{"id":7761,"date":"2026-10-22T13:40:00","date_gmt":"2026-10-22T10:40:00","guid":{"rendered":"https:\/\/legalbit.top\/en\/?p=7761"},"modified":"2026-10-23T15:58:53","modified_gmt":"2026-10-23T12:58:53","slug":"payfac-sub-merchant-liability","status":"publish","type":"post","link":"https:\/\/legalbit.top\/en\/payfac-sub-merchant-liability\/","title":{"rendered":"Payment Facilitators, Aggregators and ISOs: Who Is Responsible for Sub-Merchants"},"content":{"rendered":"\n<div class=\"lbm\"><svg width=\"0\" height=\"0\" style=\"position:absolute\" aria-hidden=\"true\"><symbol id=\"i-list\" viewBox=\"0 0 24 24\"><path d=\"M9 6h11M9 12h11M9 18h11\"\/><path d=\"M4 6h.01M4 12h.01M4 18h.01\"\/><\/symbol><symbol id=\"i-user\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"8\" r=\"4\"\/><path d=\"M4 21c0-4 3.6-7 8-7s8 3 8 7\"\/><\/symbol><symbol id=\"i-ban\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M5.6 5.6l12.8 12.8\"\/><\/symbol><symbol id=\"i-layers\" viewBox=\"0 0 24 24\"><path d=\"M12 3l9 5-9 5-9-5z\"\/><path d=\"M3 13l9 5 9-5\"\/><\/symbol><symbol id=\"i-eye\" viewBox=\"0 0 24 24\"><path d=\"M2 12s4-7 10-7 10 7 10 7-4 7-10 7S2 12 2 12z\"\/><circle cx=\"12\" cy=\"12\" r=\"3\"\/><\/symbol><symbol id=\"i-doc\" viewBox=\"0 0 24 24\"><path d=\"M7 3h8l4 4v14H7z\"\/><path d=\"M15 3v4h4M10 12h6M10 16h6\"\/><\/symbol><symbol id=\"i-pen\" viewBox=\"0 0 24 24\"><path d=\"M4 20l4-1 11-11-3-3L5 16z\"\/><path d=\"M14 6l3 3\"\/><\/symbol><symbol id=\"i-alert\" viewBox=\"0 0 24 24\"><path d=\"M12 3l10 18H2z\"\/><path d=\"M12 10v4M12 17.5h.01\"\/><\/symbol><symbol id=\"i-bulb\" viewBox=\"0 0 24 24\"><path d=\"M9 18h6M10 21h4\"\/><path d=\"M12 3a6 6 0 0 0-3.5 10.9c.6.5 1 1.2 1 2.1h5c0-.9.4-1.6 1-2.1A6 6 0 0 0 12 3z\"\/><\/symbol><symbol id=\"i-info\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M12 11v5M12 8h.01\"\/><\/symbol><symbol id=\"i-coin\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M14.5 9.5c-.5-1-1.5-1.5-2.5-1.5-1.4 0-2.5.8-2.5 2s1.1 1.6 2.5 2 2.5.8 2.5 2-1.1 2-2.5 2c-1 0-2-.5-2.5-1.5M12 6.5v11\"\/><\/symbol><symbol id=\"i-clock\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M12 7v5l3 2\"\/><\/symbol><symbol id=\"i-globe\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M3 12h18M12 3c2.5 2.7 3.8 5.7 3.8 9s-1.3 6.3-3.8 9c-2.5-2.7-3.8-5.7-3.8-9S9.5 5.7 12 3z\"\/><\/symbol><\/svg><section class=\"lbm-intro\"><div class=\"lbm-intro-main\"><p class=\"lbm-lead\">A payment company onboards many small sellers under one agreement with a bank. If one of them breaks the rules, it is not only the seller who answers. We explain in plain words how a PayFac (also known as a payment aggregator), an ISO and a marketplace differ, who is responsible to Visa and Mastercard for what, and when a seller needs a direct agreement with the bank. We also cover how to vet sellers, what contracts should say and whether a platform needs a licence in the EU. Everything is based on primary sources.<\/p><p class=\"lbm-verified\">Checked on 22 October 2026. Rules and sources are current as of this date.<\/p><ul class=\"lbm-toc\"><li><a href=\"#models\">Who is who<\/a><\/li><li><a href=\"#liab\">Who is responsible<\/a><\/li><li><a href=\"#eu\">Licensing in the EU<\/a><\/li><li><a href=\"#dd\">Sub-merchant due diligence<\/a><\/li><li><a href=\"#mon\">Monitoring<\/a><\/li><li><a href=\"#contract\">Contracts<\/a><\/li><li><a href=\"#case\">Case analysis<\/a><\/li><li><a href=\"#choose\">What to do<\/a><\/li><li><a href=\"#faq\">FAQ<\/a><\/li><\/ul><\/div><\/section><section id=\"models\"><h2>Who is who<\/h2><p style=\"max-width:70ch\">Imagine a chain. An acquiring bank accepts card payments for businesses. Onboarding every small seller separately is inconvenient for it, so it works through an intermediary that brings sellers together under one agreement. The role of the intermediary decides who answers for the sellers.<\/p><div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-user\"\/><\/svg><\/span><h3>Acquirer<\/h3><p>A bank or other institution that accepts card payments for businesses and answers for them to Visa and Mastercard.