Over the last four years at Finix, I’ve assisted many companies transition to Payment Facilitators. I’ve written this post to help explain how to become a Payment Facilitator in 8 steps.
Full disclosure, I am an active employee of Finix and highly recommend Finix. Finix can help offload many processes and technology needed to be a Payment Facilitator with an easy graduation path. You can start on our Flex product and graduate eventually to a full Payment Facilitator.
What is a Payment Facilitator?
A Payment Facilitator (PayFac) is a service provider for merchants who want to accept payments online or physically.
A Payment Facilitator provides merchant accounts relatively quickly to businesses or individuals. Payment Facilitators can onboard new merchants because they are onboarded as sub-merchants of the Payment Facilitator, not as merchants of the Payment Processor.
There are many reasons why someone would want to become a Payment Facilitator. I tackle some of these here.
Steps needed to become a Payment Facilitator
To become a Payment Facilitator, you must fulfill a set of legal, technical, and operational changes.
Here is a summary of the steps below:
- Negotiate a Payment Facilitation agreement with a Payment Processor
- Construct a sub-merchant agreement for all your sub-merchants to review and sign
- Achieve PCI-DSS Level 1 or 2 status with a certified QSA
- Integrate into a Payment Processor
- Establish an underwriting and onboarding process
- Onboard and underwrite net-new merchants
- Migrate over your existing customer base
- Create organizational changes and allocate internal resources to handle your new responsibilities as a Payment Facilitator
1. Payment Facilitation agreement with an Acquiring Bank and Processor
To become a Payment Facilitator, you must have an agreement from an Acquiring Bank and Payment Processor explicitly permitting you to be a registered Payment Facilitator.
You can expect to provide business and compliance-related items such as financial statements, customer information, and other KYC (Know Your Customer) information. This is a part of the payment processor and acquiring bank’s due diligence and underwriting process.
You can also expect to apply for a set of MCC codes, so a thorough analysis should be done. Any sub-merchants requiring a different MCC other than the MCC established in the Payment Facilitation Agreement will not be underwritten and thus cannot be successfully onboarded to the Payment Facilitator’s platform.
Note: Each Acquiring Payment Processor and Bank have rules and conditions outside this post's scope.
2. Sub-merchant agreement
As a Payment Facilitator, you take on most of the risk for your sub-merchants. You will need to create a sub-merchant agreement that merchants will sign as a part of the onboarding process.
You should create a sub-merchant agreement that covers your business use cases and is robust enough to handle the worst possible scenarios such as chargebacks, echeck returns, and fraud events. You will also need to ensure that your sub-merchant agreement complies with the standards required by your Acquiring Bank and Processor.
3. Achieve PCI-DSS Level 1 or 2 status with a certified QSA
All Payment Facilitators are required to be compliant with PCI-DSS (Payment Card Industry Data Security Standards) as either a Level 1 (processing more than 300,000 transactions annually) or Level 2 (processing less than 300,000 transactions annually) Service Provider.
The Payment Facilitator’s Acquiring bank and processor will set the specific requirements.
Note: Most Acquiring Banks and Processors will be hesitant to take a Payment Facilitator live without a Level 1 compliance assessment by a third-party QSA (Qualified Security Assessor). Level 2 Service Providers will also sometimes choose to validate as a Level 1 to be on Visa’s Global Registry of Approved Service Providers.
4. Integrate into a payment processor
To become a Payment Facilitator, you must be integrated directly into a Payment Processor. Even with a seasoned payments engineering team, integrating into a Payment Processor could take 12-18 months and possibly longer.
Finix can you integrate into a payment processor
Finix’s robust processor integrations can help with this process. Rather than integrate with the legacy APIs of the payment processor, you can integrate to Finix’s REST APIs. These APIs are available for a non-payment facilitator instance (Flex) and also when you are a Payment Facilitator. There is no need to re-work your implementation later.
5. Establish an onboarding and underwriting process
Payment Faciltiators have a direct relationship with the sub-merchant. As a result, Payment Facilitators take on risks (on behalf of the acquiring bank) and are liable for merchant chargebacks, data breaches, fraud, misappropriated funds distribution, etc.
