You signed a merchant agreement with a company whose name does not appear on your settlement statement. Now payouts are held, your rep says the bank made the call, and the bank has no record of ever speaking to you. That gap is the ISO model working exactly as designed. This settles who holds your account, who sets your reserve, who can end you, and which of them you are actually talking to.
The 4 parties in the chain, and which of them can approve you
Every card acceptance deal has an acquirer underneath it: a bank licensed by Visa and Mastercard that holds the BIN, moves your settlement, and absorbs the loss if you disappear owing chargebacks. Everything above it is a sales, service or technology layer, and none of them carries that loss. Visa says as much in its guide to acceptance entities: the acquirer remains responsible for the acts and obligations of not only sellers, but any other entity operating between or on behalf of the acquirer and the seller.
An ISO is the sales and service layer for that bank. Visa calls it an Independent Sales Organization. Mastercard registers the same kind of company through its own service provider program, where the trade shorthand is Member Service Provider. Hence ISO/MSP on your contract. A payment facilitator is a different animal. Visa defines it as a third party agent that can sign a merchant acceptance agreement with a seller on behalf of an acquirer, and receive settlement proceeds on that seller's behalf, and says doing either of those makes you a facilitator even if you do not do both. If you went live in 20 minutes with no bank interview, you are a sponsored merchant, not a merchant.
The last layer is your gateway. In Visa's framework a service provider contracted directly to the seller, rather than through the acquirer, is a Merchant Servicer, and Visa's comparison table marks Merchant Servicers as having no contract with the acquirer at all. Your gateway cannot get your reserve released. It has no relationship with the party holding it.
What an ISO is registered to do, in the network's own words
Visa's Third Party Agent Registration Program FAQ spells out what makes a company an ISO. An ISO solicits merchant or cardholder accounts, discusses pricing, fees or rates, processes merchant accounts, discusses terms and agreements, manages and drafts contracts, and submits contracts to the acquirer or issuer that registered it.
Read that list for what is missing. Approving you is missing. Holding your funds is missing. Setting your reserve is missing. Visa's 2024 guide is blunter still: ISOs do not process transactions, do not receive settlement funds, and have no access to the processing environment, and an ISO that starts processing gets reclassified as a Third Party Servicer. So a provider offering to pay you out of an account it controls is acting as a facilitator, a servicer, or something with no registration at all, whatever the letterhead says.
Registration is also not something an ISO does for itself. Visa's FAQ is explicit: only Visa clients can register agents, agents cannot register themselves, and acquirers must not process applications from an entity they have not registered as an ISO. The bank pays for it, too. Visa's published schedule puts ISO registration and annual renewal at $5,000 per agent, and says the fine for using an unregistered third party agent starts at $10,000 per agent. There is also a separate High Risk ISO category, for an ISO contracted to solicit high brand risk merchants.
Whose paper you are on when it goes wrong
In an ISO deal you get your own merchant ID and the bank is on the hook for the contract. Visa states it directly: ISOs operate as agents on behalf of acquirers, so when sellers sign services contracts with an ISO they are signing with the acquirer. Ask which acquirer.
A facilitator deal runs the other way. Visa's February 2024 guide says facilitators hold the primary relationship with their sponsored merchants, and that the facilitator only has to add the acquirer to the merchant acceptance agreement once the sponsored merchant's annual Visa sales pass a threshold, given there as US $1,000,000. Below it, the bank is not on your paper. Above it, you get an underwriting request from a bank you never chose, which is why merchants who scale fast suddenly meet their acquirer.
Neither structure escapes the bank's appetite: Visa says its requirements apply to a sponsored merchant as if it had contracted with an acquirer directly. What changes is how many parties stand between you and the person who can say yes, and how many of them can end you without asking anyone. Before you sign, find these 4 things on the paper itself:
- The legal name and address of the acquiring bank, printed in the agreement, not the brand on the website.
- Whether that bank actually signs, or is only mentioned in a recital.
- The entity named as payee on settlement, which tells you who is holding your funds.
- The termination clause, specifically who is entitled to report a termination and to which database.
Who sets the reserve, and who can release it
Underwriting authority sits with the bank, because the bank carries the loss. Some ISOs run their own credit and risk teams and make the first call. Others do no underwriting and forward applications untouched. The trade calls those wholesale and retail: a wholesale ISO carries underwriting and financial risk for what it signs and sets its own pricing, a retail ISO does neither. Here is the part nobody volunteers. Guidance from the payment facilitator industry says the card brand rules do not define either term. So a provider calling itself a wholesale ISO has told you what it wants you to think, not something you can check.
Authority is checkable. Ask in writing what their sponsor agreement lets them decide, and who signs off a reserve reduction on the bank side. A reserve has 3 terms that matter: the percentage held, the hold period, and the written condition that releases it. If the release condition is missing, the reserve is discretionary, reviewed when the bank feels like reviewing it. That is the same problem as the first 14 days of a payout freeze, where knowing which entity is physically holding the money decides who you write to and what you send.
The bank is being scored on you
This is the mechanism behind most reserve decisions and almost nobody explains it to merchants. On 1 June 2025 Visa folded its fraud monitoring and dispute monitoring programs into a single Visa Acquirer Monitoring Program. The metric is a count based ratio on card not present transactions: fraud reports plus disputes, divided by settled transactions.