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-layers\"\/><\/svg><\/span><h3>Payment facilitator (PayFac)<\/h3><p>This is what the market usually calls a payment aggregator, so in the title and text these words mean the same role. It signs agreements with sellers on the acquirer\u2019s behalf and receives the money for them. It is registered with Visa.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-user\"\/><\/svg><\/span><h3>Sub-merchant<\/h3><p>A small seller onboarded by a PayFac. Mastercard calls it a sponsored merchant. The PayFac signs the agreement for the acquirer, but all card scheme requirements apply as if the seller had contracted with the acquirer directly.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-doc\"\/><\/svg><\/span><h3>ISO<\/h3><p>An intermediary of the acquirer that finds and services sellers. It does not receive the money, and the seller contracts directly with the acquirer. It is registered as a Third Party Agent.<\/p><\/div><\/div><p style=\"max-width:70ch\">A marketplace is a separate case. The platform itself contracts with the acquirer and receives the money for sellers, so its sellers are not sub-merchants of a PayFac. Mastercard calls this role a Platform Merchant (Rule 5.1.2.2). The platform must verify third-party sellers and their owners, sign a contract with each, monitor the legality of sales and answer for buyers\u2019 disputes.<\/p><div class=\"lbm-cmp\"><table><thead><tr><th>Role<\/th><th>Who signs with the seller<\/th><th>Who receives the money<\/th><th>Mastercard term<\/th><\/tr><\/thead><tbody><tr><th scope=\"row\">PayFac<\/th><td>The PayFac on behalf of the acquirer<\/td><td>The PayFac<\/td><td>Payment Facilitator<\/td><\/tr><tr><th scope=\"row\">Marketplace<\/th><td>The platform, with the acquirer<\/td><td>The platform<\/td><td>Platform Merchant<\/td><\/tr><tr><th scope=\"row\">ISO<\/th><td>The seller, with the acquirer<\/td><td>Does not receive<\/td><td>ISO<\/td><\/tr><\/tbody><\/table><\/div><div class=\"lbm-co info\"><span class=\"lbm-ico\"><svg><use href=\"#i-coin\"\/><\/svg><\/span><div><b>When a direct agreement with the bank is needed<\/b><p>If a sub-merchant\u2019s annual Visa sales exceed US$1,000,000, the acquirer must join its agreement, and the PayFac may continue to service the seller. Mastercard sets a higher threshold of US$10,000,000 in combined Mastercard and Maestro volume (Rule 7.8). There are exceptions. A direct agreement is not needed if enhanced control conditions are met, for example the PayFac is registered as a Network Enablement Partner, the acquirer has access to its systems and reviews at least 5% of newly onboarded sellers every month. It is also not needed for sellers in certain industries, such as utilities, education, medical services and tax payments.<\/p><\/div><\/div><\/section><section id=\"liab\"><h2>Who is responsible<\/h2><p style=\"max-width:70ch\">The main rule is the same for Visa and Mastercard. Towards the card scheme, the acquirer answers for the PayFac and the sub-merchants. It then passes this responsibility down the chain.<\/p><div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-alert\"\/><\/svg><\/span><h3>Acquirer<\/h3><p>Under Visa rules it answers for the acts and omissions of PayFacs, for harm caused by them and by their sellers, and may contract only with those it has screened for risk. Under Mastercard rules it answers for all acts and omissions of PayFacs and sponsored merchants and must ensure they follow the standards (Rule 7.6.5). It may let the PayFac handle some checks, but it stays responsible if the PayFac fails to do them (Rule 7.6.5.1).<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-coin\"\/><\/svg><\/span><h3>PayFac<\/h3><p>In effect extends unsecured credit to sellers. A seller receives money before delivering goods, and card disputes can usually be raised within 120 days, sometimes up to 540. If the seller cannot repay, the PayFac itself funds the disputes. Mastercard adds that the PayFac must pay the seller for all transactions, but the agreement may provide a chargeback reserve (Rule 7.8.2).