For sponsor banks, managing relationships with Independent Sales Organizations (ISOs) and Payment Facilitators (PayFacs) requires more than evaluating individual partners. Banks must also understand how their collective portfolios create concentrations of risk.
A bank may sponsor several well-managed ISOs and PayFac’s, each operating within its approved risk parameters, yet collectively create excessive exposure to a particular merchant category, industry, geographic market, or processing model.
Effective concentration management is not only about establishing limits. It is about understanding how risks accumulate across the entire sponsored portfolio and ensuring those exposures remain consistent with the bank's risk appetite and operational capabilities.
Understanding Portfolio Concentration Risk
Concentration risk arises when a disproportionate share of a bank's payments activity depends on merchants, partners, industries, or operating arrangements with similar risk characteristics. For example, a bank may sponsor five PayFacs, each with a relatively modest portfolio of higher-risk merchants. Individually, these relationships may be acceptable. Collectively, however, they could expose the bank to significant correlated losses from fraud, chargebacks, regulatory changes, or industry disruptions.
Sponsor banks should evaluate concentration across several dimensions which may overlap:
Exposure to specific merchant categories, especially those associated with elevated fraud, chargeback, or financial risk.
Processing volume, revenue, or potential loss exposure concentrated in a small number of partners.
Merchants operating in jurisdictions with shared economic, regulatory, or fraud vulnerabilities.
Concentrations involving high-ticket transactions, delayed delivery, recurring billing, or card-not-present activity.
Reliance on common processors, gateways, platforms, or other critical service providers.
A bank could discover that its largest PayFac also supports its highest-risk industry segment and depends on a processing platform used by several other sponsored partners.
Establishing Meaningful Concentration Limits
There is no universal percentage for determining what constitutes an acceptable concentration for every sponsor bank. Limits should reflect the institution's capital position, financial exposure, business strategy, underwriting standards, and ability to oversee its merchant portfolio.
The OCC's Merchant Processing guidance recognizes the importance of managing high-risk merchant concentrations and chargeback exposure relative to bank capital. Interagency third-party risk guidance similarly emphasizes oversight proportionate to the nature and complexity of third-party relationships.
Banks should consider establishing limits at three levels:
1. Enterprise-level limits: Maximum exposure across the bank's entire merchant processing business, including high-risk processing volume, potential chargeback losses, and reliance on individual industries.
2. Partner-level limits: Maximum permitted exposure for each ISO or PayFac, considering merchant composition, processing volume, financial strength, and demonstrated risk management capabilities.
3. Merchant-segment limits: Thresholds for merchant categories or activities sharing similar risk characteristics, regardless of which ISO or PayFac originated the merchants.
These limits must operate together. A PayFac may remain within its individual allocation while the bank approaches its enterprise-wide limit for that merchant segment.
Moving Beyond Simple Percentage Limits
Many concentration frameworks rely primarily on processing volume. Although volume is important, it does not necessarily reflect the bank's actual risk exposure.
Consider two merchant portfolios with identical annual processing volumes. One consists primarily of established retailers delivering products immediately. The other includes merchants selling expensive services months before fulfillment. Despite equivalent processing volumes, their potential credit and chargeback exposures may be substantially different. A more sophisticated approach combines quantitative measures with risk-based assessments, including:
Potential chargeback and merchant credit exposure.
Merchant financial condition and fulfillment obligations.
Historical fraud, disputes, and losses.
Reserve balances and available collateral.
Quality of underwriting and ongoing monitoring controls.
Concentration of exposure among individual merchants or merchant groups.
This framework allows banks to distinguish inherent risk from residual risk after considering appropriate mitigants.
Importantly, strong controls may justify different limits, but they should not substitute for understanding the underlying exposure.
Monitoring Concentrations Across the Portfolio
Effective concentration management requires timely, consistent information from sponsored partners. Banks should establish standardized reporting requirements covering merchant populations, MCC classifications, processing volumes, disputes, fraud, reserves, and material changes in portfolio composition.
Dashboards should aggregate information across all ISOs and PayFacs rather than relying exclusively on partner-specific reporting. Early warning thresholds can identify approaching limits before corrective action becomes necessary. For example, a bank might establish internal notification thresholds at 75% and 90% of an approved concentration limit, with escalation procedures tied to each threshold.
These are illustrative management practices, not regulatory thresholds. Monitoring should also incorporate forward-looking projections. A rapidly growing PayFac may remain within its approved limits today but exceed them within the next quarter.
Managing Exceptions and Supporting Growth
A disciplined exception process can accommodate growth while preserving appropriate governance. Concentration limits need not prevent sponsor banks from pursuing attractive business opportunities.
Potential mitigants to exceptions include enhanced reserves, processing restrictions, additional monitoring, strengthened underwriting, or more frequent financial reviews. However, exceptions must remain exceptions. Repeated approvals without reassessing enterprise-wide limits may indicate that the bank's risk appetite and business strategy are no longer aligned.
The FDIC's payment processor guidance reinforces the importance of risk-based oversight, appropriate controls, and sufficient resources to manage these relationships.
The RPY Perspective: Balancing Growth and Risk
Portfolio concentration management should be an ongoing strategic discipline rather than an annual compliance exercise. Sponsor banks need a comprehensive view of their payment processing relationships and their risks, reliable data, and governance capable of responding to changing exposures.
Equally important, ISO and PayFac partners should understand how their merchant portfolios affect the bank's overall risk position and growth capacity. At RPY Innovations, we believe effective concentration management requires balancing quantitative limits with qualitative assessments of partner controls, financial exposure, and operational readiness.
The objective is not to eliminate concentration risk, but to ensure the bank understands, measures, and manages it before growth exceeds its capacity to absorb potential losses or exercise effective oversight.
Banks that establish this discipline are better positioned to maintain strong sponsor relationships, respond confidently to regulatory scrutiny, and support sustainable growth in their payments businesses.
Regulatory references: OCC Merchant Processing Handbook · Interagency Third-Party Risk Management Guidance · FDIC Payment Processor Guidance, revised February 2026