Visa identifies an acquirer's portfolio as Above Standard at 50 bps and Excessive at 70 bps. The merchant threshold is much looser. In the US, Canada, the EU and Asia Pacific a merchant is Excessive at 220 bps with at least 1,500 fraud and dispute records in a month, and a footnote in Visa's own fact sheet drops that merchant threshold to 150 bps in the same regions on 1 April 2026.
Now read the line that sits between those 2 numbers. The merchant thresholds apply if the acquirer is not itself Above Standard or Excessive. The bank's ratio is tested first, and the bank's line is 50 bps. Yours is 150. A merchant sitting at 1.2% is comfortably inside the merchant rule and still heavy enough to drag a small portfolio toward the bank's line, so that merchant gets a reserve, or a quiet decline, and is never told why. The raw count matters as much as the rate, which is the trap in a dispute rate that reports last month's ad spend. A good ISO can tell you roughly where the sponsor's portfolio sits. A broker tells you that you are fine because you are under 1%.
Some categories are registered, not just approved
Approval is not the only gate. Visa runs an Integrity Risk Program that requires merchants in specified high integrity risk areas to be registered by their acquirer, requires heightened due diligence on them, and makes the acquirer certify every quarter that they meet the program's requirements and the law. Visa publishes that structure but not the category list or the fees, so the specifics below are trade reporting, not a quote from the rules.
Compliance vendors and the trade press describe 3 tiers keyed to merchant category codes. Tier 1 covers adult content, dating and escort services, gambling and pharmacies, on codes including 5967, 7273, 7995, 5122 and 5912. Tier 2 covers cryptocurrency, cyberlockers and card absent games of skill. Tier 3 covers outbound telemarketing on 5966, cross border tobacco on 5993, and subscription negative option billing on 5968. Now read that list for what is absent. Supplements and skincare have no high integrity risk code of their own, so whether you land inside the program is decided by the code your ISO picks, not by what you sell. A supplement that rebills by default can be boarded on 5968 and sit inside it. The same offer on a generic direct marketing code sits outside, until somebody looks.
The fees are why a broker steers around the conversation. Reporting on the schedule in force since 1 April 2024 puts merchant registration at $950, up from $500, plus $0.10 per transaction and 10 bps on processed volume, and acquirer registration and annual renewal at $100,000 for the top 2 tiers. Boarding you correctly costs the bank money before you process a dollar. Coding you wrong saves that money and moves the exposure to you. So ask the code question before you send documents. An ISO that boards you under a code that does not describe your offer has not got you approved. It has scheduled your termination for whenever somebody reconciles the descriptor against the site.
The questions that separate an ISO from a broker
Each question below takes under 30 seconds to answer for somebody who actually holds the relationship, and produces fog from somebody who does not. Ask by email, so the answers exist in writing.
2 of them you can grade without trusting the reply. Visa publishes a Global Registry of Service Providers, refreshed monthly, that anyone can search by company name. It lists agents with validated PCI DSS compliance, so an ISO that never touches cardholder data has no reason to appear. But a company that stores or transmits your card data and cannot be found there under a name it will admit to is worth a slower conversation.
The other is the termination question, where the correct answer is always the bank. Visa's merchant screening service requires an acquirer to add a terminated listing for a merchant, sponsored merchant or third party agent 1 business day after termination when the criteria are met, and lets acquirers search those listings going back 5 years. Mastercard's MATCH records purge after 5 years as well. A provider who says a termination report is their own decision does not understand their own contract.
- Which bank is the acquirer? Legal entity name, in writing, before I sign anything.
- Under what legal name are you registered with that bank, and in which service provider category?
- Which merchant category code will I be boarded under, and does the sponsor hold the high risk registration for it?
- Is the bank a signatory to my agreement, or am I a sponsored merchant under yours?
- What is the reserve percentage, the hold period, and the exact written condition that releases it?
- Who at the bank approves a reserve reduction, and what evidence have they accepted before?
- If your sponsorship with this bank ends, does my merchant ID move, who tells me, and when?
- If you terminate me, who files the listing, to which database, and under which reason code?
- How are you paid on my account? Basis points on volume, a split of the markup, or a flat fee?
What you are actually buying is the counterparty
An ISO is paid residuals, a share of the markup over interchange, counted in basis points on the volume you push. Nothing shady in that, but it means 2 things. Your adviser earns more as you process more, and their income exists only while you stay on that sponsor's paper. Neither makes them wrong. Both predict which risks they raise with you early and which they let you find later.
The honest trade off is that on a sponsored structure you do not hold the paper. Somebody else's license, appetite and payment history keep you live, and you inherit their ceiling. That is a real cost, and a provider who pretends otherwise is selling you something. The same trade off runs through media buying, where an agency ad account is also somebody else's paper.
What you get to choose is whose ceiling you inherit and how the bill is calculated. Delivery follows the volume and payment record of the entity above you, which is why an account issued off a portfolio spending around $50 million a month behaves differently from a freshly opened account. Pricing is the other half. A cut of throughput means your cost climbs with the exact number you are trying to grow, which is worked through in flat fee or a cut of your spend. The alternative is a flat monthly rate with no percentage of spend, where the bill stops tracking volume and behaves like every other fixed line.