<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-user\"\/><\/svg><\/span><h3>Sub-merchant<\/h3><p>Its acts are treated as the acts of the PayFac, and the acts of the PayFac or the seller are treated as the acts of the acquirer.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-ban\"\/><\/svg><\/span><h3>If the violation is not stopped<\/h3><p>An acquirer that does not stop a seller\u2019s violation after Mastercard\u2019s notice risks a Franchise Management Program review, an audit at its own expense and an assessment of USD 200,000 or USD 2,500 per day (Rule 5.12.7).<\/p><\/div><\/div><div class=\"lbm-co info\"><span class=\"lbm-ico\"><svg><use href=\"#i-info\"\/><\/svg><\/span><div><b>What this means<\/b><p>Contracts and checks should be built as a chain. Each link needs the right to check the one below it, to take security and to pass losses down.<\/p><\/div><\/div><\/section><section id=\"eu\"><h2>Licensing in the EU<\/h2><p style=\"max-width:70ch\">For a company in the EU, a separate question is whether it needs a payment institution licence. Article 3(b) of PSD2 (EU Payment Services Directive 2) excludes payments through a commercial agent authorised to negotiate or conclude the sale of goods or services on behalf of only the payer or only the payee.<\/p><div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-doc\"\/><\/svg><\/span><h3>A platform is not excluded by default<\/h3><p>The European Banking Authority (EBA) keeps a public database of questions and answers on EU rules. Question 2020_5354 in that database was answered by the European Commission, which said that an e-commerce platform that receives payment on behalf of the payee is not excluded from PSD2 by default, even where the payment settles the payer\u2019s debt to the payee. Such an exclusion would weaken buyer and seller protections and distort competition.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-eye\"\/><\/svg><\/span><h3>The business model is assessed<\/h3><p>In the answer to question 2020_5355 from the same database, the Commission said that a B2C (business to consumer) platform (one that sells to consumers) may fall under the exclusion if it acts as an agent of the payee and not also on behalf of the payer. The competent authority assesses the business model, and PSD2 sets no criteria for this.<\/p><\/div><\/div><p style=\"max-width:70ch\">We covered licence types and capital requirements <a href=\"\/en\/payment-institution-emi-licence-eu-uk-canada\/\">in the article on EMI and payment institution licences<\/a>. The answers clarify existing provisions, and we do not cover PSD3 (proposed third EU Payment Services Directive) and the PSR (proposed EU Payment Services Regulation) here.<\/p><div class=\"lbm-co soft\"><span class=\"lbm-ico\"><svg><use href=\"#i-bulb\"\/><\/svg><\/span><div><b>Our takeaway<\/b><p>If you receive buyers\u2019 money and pass it on to sellers, you cannot assume that the commercial agent exclusion will apply. It is better to confirm your position with the supervisor and not only internally.<\/p><\/div><\/div><\/section><div class=\"lbm-svc\"><div><b>Need help with this topic?<\/b><p>We will review your situation and propose a solution for your project.<\/p><\/div><a class=\"lbm-svc-btn popmake-4929\" href=\"#\" role=\"button\">Contact us<\/a><\/div><section id=\"dd\"><h2>Sub-merchant due diligence<\/h2><p style=\"max-width:70ch\">Both the PayFac and each seller are checked. We covered general approaches <a href=\"\/en\/kyc-kyb-payment-providers\/\">in the article on KYC and KYB<\/a>, and here we show only what card scheme rules add.<\/p><div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-doc\"\/><\/svg><\/span><h3>How the acquirer checks the PayFac<\/h3><p>It looks at financial responsibility, business practices, marketing and principal owners, carries out an onsite inspection and queries the database of terminated merchants (Visa Merchant Screening Service, VMSS). A senior officer of the acquirer signs the contracts, and Visa\u2019s registration confirmation must be received before any transactions.