A payment company onboards many small sellers under one agreement with a bank. If one of them breaks the rules, it is not only the seller who answers. We explain in plain words how a PayFac (also known as a payment aggregator), an ISO and a marketplace differ, who is responsible to Visa and Mastercard for what, and when a seller needs a direct agreement with the bank. We also cover how to vet sellers, what contracts should say and whether a platform needs a licence in the EU. Everything is based on primary sources.
Checked on 22 October 2026. Rules and sources are current as of this date.
Who is who
Imagine a chain. An acquiring bank accepts card payments for businesses. Onboarding every small seller separately is inconvenient for it, so it works through an intermediary that brings sellers together under one agreement. The role of the intermediary decides who answers for the sellers.
Acquirer
A bank or other institution that accepts card payments for businesses and answers for them to Visa and Mastercard.
Payment facilitator (PayFac)
This is what the market usually calls a payment aggregator, so in the title and text these words mean the same role. It signs agreements with sellers on the acquirer’s behalf and receives the money for them. It is registered with Visa.
Sub-merchant
A small seller onboarded by a PayFac. Mastercard calls it a sponsored merchant. The PayFac signs the agreement for the acquirer, but all card scheme requirements apply as if the seller had contracted with the acquirer directly.
ISO
An intermediary of the acquirer that finds and services sellers. It does not receive the money, and the seller contracts directly with the acquirer. It is registered as a Third Party Agent.
A marketplace is a separate case. The platform itself contracts with the acquirer and receives the money for sellers, so its sellers are not sub-merchants of a PayFac. Mastercard calls this role a Platform Merchant (Rule 5.1.2.2). The platform must verify third-party sellers and their owners, sign a contract with each, monitor the legality of sales and answer for buyers’ disputes.
| Role | Who signs with the seller | Who receives the money | Mastercard term |
|---|---|---|---|
| PayFac | The PayFac on behalf of the acquirer | The PayFac | Payment Facilitator |
| Marketplace | The platform, with the acquirer | The platform | Platform Merchant |
| ISO | The seller, with the acquirer | Does not receive | ISO |
If a sub-merchant’s annual Visa sales exceed US$1,000,000, the acquirer must join its agreement, and the PayFac may continue to service the seller. Mastercard sets a higher threshold of US$10,000,000 in combined Mastercard and Maestro volume (Rule 7.8). There are exceptions. A direct agreement is not needed if enhanced control conditions are met, for example the PayFac is registered as a Network Enablement Partner, the acquirer has access to its systems and reviews at least 5% of newly onboarded sellers every month. It is also not needed for sellers in certain industries, such as utilities, education, medical services and tax payments.
Who is responsible
The main rule is the same for Visa and Mastercard. Towards the card scheme, the acquirer answers for the PayFac and the sub-merchants. It then passes this responsibility down the chain.
Acquirer
Under Visa rules it answers for the acts and omissions of PayFacs, for harm caused by them and by their sellers, and may contract only with those it has screened for risk. Under Mastercard rules it answers for all acts and omissions of PayFacs and sponsored merchants and must ensure they follow the standards (Rule 7.6.5). It may let the PayFac handle some checks, but it stays responsible if the PayFac fails to do them (Rule 7.6.5.1).
PayFac
In effect extends unsecured credit to sellers. A seller receives money before delivering goods, and card disputes can usually be raised within 120 days, sometimes up to 540. If the seller cannot repay, the PayFac itself funds the disputes. Mastercard adds that the PayFac must pay the seller for all transactions, but the agreement may provide a chargeback reserve (Rule 7.8.2).
Sub-merchant
Its acts are treated as the acts of the PayFac, and the acts of the PayFac or the seller are treated as the acts of the acquirer.
If the violation is not stopped
An acquirer that does not stop a seller’s violation after Mastercard’s notice risks a Franchise Management Program review, an audit at its own expense and an assessment of USD 200,000 or USD 2,500 per day (Rule 5.12.7).
Contracts and checks should be built as a chain. Each link needs the right to check the one below it, to take security and to pass losses down.
