Risk management and Payment Facilitation: Are you up to the challenge?

These are inherent risks associated with the processing of transactions for your sub-merchants. As a PayFac, you’re responsible for the transactions of every sub-merchant on your platform. To reduce risk and losses, you have to constantly monitor their transactions for all types of payment fraud and institute controls when necessary.

One type known as friendly fraud occurs when a real customer orders a product online and receives the goods or products, but claims they didn’t and proceeds to ask their bank for a chargeback rather than ask the merchant for a refund. If you provide processing, settlement of funds, and bill your merchants, you’re responsible for handling chargebacks.

Settlement of funds comes with risks as well, because a PayFac will often settle transactions with a sub-merchant before goods are delivered. This means you’re extending them a line of credit in a sense. If you try to collect funds from a merchant for a chargeback you paid out and that merchant has gone out of business, you’re stuck with losses that can quickly add up as you grow.

These are risks related to non-compliance with all the governmental and card-brand regulations you’re subject to as a PayFac. You’re responsible for who’s on your platform and must have processes and procedures in place that prove to your acquirer who your sub-merchants are.

A PayFac must ensure their sub-merchants are covered for money laundering, terrorist financing, and all other risks, including Know Your Customer (KYC), Anti-Money Laundering (AML), and Office of Foreign Asset Control (OFAC) requirements.

During the underwriting process, you’re also required to identify the business owner(s) of your sub-merchants, according to rules and regulations set by the U.S. Patriot Act, Bank Secrecy Act, AML laws, and the Financial Crimes Enforcement Network (FinCEN).

Card brands have their own set of rules and regulations that you must follow and ensure your sub-merchants are following. Arguably the most important is PCI compliance to protect customer data. All merchants must meet Payment Card Industry Data Security Standards (PCI DSS), but a PayFac must also register as a Level 1 PCI DSS. Failure to meet these requirements can lead to fines, higher transaction fees, and contract termination.

These are risks stemming from inadequate or failed internal processes, procedures, systems, or employees. Operational risks include:

• The organizational shake up when you become a payments business can lead to costly disruptions to your core business.
• Old hardware failures or other disruptive threats to networks, malware, or employee errors can hinder PayFac operations.
• The struggle to attract top talent can lead to less experienced staff moving into high-pressure roles, increasing the likelihood of errors.

These are risks that can negatively affect your industry and public reputation. This happens all too often these days with data breaches, bad customer service reviews that go viral, executive scandals, and so on.

Since you’re required as a PayFac to know your customer (see KYC above), you’re responsible for any illegal or illicit activity of your sub-merchants. The types of sub-merchants you board can also cause issues even if they’re not illegal, per se. Examples include massage parlors, vaping products, firearms, and drug trafficking, because they often get approved as legitimate merchants.

Getting on the wrong side of regulators, card brands, and acquirers can also create lasting damage to your reputation and could expose your company to substantial fines.