are the Adyen terms, the Stripe Services Agreement, the Checkout.com Sub-Merchant Terms and the Nuvei and Wells Fargo form agreement (2018 edition). Law firm pages on this topic turned out to be promotional and do not analyse specific clauses, so we relied on the texts themselves and on Visa’s guide for PayFacs and marketplaces.
Payments for third parties
All four texts forbid this, but none uses the word laundering. Adyen does not allow payment for third parties’ goods without its approval (cl. 2.1). Stripe forbids acting as an intermediary without added value (cl. 1.2(a)(viii)). Nuvei forbids submitting another merchant’s transactions (cl. 2.13), and Checkout.com forbids submitting transactions on behalf of a third party. Visa’s guide for PayFacs and marketplaces asks agreements to forbid any transaction that does not arise from a deal between a buyer and a seller.
Suspension and reserves
Adyen may withhold money it suspects to be fraudulent or illegal until an investigation ends (cl. 2.6) and keeps a reserve (cl. 6). Nuvei may suspend payouts for a reasonable time (cl. 5.1) and set up a reserve without notice, including when chargebacks exceed 1% in 30 days (cl. 3.5). Stripe may suspend access at once and hold a reserve as security (cl. 10.1 and 12). Visa’s guide allows settlement to be suspended during an investigation.
Fines and registers
Adyen may set off scheme fines against payouts (cl. 2.7 and 3.6). At Stripe, fines are outside the limit on liability (cl. 8.4). Nuvei requires the merchant to reimburse fines and deducts them from settlement (cl. 5.3), and on termination the merchant agrees in advance to a MATCH listing (cl. 4.4). We found no such consent in the other texts.
On the main points the market agrees. Payments for others are forbidden, payouts can be suspended, the agreement ends at once and the merchant reimburses fines. Large processors write these terms for themselves, so for a small PSP (payment service provider) they are a base, not a ready template. Add a closed list of sites and consent to registers on top.
If you work through a PayFac, ISO or marketplace
The chain of contracts is longer, but responsibility is the same. The acquirer answers for the PayFac and the sponsored merchant (Mastercard, 7.6.5). We explained how the roles are split in our article on PayFacs, aggregators and ISOs.
Sponsored merchant agreement
The PayFac signs it as the acquirer’s agent. It must not stop the PayFac, the acquirer or Mastercard from ending it at any time (7.8.1), and it ends automatically if Mastercard removes the PayFac from the register or the acquirer stops being a member (7.8.1.1).
PayFac agreement under Visa
The PayFac signs an agreement with each sponsored merchant and answers for it. The acquirer may terminate at once, and a PayFac does not process payments for another PayFac (AACQ.C1.2, VARS). With a merchant whose annual volume exceeds USD 1 million the acquirer signs a direct agreement.
Marketplace
The agreement obliges the marketplace to sign with each seller before processing and gives the acquirer the right to stop payments for a particular seller (Visa, ATPA.C1.3). Mastercard requires platforms to collect information on the seller and its owners, verify it, comply with AML (anti-money laundering) and sanctions rules and end the agreement without notice if the seller knew or should have known that a sale was fraudulent (5.1.2.2).
Control does not pass to a provider
The acquirer signs the agreement. There must be no separate agreement between a service provider and the merchant, the provider gets no access to the merchant’s funds and the acquirer does not limit its right to terminate for the provider’s sake (7.6.1 and 7.6.4).
What an agreement does not replace
Good terms work only together with checks and a quick response.
A gap in the agreement does not remove responsibility
Mastercard says plainly that a missing clause does not relieve the acquirer of responsibility (5.1.2). Fix the agreement before an incident.
Monitoring is needed
An acquirer that does not take part in transaction laundering monitoring gets no reduction of fines for such breaches (SPME 8.9.3). We wrote more about monitoring and the signs of the scheme in our article on transaction laundering and miscoding.
Time decides
In a BRAM case the acquirer has two business days to respond if law enforcement started the case, and five in other cases. If the breach is stopped within two business days, the fine may be reduced. The agreement must let you meet the deadline, and the company must know who decides on suspension.