Licensing in the EU
For a company in the EU, a separate question is whether it needs a payment institution licence. Article 3(b) of PSD2 (EU Payment Services Directive 2) excludes payments through a commercial agent authorised to negotiate or conclude the sale of goods or services on behalf of only the payer or only the payee.
A platform is not excluded by default
The European Banking Authority (EBA) keeps a public database of questions and answers on EU rules. Question 2020_5354 in that database was answered by the European Commission, which said that an e-commerce platform that receives payment on behalf of the payee is not excluded from PSD2 by default, even where the payment settles the payer’s debt to the payee. Such an exclusion would weaken buyer and seller protections and distort competition.
The business model is assessed
In the answer to question 2020_5355 from the same database, the Commission said that a B2C (business to consumer) platform (one that sells to consumers) may fall under the exclusion if it acts as an agent of the payee and not also on behalf of the payer. The competent authority assesses the business model, and PSD2 sets no criteria for this.
We covered licence types and capital requirements in the article on EMI and payment institution licences. The answers clarify existing provisions, and we do not cover PSD3 (proposed third EU Payment Services Directive) and the PSR (proposed EU Payment Services Regulation) here.
If you receive buyers’ money and pass it on to sellers, you cannot assume that the commercial agent exclusion will apply. It is better to confirm your position with the supervisor and not only internally.
We will review your situation and propose a solution for your project.
Sub-merchant due diligence
Both the PayFac and each seller are checked. We covered general approaches in the article on KYC and KYB, and here we show only what card scheme rules add.
How the acquirer checks the PayFac
It looks at financial responsibility, business practices, marketing and principal owners, carries out an onsite inspection and queries the database of terminated merchants (Visa Merchant Screening Service, VMSS). A senior officer of the acquirer signs the contracts, and Visa’s registration confirmation must be received before any transactions.
How a seller is checked
A written underwriting policy and an acquirer-approved agreement are needed. The seller must be financially responsible, must not harm the Visa system and must operate in an allowed jurisdiction. High-brand-risk sellers get enhanced due diligence and may be signed only by registered High-Risk Internet Payment Facilitators.
Whom you cannot onboard
You cannot onboard those listed on VMSS (Visa Merchant Screening Service, Visa’s database of sellers that previously lost card acceptance) or similar files. A PayFac cannot sponsor another PayFac, a staged digital wallet (one that is topped up first and then used to pay a seller) or person-to-person money transfers. Mastercard has similar limits (Rule 7.8).
Automated onboarding
Controls such as velocity checks and fraud detection are needed to screen out fraudulent applications.
What Mastercard adds
A seller must be located within the acquirer’s Area of Use, and the location of a transaction is the seller’s, not the PayFac’s. Funds the acquirer lets a PayFac access may be used only to pay sellers. Sellers in risky categories (Section 9.1 of the Security Rules and Procedures) and those previously reported under the Excessive Chargeback Program must be registered before transactions are accepted. For such sellers the PayFac must be approved by Mastercard as a Network Enablement Partner (Rules 7.6.5.1 and 7.8.3).
Monitoring
Checks do not end after onboarding. Visa describes ongoing monitoring as a required part of risk management, and Mastercard expressly requires a PayFac to monitor sellers’ activity and use of the marks (Rule 7.8.2).
What to track
Sales volume, average ticket, purchase returns, authorisation and decline counts, disputes, fraud advices and force-posted transactions.
Warning signs
Rounded amounts, micro-transactions, repeated sales on one card, dormant accounts with sudden spikes and load balancing between merchants.
Websites and transaction laundering
Seller websites are screened for illegal activity, transaction laundering and deceptive marketing. During an investigation, settlement funds may be held or moved to a reserve.
Mastercard reporting and identifiers
Each quarter the acquirer reports to Mastercard on every seller, with its name, location, website, MCC (merchant category code), and the number and amount of sales and chargebacks. The report is not needed if transactions carry the PayFac and seller identifiers (Rule 7.6.6), unless Mastercard requires otherwise. When an ISO is used, its identifier is passed too.
We wrote about transaction laundering in detail in our article. According to Visa, acquirers, PayFacs and marketplaces are held accountable for the illicit activity of their sellers. We covered the scheme of disguising gambling as another business separately.
Contracts
Each link in the chain must be fixed in a contract.
