What acquirers actually do to stay legal while signing up more merchants

A payment acquirer is the bank or processor that sits between a merchant and the payment networks (Visa, Mastercard, American Express). Their job is to move money from customers' cards into the merchant's account—but they also have to make sure that merchant isn't running a scam, laundering money, or violating sanctions. Acquirers expand by onboarding more merchants, but every new merchant is a compliance risk. So they build systems that screen merchants fast enough to say yes or no in hours, not weeks, while still catching the ones that shouldn't be approved at all.

The tension is real: move too slowly and you lose merchants to competitors; move too fast and you face fines from regulators, card networks, and the federal government. Acquirers solve this by layering automated checks, risk scoring, and human review—each layer designed to catch different kinds of problems without grinding the process to a halt.

Key Takeaways

  • Acquirers use automated screening tools that check merchant names against sanctions lists, fraud databases, and high-risk business registries in real time during onboarding.
  • Risk scoring systems assign each merchant a compliance score based on industry, location, transaction patterns, and ownership—high-risk merchants get extra scrutiny or rejection.
  • Acquirers monitor ongoing transactions for red flags like sudden volume spikes, unusual geographies, or patterns matching known fraud schemes, and can freeze accounts mid-contract.
  • Card networks (Visa and Mastercard) set minimum compliance standards that all acquirers must meet, and audit acquirers regularly to ensure they are enforcing those standards.
  • Acquirers often refuse entire categories of merchants—high-risk industries like cryptocurrency exchanges, adult services, or gambling—to avoid the compliance cost of monitoring them individually.

Screening merchants at signup without creating a bottleneck

When a merchant applies to an acquirer, the first layer is automated. The acquirer's system checks the merchant's legal name, ownership names, and business address against multiple databases in seconds: the Office of Foreign Assets Control (OFAC) sanctions list, the FinCEN list of suspected money launderers, state business registries, and fraud databases maintained by payment networks and third-party vendors. If a name matches a sanctions entry or a known fraud operator, the application is rejected immediately—no human review needed.

For merchants that pass the automated screen, a risk-scoring engine takes over. The system assigns a score based on the merchant's industry, the country they operate in, their stated annual volume, the types of products they sell, and the ownership structure. A local bakery in Ohio gets a low score. A cryptocurrency exchange in a high-risk jurisdiction gets a high score. The score determines the next step: low-risk merchants move to approval; medium-risk merchants go to a compliance analyst for a phone call or document review; high-risk merchants are either rejected or sent to senior review.

This layering lets acquirers approve most merchants in hours while still catching obvious problems. The cost is that some legitimate merchants in high-risk industries—remittance services, money transmitters, cannabis retailers in legal states—face delays or rejection even though they are not actually illegal. Acquirers accept this friction because the alternative is regulatory action.

Ongoing monitoring for transaction patterns that signal fraud or evasion

Approval is not the end of compliance. Acquirers monitor every merchant's transactions in real time or near-real time, looking for patterns that suggest fraud, money laundering, or sanctions evasion. A merchant that was approved to sell clothing but suddenly starts processing $500,000 a day in wire transfers triggers an alert. A merchant that was approved for domestic sales but suddenly has 80% of transactions from Iran triggers an alert. A merchant that processes thousands of small transactions in rapid succession—a pattern used to test stolen card numbers—triggers an alert.

When an alert fires, the acquirer's monitoring team reviews the transactions and the merchant's account. They may ask the merchant for documentation—invoices, shipping records, customer contracts—to explain the pattern. If the merchant cannot explain it, or if the explanation does not match the data, the acquirer can freeze the account, reverse recent transactions, and terminate the merchant agreement. This power is essential for compliance but also creates risk for legitimate merchants: a sudden spike in sales due to a viral social media post, or a one-time bulk order from a new customer, can trigger a freeze that the merchant has to fight to reverse.

The monitoring systems are built by the acquirer or licensed from third-party vendors like Actimize, FICO, or Feedzai. These vendors use machine learning to detect patterns that humans would miss, but they also generate false positives—legitimate transactions flagged as suspicious. Acquirers tune the sensitivity of these systems based on their risk appetite and their history with regulators. An acquirer that has been fined for missing fraud will run a tighter system; an acquirer that has been fined for over-blocking will loosen it.

How card networks enforce compliance standards across all acquirers

Visa and Mastercard do not directly onboard merchants—they set the rules that acquirers must follow. Both networks publish detailed compliance requirements in their operating manuals, which run to thousands of pages. These manuals specify which merchants acquirers can and cannot work with, what due diligence acquirers must perform, what monitoring systems they must have, and what documentation they must keep.

Visa's rules, for example, require acquirers to screen merchants against OFAC and FinCEN lists, to verify the merchant's legal identity, to understand the merchant's business, and to monitor for high-risk activities. Mastercard has similar rules. Both networks audit acquirers annually or more often, sending teams to review onboarding files, monitoring logs, and transaction data. If an audit finds that an acquirer approved a merchant that should have been rejected, or failed to detect a fraud pattern, the network can fine the acquirer, require remediation, or in extreme cases, revoke the acquirer's license.

This creates a compliance floor: all acquirers must meet at least the network standards. But acquirers often go beyond the floor. A large acquirer like Chase or Stripe may have compliance standards stricter than Visa's, because they have more to lose from a regulatory fine or a fraud scandal. A smaller acquirer may operate closer to the minimum, accepting more risk to compete on speed and cost.