As a Payment Facilitator, you must conduct compliance checks on your Merchants during the underwriting process, including but not limited to
- KYC (Know Your Customer) and KYB (Know Your Business)
- Global watchlist sanctions screening (OFAC)
- Bank Account Verification
- Credit checks (Optional but dependent on Acquiring Bank and Processor rules)
Entity verification (KYC / Beneficial Ownership)
Before the underwriting process can kickoff, the Payment Facilitator is required to identify the business entity owner(s) per the United States Patriot Act, Bank Secrecy Act (BSA), AML (Anti-Money Laundering) laws, and FinCEN (Financial Crimes Enforcement Network) rules.
FinCEN states that beneficial ownership includes those individuals with a 25% or greater stake in the business entity. However, Acquiring Banks and Processors may classify beneficial owners of high-risk merchants as individuals with a 10% or greater stake in the business entity. Please Note - If there is a change in Beneficial Ownership, the merchant will need to be underwritten again using information collected from the new Beneficial Owner(s).
Sanctions screening (OFAC)
OFAC, officially known as The Office of Foreign Assets Control (OFAC), is a financial intelligence and enforcement agency of the U.S. Treasury Department. It administers and enforces economic and trade sanctions in support of U.S. national security and foreign policy objectives.
As part of your underwriting responsibilities, you must ensure that the sub-merchants you onboard are not on the OFAC list or any global sanctions/watch list. Watch list membership can include the sub-merchant itself (as a business) or individuals (beneficial business owners) who are added to the OFAC list. There are severe penalties for non-compliance, including fines, freezing of assets, and barring parties from operating in the United States.
EIN / TIN match
An Employer Identification Number (EIN) is a unique identification number assigned to a sub-merchant so that it can easily be identified by the Internal Revenue Service (IRS) and is also commonly used by sub-merchants to report taxes. The EIN is also known as a Federal Tax Identification Number (TIN) when it is used to identify a corporation for tax purposes.
Just as the Social Security Number (SSN) is used to identify the individual residents of the United States, the EIN is issued to identify the business entities in the country. The EIN is a unique nine-digit number issued by the IRS. It includes information regarding the sub-merchants corporate taxonomy, such as the city and state of its business registration. The digits of an EIN are formatted as follows: XX-XXXXXXX. The IRS uses the EIN to identify taxpayers required to file various business tax returns.
Sub-merchants looking to operate in the United States must apply for an EIN by phone, online, fax, or by mail.
Bank Account Verification
The Payment Facilitator should verify bank account ownership to ensure that money is deposited into an actual bank account of legitimate record.
There are various rules for liability and responsibility that won’t be explored in this document, but having a good underwriting process can mitigate risk for you and your payments ecosystem.
Finix Underwriting and Compliance Product can underwrite and onboard merchants.
As a Payment Facilitator, you can leverage Finix's underwriting product to underwrite and onboard merchants.
6. Begin underwriting net-new merchants
Once you have successfully become a registered Payment Facilitator and integrated into an Acquiring Payment Processor, you are ready to start underwriting sub-merchants.
You should run a trial period with a small number of sub-merchants to ensure you are ready to scale up in volume. Once you have completed a trial period of sub-merchants, you can start aggressively onboarding and underwriting net-new merchants.
7. Migrate over your customer base
In an ideal world, you do not want to impact existing customers when you graduate to a Payment Facilitator. You can make this seamless transition through careful planning within your organization and mutual coordination.
The biggest hurdles of migrating a customer base are:
- Migrating customer payment card and bank account data
- Having customers execute a new Sub-Merchant Agreement that differs from their original one
8. Organizational changes
Becoming a Payment Facilitator may require changing your current organizational makeup to thoroughly and expeditiously handle this new set of responsibilities.
As a Payment Facilitator, you must provide
- Primary liability for the processing accounts of your underwritten sub-merchants
- Transaction processing support
- Transaction monitoring
- Sub-merchant invoicing
- Other non-processing business services or solutions
Effectively tackling these new responsibilities may require you to retrain colleagues, introduce new operational flows, and make engineering or software modifications to your current product offering.