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-user\"\/><\/svg><\/span><h3>How a seller is checked<\/h3><p>A written underwriting policy and an acquirer-approved agreement are needed. The seller must be financially responsible, must not harm the Visa system and must operate in an allowed jurisdiction. High-brand-risk sellers get enhanced due diligence and may be signed only by registered High-Risk Internet Payment Facilitators.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-ban\"\/><\/svg><\/span><h3>Whom you cannot onboard<\/h3><p>You cannot onboard those listed on VMSS (Visa Merchant Screening Service, Visa&#8217;s database of sellers that previously lost card acceptance) or similar files. A PayFac cannot sponsor another PayFac, a staged digital wallet (one that is topped up first and then used to pay a seller) or person-to-person money transfers. Mastercard has similar limits (Rule 7.8).<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-eye\"\/><\/svg><\/span><h3>Automated onboarding<\/h3><p>Controls such as velocity checks and fraud detection are needed to screen out fraudulent applications.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-globe\"\/><\/svg><\/span><h3>What Mastercard adds<\/h3><p>A seller must be located within the acquirer\u2019s Area of Use, and the location of a transaction is the seller\u2019s, not the PayFac\u2019s. Funds the acquirer lets a PayFac access may be used only to pay sellers. Sellers in risky categories (Section 9.1 of the Security Rules and Procedures) and those previously reported under the Excessive Chargeback Program must be registered before transactions are accepted. For such sellers the PayFac must be approved by Mastercard as a Network Enablement Partner (Rules 7.6.5.1 and 7.8.3).<\/p><\/div><\/div><\/section><section id=\"mon\"><h2>Monitoring<\/h2><p style=\"max-width:70ch\">Checks do not end after onboarding. Visa describes ongoing monitoring as a required part of risk management, and Mastercard expressly requires a PayFac to monitor sellers\u2019 activity and use of the marks (Rule 7.8.2).<\/p><div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-clock\"\/><\/svg><\/span><h3>What to track<\/h3><p>Sales volume, average ticket, purchase returns, authorisation and decline counts, disputes, fraud advices and force-posted transactions.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-alert\"\/><\/svg><\/span><h3>Warning signs<\/h3><p>Rounded amounts, micro-transactions, repeated sales on one card, dormant accounts with sudden spikes and load balancing between merchants.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-globe\"\/><\/svg><\/span><h3>Websites and transaction laundering<\/h3><p>Seller websites are screened for illegal activity, transaction laundering and deceptive marketing. During an investigation, settlement funds may be held or moved to a reserve.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-eye\"\/><\/svg><\/span><h3>Mastercard reporting and identifiers<\/h3><p>Each quarter the acquirer reports to Mastercard on every seller, with its name, location, website, MCC (merchant category code), and the number and amount of sales and chargebacks. The report is not needed if transactions carry the PayFac and seller identifiers (Rule 7.6.6), unless Mastercard requires otherwise. When an ISO is used, its identifier is passed too.<\/p><\/div><\/div><p style=\"max-width:70ch\">We wrote about transaction laundering in detail <a href=\"\/en\/transaction-laundering-and-miscoding\/\">in our article<\/a>. According to Visa, acquirers, PayFacs and marketplaces are held accountable for the illicit activity of their sellers. We covered the scheme of disguising gambling as another business <a href=\"\/en\/gambling-payment-laundering\/\">separately<\/a>.<\/p><\/section><section id=\"contract\"><h2>Contracts<\/h2><p style=\"max-width:70ch\">Each link in the chain must be fixed in a contract.<\/p><div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-doc\"\/><\/svg><\/span><h3>PayFac and acquirer<\/h3><p>Services within the acquirer\u2019s jurisdiction, registration with the card schemes, responsibility for sub-merchants, requirements for checks and reporting.