Why acquirers refuse entire categories of merchants

Rather than try to monitor every merchant in a high-risk category, many acquirers simply refuse to work with entire industries. Cryptocurrency exchanges, online gambling, adult services, and unlicensed money transmitters are common exclusions. The reason is economic: the compliance cost of monitoring these merchants—the staff, the systems, the audit risk—exceeds the revenue the acquirer makes from processing their transactions.

This creates a barrier for legitimate businesses in these categories. A legal cannabis retailer in Colorado or a licensed online poker site may struggle to find an acquirer because most major acquirers have blanket policies against the industry. Some acquirers specialize in high-risk merchants and charge higher fees to cover the compliance cost. Others partner with niche acquirers—a cannabis processor might use a specialized acquirer that focuses only on state-legal cannabis businesses and has built compliance systems tailored to that industry.

The exclusion list also changes over time. When the U.S. government cracked down on online gambling in 2006, acquirers dropped gambling merchants almost overnight. When cryptocurrency became more mainstream, some acquirers began cautiously re-entering the space, though with much stricter monitoring than they use for traditional merchants. Acquirers watch regulatory trends closely because a sudden enforcement action can make an entire category toxic overnight.

How acquirers balance speed against compliance cost

The core tension in acquirer compliance is that every additional check costs money and time. A more thorough background check catches more fraud but delays approval. A more sensitive monitoring system catches more suspicious transactions but also blocks more legitimate ones. An acquirer that wants to grow fast has to accept more risk; an acquirer that wants to minimize risk has to accept slower growth.

Different acquirers make different bets. Stripe and Square built their early growth on fast onboarding—they approved merchants in minutes using mostly automated checks, accepting higher fraud losses in exchange for volume. Traditional acquirers like Chase and Bank of America moved slower, requiring more documentation and manual review, but had lower fraud rates. Over time, the fast acquirers built better monitoring systems and tightened their onboarding, while the traditional acquirers automated more of their screening. The gap has narrowed, but it has not closed.

Regulatory pressure also shapes the balance. After the 2008 financial crisis, regulators increased scrutiny of acquirer compliance, particularly around sanctions screening and anti-money-laundering. Acquirers responded by investing heavily in compliance infrastructure. A large acquirer today may have hundreds of compliance staff and millions of dollars in monitoring systems. A smaller acquirer may outsource compliance to a third-party processor or use a lighter-touch model. Both approaches are legal, but they carry different risks and costs.

What happens when an acquirer gets compliance wrong

When an acquirer fails to catch a fraud merchant or misses a sanctions violation, the consequences are severe. The card networks can fine the acquirer millions of dollars. Federal regulators—the Office of the Comptroller of the Currency (OCC), the Federal Reserve, or FinCEN—can impose consent orders requiring the acquirer to overhaul its compliance program. In extreme cases, regulators can revoke an acquirer's license to operate.

In 2015, HSBC was fined $100 million by U.S. regulators for failing to screen merchants against sanctions lists. In 2019, PayPal agreed to pay $25 million to settle allegations that it processed transactions for merchants in sanctioned countries. These fines are not just penalties—they signal to the market that compliance failures are expensive, which pushes all acquirers to invest more in compliance infrastructure.

The cost of a compliance failure also extends beyond fines. An acquirer that becomes known for processing fraud or sanctions violations loses merchant trust and may lose relationships with card networks or banks. Merchants want to work with acquirers they trust will not freeze their accounts or shut them down. Banks want to work with acquirers that will not expose them to regulatory risk. A single major compliance failure can damage an acquirer's reputation for years.

Frequently Asked Questions

Why did my merchant account get frozen after I had a spike in sales?

Acquirers monitor for sudden changes in transaction volume or patterns because these can signal fraud or money laundering. A legitimate spike in sales can trigger the same alerts as a fraudulent one. If your account was frozen, contact your acquirer's support team with documentation of the spike—invoices, customer orders, marketing campaigns—to explain the pattern. Most acquirers will unfreeze accounts once they verify the transactions are legitimate.

Can an acquirer refuse to work with me because of my industry?

Yes. Acquirers can refuse merchants in any industry they classify as high-risk, including cryptocurrency, online gambling, adult services, and unlicensed money transmission. If you are in one of these categories, look for acquirers that specialize in your industry—they have built compliance systems designed for your business and are more likely to approve you.

What is OFAC screening and why does it matter?

OFAC (Office of Foreign Assets Control) maintains a list of individuals and companies that the U.S. government has sanctioned, usually for national security or foreign policy reasons. Acquirers must screen merchant names against this list to avoid processing transactions for sanctioned entities. If a merchant's name matches a sanctioned entry, the acquirer must reject the application or freeze the account, even if the merchant is not actually the sanctioned party.

How long does merchant onboarding usually take?

Low-risk merchants can be approved in hours or minutes if they pass automated screening. Medium-risk merchants typically take one to three business days for manual review. High-risk merchants may take a week or more, or may be rejected. The timeline depends on the acquirer's risk appetite, the merchant's industry, and how quickly the merchant responds to document requests.

What happens if I process transactions for a sanctioned country by accident?

If you process even one transaction for a sanctioned country or entity, your acquirer is required to report it to FinCEN and may freeze your account pending investigation. The acquirer may also terminate your merchant agreement. If this happens, work with a lawyer familiar with sanctions law—the consequences can include civil penalties and, in rare cases, criminal charges. Prevention is much easier than remediation.