PayFac and acquirer
Services within the acquirer’s jurisdiction, registration with the card schemes, responsibility for sub-merchants, requirements for checks and reporting.
PayFac and sub-merchant
A ban on illegal transactions and compliance with card scheme rules and the law.
What Mastercard requires
The agreement must clearly show that the PayFac acts on the acquirer’s behalf, must not limit the right to terminate it at any time and must contain all the terms of an ordinary merchant agreement (Rule 7.8.1). These include current addresses and a description of the business, precedence of Mastercard standards over the agreement, automatic termination if the PayFac is deregistered and the right to terminate immediately for fraud (Rule 7.8.1.1). If the PayFac omits these terms, the acquirer is still responsible for chargebacks and compliance. We covered which clauses to include in our article on merchant agreements and protection from transaction laundering.
Case analysis
A payment facilitator onboards small businesses through automated onboarding. After a few months it turns out that some sub-merchants sell something other than what was declared, and one seller’s revenue is far above what was declared. The acquirer demands an explanation. A sensible order of action is to pause payouts to the problem sellers, check their sites and documents, revise the automated onboarding rules and monitoring thresholds, check whether the sales level that requires a direct agreement with the acquirer has been exceeded, and record the new terms in the contracts.
What to do
Start by understanding your role clearly, and build the rest from it.
Define your role
PayFac, marketplace or ISO, and who in your model signs the contracts and receives the money.
Start hereCheck your licensing status
Map the model to PSD2 and the commercial agent exclusion, and where in doubt ask for the supervisor’s position.
Describe underwriting
A written policy, admission criteria, prohibited categories and enhanced checks for high-risk sellers.
Set up monitoring
Indicators, thresholds, exceptions, owners and response times.
Bring contracts in order
The acquirer, PayFac, sub-merchant chain with a reserve, audit rights and pass-through of fines.
Prepare an incident plan
Suspension, reserve, notice to the acquirer and a record of decisions.
The more sellers are onboarded through one agent, the more important it is that responsibility is written into every link of the chain.The LegalBit team
Frequently asked questions
Is a PayFac the same as a payment aggregator?
Yes, in everyday terminology they are the same. The card schemes use the term Payment Facilitator.
How does a PayFac differ from an ISO?
A PayFac signs the merchant agreement with the seller on behalf of the acquirer and receives settlement for it. An ISO recruits and services sellers but does not receive settlement, and the seller signs with the acquirer.
Does a payment facilitator need a licence in the EU?
It depends on the model. If you receive money on behalf of sellers, the commercial agent exclusion cannot be assumed to apply automatically. The business model must be assessed and, where needed, confirmed with the supervisor.
Who pays for chargebacks?
If a seller cannot repay cardholders, the PayFac funds disputes and settlement, and the acquirer answers for the losses it causes. Mastercard allows a chargeback reserve in the PayFac’s agreement with the seller. Contracts should reflect this.
Can any seller be onboarded?
No. Persons listed on terminated merchant files such as VMSS cannot be onboarded, and high-brand-risk sellers may be signed only by registered High-Risk Internet Payment Facilitators.
Is a direct agreement with the acquirer needed?
Yes, if a sub-merchant’s annual sales exceed US$1,000,000 on Visa or US$10,000,000 in combined Mastercard and Maestro volume. Mastercard has exceptions for sellers in certain industries and where enhanced control conditions are met.
See also: Transaction Laundering and Miscoding: The Hidden Threats to Your Fintech Business; KYC and KYB for Payment Providers; EMI and Payment Institution Licence in the EU, UK and Canada. Services: fintech and payments.
- Visa: Visa’s Payment Facilitator Model
- Visa: Beyond the Acquirer, Additional Visa Acceptance Entities
- Visa: Payment Facilitator and Marketplace Risk Guide
- EBA Single Rulebook Q&A 2020_5354: commercial agent exclusion for e-commerce platforms
- EBA Single Rulebook Q&A 2020_5355: commercial agent exclusion for B2C e-commerce platforms
- Mastercard: Payment facilitators
- Mastercard: Mastercard Rules (2 June 2026 edition)
This is what we do
How we help payment and fintech companies:
