Beyond Due Diligence: How Sponsor Banks Should Assess ISO and Payment Facilitator Risk

Understanding the risks, evaluating the controls, and building sustainable sponsorship relationships.  Sponsor banks play a critical role in the payments ecosystem, enabling Independent Sales Organizations (ISOs) and Payment Facilitators (PayFac’s) to deliver payment acceptance services to businesses of all sizes. These partnerships create opportunities for revenue growth, market expansion, and innovation. However, they also introduce operational, financial, regulatory, and compliance risks that banks must carefully evaluate.

As ISO and PayFac business models become more sophisticated, traditional due diligence alone is no longer sufficient. Banks must understand not only who they are sponsoring, but also how those organizations operate, the merchants they serve, and whether their risk management capabilities can support continued growth.

The fundamental question is no longer simply whether an ISO or PayFac meets the bank's onboarding requirements. It is whether the bank understands, can measure, and can effectively oversee the risks associated with the relationship throughout its lifecycle.

1. Understanding the Business Model and Inherent Risk

Not all ISOs and PayFac’s present the same level of risk. A referral-only ISO operating with established merchants presents a very different exposure than a PayFac underwriting thousands of sub-merchants, managing transaction monitoring, and participating in the movement of funds.

Sponsor banks should begin by understanding the partner's business model, including:

• Merchant categories and industries served, including higher-risk segments.

• Geographic markets and cross-border activities.

• Transaction volumes, average ticket sizes, and projected growth.

• Underwriting responsibilities and decision-making authority.

• Settlement arrangements, funding practices, and access to funds.

• Reliance on processors, technology providers, and other third parties.

The objective is to determine the relationship's inherent risk before considering the effectiveness of mitigating controls.

Importantly, banks should distinguish between an ISO's sales, referral, and servicing activities and a PayFac’s potential responsibility for merchant onboarding, transaction monitoring, and settlement. Responsibilities are determined by the actual operating model, agreements, and applicable network rules, not simply the organization's designation.

2. Evaluating Financial Strength and Exposure

A sponsor bank's financial exposure extends beyond the revenue generated by its ISO or PayFac relationships.  Merchant failures, excessive chargebacks, fraud, delayed delivery, and insufficient reserves can create substantial financial liabilities.  Banks should evaluate the financial stability of their partners through financial statements, liquidity assessments, profitability trends, capital resources, and contingency funding arrangements.

Equally important is understanding the financial characteristics of the underlying merchant portfolio.  For example, a PayFac specializing in subscription services, future-delivery products, or travel may generate significant processing volume while carrying substantial contingent liabilities.  Banks should assess whether reserve structures, collateral requirements, settlement delays, and exposure limits adequately address these risks.

Financial exposure should be evaluated under normal operating conditions and plausible stress scenarios, including sudden merchant failures, increased disputes, or the termination of a major processing relationship.  Processing volume alone is not an adequate measure of either profitability or risk.

3. Assessing Merchant Underwriting and Onboarding Controls

Merchant onboarding represents one of the most significant control points in the sponsorship relationship.  Banks must determine whether their ISO or PayFac partners have appropriate procedures for identifying merchants, validating business activities, and evaluating potential fraud or financial exposure.  Areas of assessment include business identity verification, beneficial ownership information where appropriate, sanctions screening, prohibited merchant categories, and merchant risk classification.

For PayFacs with delegated underwriting authority, banks should understand the criteria used to approve merchants, when exceptions are permitted, and when decisions require escalation.  Increasingly automated onboarding creates additional considerations. Banks should assess how rules engines, third-party identity solutions, and automated decisioning systems are configured, monitored, and independently validated.  An efficient onboarding process is valuable, but faster approvals should not come at the expense of effective controls.

4. Reviewing BSA/AML and Regulatory Compliance

Sponsor banks remain responsible for meeting their applicable Bank Secrecy Act (BSA), Anti-Money Laundering (AML), sanctions, and other regulatory obligations.

The FFIEC BSA/AML Examination Manual specifically identifies risks associated with third-party payment processors, including inadequate merchant due diligence and exposure to suspicious transaction activity.   Banks should evaluate whether their partners maintain compliance practices appropriate to their actual business activities and contractual responsibilities.

This includes assessing customer and merchant identification processes, suspicious activity escalation, employee training, record retention, and independent reviews where warranted.  One particularly important consideration is whether information moves effectively between the partner and the bank.

If the PayFac identifies suspicious activity, how is that information communicated? Can the bank obtain the merchant-level data needed for its own monitoring and investigation? Are escalation responsibilities documented?  A written compliance program provides a foundation, but the effectiveness of its implementation is what ultimately matters.

5. Evaluating Transaction Monitoring and Fraud Management

Merchant approval is only the beginning of risk management.  A previously acceptable merchant can become problematic because of changes in business practices, ownership, transaction patterns, or financial condition.

Sponsor banks should assess whether partners maintain effective ongoing monitoring, including fraud rates, chargeback activity, unusual processing volumes, transaction velocity, and changes in merchant behavior.  Banks should also review how partners identify merchant activity inconsistent with the original underwriting profile.

Monitoring should extend beyond individual merchants to portfolio-level trends, including concentrations by industry, geographic exposure, and common fraud characteristics.  Card-network programs, including Visa's Acquirer Monitoring Program (VAMP), reinforce the importance of understanding fraud and dispute performance.

A well-designed monitoring framework should identify emerging problems early enough to allow corrective action before losses or network compliance consequences escalate.

6. Understanding Card-Network Responsibilities

Card-network compliance creates another critical dimension of sponsor-bank risk.  Visa and Mastercard impose obligations on acquiring institutions involving third-party registration, merchant oversight, fraud management, data security, and compliance with network operating rules.

Visa's Payment Facilitator framework specifically identifies acquirer responsibilities for due diligence, monitoring PayFac compliance, and ensuring appropriate merchant underwriting.   Banks should evaluate their ability to demonstrate compliance with these requirements, including the effectiveness of the controls performed by their partners.

Particular attention should be given to how the bank receives information, identifies exceptions, enforces corrective actions, and documents oversight.  Delegating operational activities does not eliminate the acquiring bank's card-network responsibilities.

7. Assessing Technology, Operational Resilience, and Reconciliation

ISO and PayFac relationships increasingly depend on interconnected technology platforms for onboarding, processing, fraud monitoring, settlement, and reporting.  Banks should evaluate whether these systems operate reliably and provide sufficient visibility into merchant activity.  Important considerations include cybersecurity, access controls, incident management, business continuity, disaster recovery, and oversight of technology vendors.

Reconciliation deserves particular attention.  Banks must understand how transactions move through the processing ecosystem and how authorization, clearing, settlement, funding, reserves, and adjustments are reconciled.  Unresolved differences between systems can conceal operational problems, merchant funding errors, or financial exposures.

Banks should assess not only whether reconciliation occurs, but also whether exceptions are identified, assigned, escalated, and resolved within established timeframes.

8. Evaluating Portfolio Concentration and Operational Capacity

Concentration risk is often overlooked when evaluating individual sponsorship relationships.  A bank may have several well-managed ISOs or PayFacs while still accumulating excessive exposure to a particular industry, merchant category, geographic region, or processing platform.

Concentration assessments should consider merchant counts, processing volume, deposits, potential loss exposure, and revenue dependency. However, financial measures tell only part of the story.  Banks must also consider operational capacity. Can existing underwriting, compliance, risk management, and technology teams effectively oversee the portfolio as it grows?

A sponsor bank managing several thousand relatively low-risk merchants may face different challenges than a bank sponsoring a smaller number of complex, higher-risk relationships.  A sustainable concentration framework should combine portfolio risk exposure with the bank's demonstrated operational capacity.

9. Establishing Effective Oversight and Governance

The FDIC updated its payment-processor guidance in February 2026, while retaining its emphasis on risk-based due diligence and monitoring.   For sponsor banks, this means relationships should be subject to ongoing evaluation rather than periodic documentation exercises.

Effective oversight should include defined risk ratings, measurable performance indicators, documented escalation procedures, independent testing, and regular reporting to management and the board.  Contracts should clearly define responsibilities, information access, audit rights, corrective-action expectations, and termination provisions.

Banks should also establish triggers for reassessing relationships, including material growth, changing merchant concentrations, significant fraud events, control failures, and regulatory developments.  The strongest oversight programs combine consistent governance with flexibility to respond to changing circumstances.

10. Moving from Inherent Risk to Residual Risk

Ultimately, a sponsor bank needs to assess two distinct questions: What risks does the ISO or PayFac introduce, and how effectively are those risks controlled?  This distinction between inherent and residual risk is essential.

A PayFac serving higher-risk industries may possess sophisticated underwriting, transaction monitoring, reserves, and compliance controls that substantially reduce its residual risk.  Conversely, a seemingly straightforward ISO may present considerable residual risk if its operations lack transparency, documented controls, or effective oversight.

Banks should establish a repeatable assessment methodology that evaluates inherent risk, control effectiveness, remaining exposure, and the bank's capacity to oversee the relationship.  The results should inform monitoring frequency, contractual requirements, risk limits, and decisions about future growth.

The RPY Perspective: Building Sustainable Sponsorship Relationships

Effective sponsorship is not about avoiding every higher-risk relationship. It is about understanding the risks, implementing proportionate controls, and maintaining the ability to demonstrate effective oversight.

Banks that approach ISO and PayFac risk assessments as ongoing business disciplines, rather than compliance exercises, are better positioned to expand their payments portfolios responsibly.  Equally important, ISOs and PayFacs that invest in strong governance, reliable data, and transparent operations become more attractive, sustainable partners for their sponsoring institutions.

The goal is not simply to approve a relationship. It is to establish a framework in which the bank and its partner can grow together without allowing risk to outpace the controls designed to manage it.

RPY Innovations works with sponsor banks, ISOs, and Payment Facilitators to evaluate risk management frameworks, strengthen underwriting and compliance practices, assess operational controls, and develop scalable oversight programs.

As the payments ecosystem continues to evolve, effective sponsorship will depend on combining commercial opportunity with disciplined, measurable risk management.

Regulatory references: Interagency Third-Party Risk Management Guidance · FFIEC Payment Processor Risk Guidance · Visa Payment Facilitator Model