Sponsor-Bank and Card-Brand Requirements: What Payment Facilitators Need to Get Right

Becoming a Payment Facilitator (PayFac) creates significant opportunities. It allows a company to control more of the merchant experience, streamline onboarding, integrate payments directly into software, and create new revenue streams.

It also changes the company’s responsibilities.

A PayFac is not simply a technology company connecting merchants to payment processing. It operates within a framework established by its sponsor bank, Visa, Mastercard, and other card brands. That framework places significant responsibility on the PayFac for merchant underwriting, monitoring, compliance, transaction activity, settlement, reporting, and risk management. In short, the company is now a payments company as well.

For growing PayFacs, understanding the relationship between card-brand requirements and sponsor-bank expectations is essential.

The Sponsor Bank Remains Responsible

One of the most important concepts in the PayFac model is that delegating responsibilities does not necessarily delegate accountability.

Mastercard permits an acquirer to allow a PayFac to perform functions including verifying that sponsored merchants are legitimate businesses, maintaining underwriting records, paying sponsored merchants, supplying necessary acceptance materials, and monitoring merchant activity. However, the acquirer remains responsible for ensuring those obligations are fulfilled.

Visa similarly places responsibility on the acquirer to conduct due diligence on the PayFac, register the PayFac appropriately, monitor its compliance, and ensure proper due diligence occurs when sponsored merchants are signed.

The sponsor bank is therefore not simply providing access to card processing. It is sponsoring the PayFac into the payments ecosystem and accepting risk associated with that relationship. This explains why sponsor-bank requirements can be more detailed than prospective PayFacs initially expect.

Merchant Onboarding Is Only the Beginning

PayFac compliance begins with merchant onboarding, but it does not end there.

Effective underwriting requires processes capable of establishing that merchants are legitimate businesses and that their activities are consistent with the information they provide. That generally means collecting and validating information such as ownership, business type, products and services, expected transaction volume, average ticket, payment channels, geography, website activity, and other risk indicators.

Card brands also expect accurate merchant identification. Mastercard requires PayFacs to maintain information such as sponsored-merchant names, addresses, and URLs and to provide this information when requested. Visa requires identifiers for the PayFac and its sponsored merchants to be incorporated into transaction processing so activity can be properly attributed.

Onboarding information cannot simply disappear into an application file after approval. It should become the baseline against which future merchant behavior is evaluated.

Ongoing Monitoring Is Increasingly Important

A merchant that appeared low risk when approved may look very different six months later.

Volumes may increase dramatically. Average tickets can change. Products or services can evolve. Chargebacks may rise. Fraud patterns may emerge. A merchant may begin selling through new channels or entering new geographic markets.

PayFacs therefore need monitoring capable of identifying material changes in merchant behavior.

Visa emphasizes monitoring transaction activity at both the PayFac and individual sponsored-merchant level. Mastercard is similarly increasing expectations around merchant monitoring. In 2026, Mastercard described standards requiring acquirers and PayFacs to investigate certain potential scam activity within 72 hours once specified risk signals are reached.

The broader direction is clear: identifying problems only after losses occur is increasingly insufficient. Expectations are moving toward earlier detection, investigation, documentation, and intervention.

Exceptions Matter as Much as Normal Processing

A PayFac program should not be evaluated only by what happens when everything works correctly. Sponsor banks and card brands also want to understand how exceptions are handled.

What happens when identity verification fails? Who can override an underwriting decision? What happens when a merchant exceeds expected volume? How are unusual transaction patterns investigated? Who reviews merchants approaching fraud or dispute thresholds? How quickly are high-risk cases escalated?

Termination procedures are equally important. Visa’s Merchant Screening Service illustrates this expectation. Acquirers are required to query relevant termination information before onboarding prospective merchants and other agents, while qualifying terminations must be reported.

Clearly documented exception, escalation, and termination procedures are hallmarks of a mature PayFac program.

Reporting Must Give the Sponsor Bank Visibility

One of the most common areas of friction between PayFacs and sponsor banks is reporting.

The PayFac may believe its monitoring system is working appropriately. The sponsor bank, however, needs evidence.

That typically means dashboards, exception reports, merchant-level transaction data, fraud metrics, dispute trends, underwriting statistics, monitoring results, remediation status, and escalation reporting.

Mastercard requires acquirers to maintain visibility into sponsored-merchant activity and, in certain circumstances, report merchant information including transaction counts, transaction amounts, MCCs, and chargeback activity. Visa likewise requires sponsor-bank oversight of the PayFac and may require detailed sponsored-merchant activity reporting.

The strongest PayFac programs design reporting around a simple question:

Can the sponsor bank understand the risk of the portfolio without having to reconstruct it themselves?

If the answer is no, the reporting model likely needs improvement.

Growth Can Change the Requirements

Successful merchants do not necessarily remain within the same contractual framework indefinitely.

Visa rules, for example, generally require an acquirer to establish a direct merchant agreement with a sponsored merchant once that merchant exceeds $1 million in annual Visa transaction volume, subject to specified exceptions.

PayFacs therefore need processes for identifying merchants approaching relevant thresholds and determining what additional registration, contracting, or oversight requirements may apply.

Growth should trigger controls—not surprises.

Sponsor-Bank Requirements May Exceed the Minimum

PayFacs frequently ask whether a requirement comes from the card brands or from the sponsor bank. Sometimes the answer is both.

Card-brand rules establish the broader framework, but sponsor banks develop their own risk appetite, operational standards, reporting requirements, approval processes, concentration limits, prohibited-business lists, and escalation expectations.

Two PayFacs operating under the same card-brand rules may therefore encounter very different sponsor-bank requirements.

The objective should not simply be to determine the minimum requirement contained in a rulebook. It should be to build an operating model capable of satisfying card-brand requirements while demonstrating to the sponsor bank that those requirements are being executed consistently.

Build the Program Before the Review

PayFac compliance programs should be designed into operations rather than assembled in preparation for an audit.

Policies should match actual processes. Merchant data should flow effectively among underwriting, risk, transaction monitoring, and reporting systems. Exceptions should be documented. Escalations should have clear owners. Reporting should be reproducible. Sponsor-bank requests should be tracked through completion.

Most importantly, management should be able to explain how the organization knows its controls are working.

The question from a sponsor bank or card brand is increasingly not:

“Do you have the required policy?”

It is:

“Can you show us that the policy works?”

RPY Innovations works with PayFacs, sponsor banks, fintech companies, ISVs, and embedded-payment providers to evaluate PayFac operating models, merchant onboarding, risk management, card-brand compliance, transaction monitoring, reconciliation, reporting, and sponsor-bank oversight.

If your PayFac program is growing—or your sponsor bank is asking more detailed questions—RPY Innovations can help evaluate whether your operating environment is prepared for the next level of scrutiny.

Visit RPY Innovations Insights to learn more or contact RPY to discuss your PayFac program.