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-pen\"\/><\/svg><\/span><h3>PayFac and sub-merchant<\/h3><p>A ban on illegal transactions and compliance with card scheme rules and the law.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-doc\"\/><\/svg><\/span><h3>What Mastercard requires<\/h3><p>The agreement must clearly show that the PayFac acts on the acquirer\u2019s behalf, must not limit the right to terminate it at any time and must contain all the terms of an ordinary merchant agreement (Rule 7.8.1). These include current addresses and a description of the business, precedence of Mastercard standards over the agreement, automatic termination if the PayFac is deregistered and the right to terminate immediately for fraud (Rule 7.8.1.1). If the PayFac omits these terms, the acquirer is still responsible for chargebacks and compliance. We covered which clauses to include in <a href=\"\/en\/merchant-agreement-transaction-laundering\/\">our article on merchant agreements and protection from transaction laundering<\/a>.<\/p><\/div><\/div><\/section><section id=\"case\"><h2>Case analysis<\/h2><div class=\"lbm-co soft\"><span class=\"lbm-ico\"><svg><use href=\"#i-bulb\"\/><\/svg><\/span><div><b>Hypothetical example, not a real case<\/b><p>A payment facilitator onboards small businesses through automated onboarding. After a few months it turns out that some sub-merchants sell something other than what was declared, and one seller\u2019s revenue is far above what was declared. The acquirer demands an explanation. A sensible order of action is to pause payouts to the problem sellers, check their sites and documents, revise the automated onboarding rules and monitoring thresholds, check whether the sales level that requires a direct agreement with the acquirer has been exceeded, and record the new terms in the contracts.<\/p><\/div><\/div><\/section><section id=\"choose\"><h2>What to do<\/h2><p style=\"max-width:70ch\">Start by understanding your role clearly, and build the rest from it.<\/p><ol class=\"lbm-steps\"><li><span class=\"lbm-ico\"><svg><use href=\"#i-user\"\/><\/svg><\/span><div><h3>Define your role<\/h3><p>PayFac, marketplace or ISO, and who in your model signs the contracts and receives the money.<\/p><span class=\"lbm-tag\">Start here<\/span><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-globe\"\/><\/svg><\/span><div><h3>Check your licensing status<\/h3><p>Map the model to PSD2 and the commercial agent exclusion, and where in doubt ask for the supervisor\u2019s position.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-doc\"\/><\/svg><\/span><div><h3>Describe underwriting<\/h3><p>A written policy, admission criteria, prohibited categories and enhanced checks for high-risk sellers.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-eye\"\/><\/svg><\/span><div><h3>Set up monitoring<\/h3><p>Indicators, thresholds, exceptions, owners and response times.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-pen\"\/><\/svg><\/span><div><h3>Bring contracts in order<\/h3><p>The acquirer, PayFac, sub-merchant chain with a reserve, audit rights and pass-through of fines.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-alert\"\/><\/svg><\/span><div><h3>Prepare an incident plan<\/h3><p>Suspension, reserve, notice to the acquirer and a record of decisions.<\/p><\/div><\/li><\/ol><\/section><figure class=\"lbm-pull\"><q>The more sellers are onboarded through one agent, the more important it is that responsibility is written into every link of the chain.<\/q><cite>The LegalBit team<\/cite><\/figure><section id=\"faq\"><h2>Frequently asked questions<\/h2><div class=\"lbm-faq\"><details><summary>Is a PayFac the same as a payment aggregator?<\/summary><p>Yes, in everyday terminology they are the same. The card schemes use the term Payment Facilitator.<\/p><\/details><details><summary>How does a PayFac differ from an ISO?<\/summary><p>A PayFac signs the merchant agreement with the seller on behalf of the acquirer and receives settlement for it. An ISO recruits and services sellers but does not receive settlement, and the seller signs with the acquirer.<\/p><\/details><details><summary>Does a payment facilitator need a licence in the EU?<\/summary><p>It depends on the model. If you receive money on behalf of sellers, the commercial agent exclusion cannot be assumed to apply automatically. The business model must be assessed and, where needed, confirmed with the supervisor.<\/p><\/details><details><summary>Who pays for chargebacks?<\/summary><p>If a seller cannot repay cardholders, the PayFac funds disputes and settlement, and the acquirer answers for the losses it causes. Mastercard allows a chargeback reserve in the PayFac\u2019s agreement with the seller. Contracts should reflect this.<\/p><\/details><details><summary>Can any seller be onboarded?<\/summary><p>No. Persons listed on terminated merchant files such as VMSS cannot be onboarded, and high-brand-risk sellers may be signed only by registered High-Risk Internet Payment Facilitators.<\/p><\/details><details><summary>Is a direct agreement with the acquirer needed?<\/summary><p>Yes, if a sub-merchant\u2019s annual sales exceed US$1,000,000 on Visa or US$10,000,000 in combined Mastercard and Maestro volume. Mastercard has exceptions for sellers in certain industries and where enhanced control conditions are met.<\/p><\/details><\/div><p class=\"lbm-more\"><b>See also: <\/b><a href=\"\/en\/transaction-laundering-and-miscoding\/\">Transaction Laundering and Miscoding: The Hidden Threats to Your Fintech Business<\/a>; <a href=\"\/en\/kyc-kyb-payment-providers\/\">KYC and KYB for Payment Providers<\/a>; <a href=\"\/en\/payment-institution-emi-licence-eu-uk-canada\/\">EMI and Payment Institution Licence in the EU, UK and Canada<\/a>. Services: <a href=\"\/en\/fintech-payments-legal\/\">fintech and payments<\/a>.<\/p><div class=\"lbm-src\"><b>Sources<\/b><ul><li><a href=\"https:\/\/usa.visa.com\/dam\/VCOM\/global\/support-legal\/documents\/visa-payment-facilitator-model.pdf\" rel=\"nofollow noopener\" target=\"_blank\">Visa: Visa\u2019s Payment Facilitator Model<\/a><\/li><li><a href=\"https:\/\/usa.visa.com\/dam\/VCOM\/global\/support-legal\/documents\/visa-acceptance-entities.pdf\" rel=\"nofollow noopener\" target=\"_blank\">Visa: Beyond the Acquirer, Additional Visa Acceptance Entities<\/a><\/li><li><a href=\"https:\/\/usa.visa.com\/content\/dam\/VCOM\/regional\/na\/us\/partner-with-us\/documents\/visa-payment-facilitator-and-marketplace-risk-guide.pdf\" rel=\"nofollow noopener\" target=\"_blank\">Visa: Payment Facilitator and Marketplace Risk Guide<\/a><\/li><li><a href=\"https:\/\/www.eba.europa.eu\/single-rule-book-qa\/qna\/view\/publicId\/2020_5354\" rel=\"nofollow noopener\" target=\"_blank\">EBA Single Rulebook Q&#038;A 2020_5354: commercial agent exclusion for e-commerce platforms<\/a><\/li><li><a href=\"https:\/\/www.eba.europa.eu\/single-rule-book-qa\/qna\/view\/publicId\/2020_5355\" rel=\"nofollow noopener\" target=\"_blank\">EBA Single Rulebook Q&#038;A 2020_5355: commercial agent exclusion for B2C e-commerce platforms<\/a><\/li><li><a href=\"https:\/\/www.mastercard.com\/us\/en\/business\/support\/payment-facilitators.html\" rel=\"nofollow noopener\" target=\"_blank\">Mastercard: Payment facilitators<\/a><\/li><li><a href=\"https:\/\/www.mastercard.com\/content\/dam\/mccom\/shared\/business\/support\/rules-pdfs\/mastercard-rules.pdf\" rel=\"nofollow noopener\" target=\"_blank\">Mastercard: Mastercard Rules (2 June 2026 edition)<\/a><\/li><\/ul><\/div><\/section><\/div>\n\n\n\n<div class=\"lb-ac\"><h2>This is what we do<\/h2><p>How we help payment and fintech companies:<\/p><ul><li><a href=\"https:\/\/legalbit.top\/en\/fintech-payments-legal\/\">Fintech and payments<\/a><\/li><li><a href=\"https:\/\/legalbit.top\/en\/regulatory-and-compliance\/\">Regulatory and compliance<\/a><\/li><\/ul><\/div>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"BlogPosting\",\"headline\":\"Payment Facilitators, Aggregators and ISOs: Who Is Responsible for Sub-Merchants\",\"description\":\"How PayFacs, marketplaces and ISOs differ, how responsibility is allocated under Visa and Mastercard rules, and what to check in the EU if you accept payments for sellers.\",\"url\":\"https:\/\/legalbit.top\/en\/payfac-sub-merchant-liability\/\",\"mainEntityOfPage\":\"https:\/\/legalbit.top\/en\/payfac-sub-merchant-liability\/\",\"image\":\"https:\/\/legalbit.top\/wp-content\/uploads\/2026\/10\/payfac_iso-1-scaled.webp\",\"datePublished\":\"2026-10-22T10:30:00Z\",\"dateModified\":\"2026-10-22T10:30:00Z\",\"inLanguage\":\"en\",\"author\":{\"@type\":\"Organization\",\"name\":\"LegalBit\",\"url\":\"https:\/\/legalbit.top\/\"},\"publisher\":{\"@type\":\"Organization\",\"name\":\"LegalBit\",\"url\":\"https:\/\/legalbit.top\/\"}}<\/script>\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"Is a PayFac the same as a payment aggregator?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes, in everyday terminology they are the same. The card schemes use the term Payment Facilitator.\"}},{\"@type\":\"Question\",\"name\":\"How does a PayFac differ from an ISO?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"A PayFac signs the merchant agreement with the seller on behalf of the acquirer and receives settlement for it. An ISO recruits and services sellers but does not receive settlement, and the seller signs with the acquirer.\"}},{\"@type\":\"Question\",\"name\":\"Does a payment facilitator need a licence in the EU?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"It depends on the model. If you receive money on behalf of sellers, the commercial agent exclusion cannot be assumed to apply automatically. The business model must be assessed and, where needed, confirmed with the supervisor.\"}},{\"@type\":\"Question\",\"name\":\"Who pays for chargebacks?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"If a seller cannot repay cardholders, the PayFac funds disputes and settlement, and the acquirer answers for the losses it causes. Mastercard allows a chargeback reserve in the PayFac\u2019s agreement with the seller. Contracts should reflect this.\"}},{\"@type\":\"Question\",\"name\":\"Can any seller be onboarded?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No. Persons listed on terminated merchant files such as VMSS cannot be onboarded, and high-brand-risk sellers may be signed only by registered High-Risk Internet Payment Facilitators.\"}},{\"@type\":\"Question\",\"name\":\"Is a direct agreement with the acquirer needed?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes, if a sub-merchant\u2019s annual sales exceed US$1,000,000 on Visa or US$10,000,000 in combined Mastercard and Maestro volume. Mastercard has exceptions for sellers in certain industries and where enhanced control conditions are met.\"}}]}<\/script>\n","protected":false},"excerpt":{"rendered":"<p>A payment company onboards many small sellers under one agreement with a bank. If one of them breaks the rules, it is not only the seller who answers. We explain in plain words how a PayFac (also known as a payment aggregator), an ISO and a marketplace differ, who is responsible to Visa and Mastercard [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":7775,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[72],"tags":[115,112,120,114,117],"post_folder":[],"class_list":["post-7761","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-fintech","tag-compliance","tag-eu","tag-fintech","tag-kyc","tag-payments"],"_links":{"self":[{"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/posts\/7761","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/comments?post=7761"}],"version-history":[{"count":47,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/posts\/7761\/revisions"}],"predecessor-version":[{"id":8124,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/posts\/7761\/revisions\/8124"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/media\/7775"}],"wp:attachment":[{"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/media?parent=7761"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/categories?post=7761"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/tags?post=7761"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/post_folder?post=7761"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}