We will review your situation and propose a solution for your project.
Case analysis
A PSP onboards an online home textiles shop. Three months later turnover is three times the declared figure, amounts repeat and the payment page leads to a site with real-money games. If the agreement has the right clauses, the PSP acts step by step. First it suspends payouts and asks for supply documents and a list of all sites. Then it makes a test payment and compares the site with the declared MCC. If the mismatch is confirmed, it terminates without a notice period, claims chargebacks and fines back and reports to the registers, as the merchant was warned in advance. Without these clauses every step would have to be fought.
What to do now
Check agreements against the scheme minimum
Compare your current agreements with the table above, including the reference to VARS in agreements from 21 October 2024.
Start hereAdd an own-goods clause
Ban accepting payments for third parties and for goods fulfilled by another business.
Introduce a register of sites and apps
The merchant reports new sites, payment pages and DBA (doing business as, the trading name) names in advance.
Write in a right to suspend payouts
A right to suspend payouts and hold funds on suspicion, without waiting for the result of a review.
Record your checks
A right to request documents, review the site and make a test payment.
Agree on fines and registers
Recovery of fines and losses, reserves and a warning about listing in VMSS and MATCH.
Clauses give you the right to act, and monitoring shows when to use it. One without the other leaves the acquirer exposed.
An agreement will not stop an illicit merchant, but it decides how much time you have to stop it yourself.The LegalBit team
Frequently asked questions
Must the agreement expressly ban transaction laundering?
For Visa, yes, such a ban is among the mandatory terms (VARS, AACQ.C2.1). Mastercard has no separate clause under that name, but the agreement must repeat the rules on prohibited practices and valid transactions (5.12 and 5.13). It is best to write the ban in any case.
Can the agreement limit the acquirer’s responsibility to the scheme?
No. Mastercard requires that the agreement contain no terms limiting the acquirer’s responsibility (5.1). The agreement can let you claim money back from the merchant, but the acquirer answers to the scheme.
Can funds be held during a review?
Visa requires holding the funds available for settlement if illegal activity is found, but only if the agreement allows it (AACQ.C8.3). Mastercard allows holding funds as a chargeback reserve (5.4.1). So write the right to hold funds into the agreement, and its limits also depend on local law.
Is a separate agreement needed with each sponsored merchant?
Yes. The PayFac signs with each sponsored merchant, and the agreement must meet the scheme rules (Mastercard, 7.8.1, Visa, AACQ and ATPA.C1.2). If the merchant’s annual volume exceeds USD 1 million, Visa requires a direct agreement with the acquirer.
What happens to a merchant terminated for laundering?
A merchant terminated for its own fault is listed in a Visa register (Terminated Merchant File, for example VMSS), and Mastercard has reason code 03 in the MATCH database. MATCH records are kept for five years, and that usually stops a new acquirer from taking the merchant on.
Is a good agreement enough to avoid fines?
No. An agreement gives rights but does not replace onboarding checks and monitoring. An acquirer without transaction laundering monitoring gets no reduction of fines for such breaches (SPME 8.9.3).
See also: Transaction Laundering and Miscoding; Payment Facilitators, Aggregators and ISOs: Who Is Responsible for Sub-Merchants; Illegal Gambling Through Other Businesses’ Card Payments; KYC and KYB for Payment Providers; How banks block fintech startup accounts and how to avoid it. Services: lawyers for fintech and payment services.
- Visa: Visa Acceptance Risk Standards (VARS), October 2024
- Mastercard: Mastercard Rules (2 June 2026 edition)
- Mastercard: Security Rules and Procedures, Merchant Edition (4 August 2026 edition)
- Visa: Payment Facilitator and Marketplace Risk Guide
- Adyen: Adyen Terms and Conditions
- Stripe: Stripe Services Agreement, United States
- Checkout.com: Sub-Merchant Terms
- Nuvei and Wells Fargo: Merchant Agreement, 2018 edition
This is what we do
How we help payment and fintech companies:
