What a payment facilitator actually is, and whether you need to become one

A payment facilitator (often called a PayFac) is a company that lets other businesses accept card payments without those businesses having to set up their own merchant accounts directly with banks. Instead of each small business negotiating with a bank, the PayFac holds the master merchant account and lets smaller merchants operate under it. You become a PayFac when you build the infrastructure to do this and register with the card networks (Visa, Mastercard, Discover, American Express).

Most people do not need to become a PayFac. If you want to accept payments for your own business, you can use an existing PayFac like Square, Stripe, or PayPal instead. You only pursue this path if you want to be the company that enables other businesses to accept payments—meaning you are building a platform, software, or service where payment acceptance is a core feature you offer to customers.

The barrier to entry is real. You will need significant capital, legal structure, compliance infrastructure, and technical capability. This is not a side business or a quick revenue stream. Banks and card networks treat PayFacs as financial institutions because they handle other people's money.

Key Takeaways

  • You need a master merchant account from a bank, which requires a business license, financial statements, and often $50,000 to $250,000 in liquid capital or revenue history.
  • You must register with Visa and Mastercard directly through their sponsoring bank and meet their specific PayFac requirements, which include fraud prevention systems and transaction monitoring.
  • You will need a Payment Processor Service Agreement with an acquiring bank and a Sponsorship Agreement with that bank to operate under their master account.
  • Building the technical infrastructure—APIs, encryption, PCI compliance systems, settlement routing—typically costs $100,000 to $500,000 and takes 6 to 18 months.
  • You must maintain compliance with PCI DSS (Payment Card Industry Data Security Standard), state money transmitter laws, and anti-fraud requirements, with ongoing audits and reporting.

The capital and banking requirements you need first

Before you can register with card networks, you need a master merchant account from a bank. This is not the same as a regular business checking account. The bank is essentially saying they will hold the liability for all the transactions you process on behalf of your sub-merchants, so they underwrite you heavily.

Most acquiring banks require proof of financial stability. This typically means one or more of the following: a minimum of $50,000 to $250,000 in liquid capital (the exact amount varies by bank and your business model), two years of business tax returns showing revenue, a personal may provide from the owner, and a detailed business plan explaining how you will manage fraud and disputes. Some banks will accept a lower capital requirement if you have a track record processing payments or if you have a strategic investor backing you.

You will also need to choose an acquiring bank—the institution that will sponsor your master merchant account and your relationship with the card networks. This is not a choice you make freely. The bank chooses whether to work with you. Common acquiring banks for PayFacs include Stripe's banking partners, Galileo, Marqeta's banking relationships, and traditional banks like JPMorgan Chase or Bank of America, but each has different underwriting standards and different fees. You will likely need to explore to multiple banks and expect rejection from some.

Registration with Visa, Mastercard, and other networks

Once you have a master merchant account and a sponsoring bank, you must register directly with Visa and Mastercard as a Payment Facilitator. This is a formal designation with specific requirements. You cannot skip this step or work around it—the card networks will not process transactions from your sub-merchants unless you are registered.

Visa's PayFac registration requires you to submit detailed information about your business, your technical infrastructure, your fraud prevention systems, and your financial controls. Mastercard has a similar process called Mastercard Service Provider Registration. Both networks will ask for documentation of your compliance program, your transaction monitoring systems, and your dispute resolution process. The process process typically takes 4 to 12 weeks, and the networks may request additional information or clarification multiple times.

Each network also charges registration fees (typically $1,000 to $5,000 per network) and ongoing compliance fees. You will also need to maintain a Compliance Officer on staff or hire one as a consultant—someone responsible for monitoring your sub-merchants for fraud, money laundering, and violations of network rules. This person will file reports with the networks and manage your relationship with them.

Building the technical infrastructure and systems

You cannot operate as a PayFac without the technology to support it. You need to build or purchase systems that handle payment processing, settlement, reporting, and compliance. This is where most of the cost and time comes in.

At minimum, you need: an API (process Programming Interface) that lets your sub-merchants integrate payment acceptance into their software or point-of-sale system; encryption and tokenization systems that protect card data so you do not have to store it directly (this is a core PCI requirement); a settlement system that routes funds from the card networks to your sub-merchants' bank accounts, minus your fees; a reporting dashboard where sub-merchants can see their transactions, disputes, and chargebacks; and fraud detection and monitoring tools that flag suspicious activity.

You can build this yourself if you have experienced payment engineers on staff, or you can license technology from a payment processor or PayFac-as-a-Service provider (companies like Stripe Connect, Adyen for Platforms, or Fiserv offer this). Licensing typically costs $10,000 to $50,000 per month plus transaction fees, while building in-house costs $100,000 to $500,000 upfront and requires ongoing maintenance. Either way, expect 6 to 18 months before you are live.

PCI compliance and ongoing regulatory requirements

As a PayFac, you are responsible for PCI DSS (Payment Card Industry Data Security Standard) compliance. This is not optional and not a one-time checkbox. PCI DSS is a set of 12 requirements covering how you store, process, and transmit card data. You must achieve and maintain one of four compliance levels depending on your transaction volume. Most PayFacs operate at Level 1 (the highest standard), which requires annual third-party audits and quarterly vulnerability scans.

You will also need to comply with state money transmitter laws. Most states require payment processors and PayFacs to register as money transmitters, which involves background checks, net worth requirements, and surety bonds. The requirements vary significantly by state—some states require $500,000 in net worth, others require $1 million or more. You will need to register in every state where you have sub-merchants or where you operate.

Beyond PCI and money transmitter registration, you must implement Know Your Customer (KYC) and Anti-Money Laundering (AML) programs. This means you verify the identity of every sub-merchant you onboard, screen them against government watchlists, and monitor their transaction patterns for suspicious activity. You will file Suspicious Activity Reports (SARs) with the Financial Crimes Enforcement Network (FinCEN) if you detect potential money laundering or fraud.

The contracts and agreements you will sign

Operating as a PayFac requires multiple legal agreements, each with specific obligations. The primary agreement is your Sponsorship Agreement with your acquiring bank. This document outlines your responsibilities, the bank's responsibilities, how disputes are handled, what happens if you violate network rules, and how the relationship can be terminated. Banks typically require you to maintain specific financial ratios, keep minimum capital reserves, and report monthly on your transaction volume and chargeback rates.

You will also sign a Payment Processor Service Agreement with the bank, which covers the technical and operational aspects of processing. This agreement specifies transaction fees, settlement timing, what happens if there are system failures, and your liability for fraud or errors.

With Visa and Mastercard, you sign Operating Regulations that govern how you can operate. These are not negotiable—you accept them as written. They cover rules about sub-merchant onboarding, dispute handling, chargeback limits, and what happens if you violate network rules (which can include fines, restricted processing, or termination).

Finally, you will create Sub-Merchant Agreements that your customers sign. These agreements outline what you charge them, what services you provide, what happens if they violate payment network rules, and how disputes are resolved. These agreements must comply with network rules and cannot shift all liability to the sub-merchant.

The realistic timeline and total cost

From the day you decide to become a PayFac to the day you process your first transaction, expect 12 to 24 months. The timeline breaks down roughly like this: 2 to 4 months to find a master merchant account and sponsoring bank relationship; 4 to 12 weeks for card network registration; 6 to 18 months to build or license and customize your technical platform; 2 to 4 months for final compliance audits and testing; and 2 to 8 weeks for go-live preparation.

Total cost varies widely depending on whether you build or license technology and how many sub-merchants you plan to support. A conservative estimate: $200,000 to $750,000 in the first year, including capital requirements for the master merchant account, technology development or licensing, compliance infrastructure, legal fees, and staffing. Ongoing annual costs (compliance audits, network fees, fraud monitoring, staffing) typically run $50,000 to $200,000 depending on transaction volume.

This is why most companies do not become PayFacs independently. Instead, they use a PayFac-as-a-Service provider (like Stripe Connect or Adyen for Platforms) and pay a percentage of each transaction. You give up some margin but avoid the capital requirement and regulatory burden.

Frequently Asked Questions

Can I become a PayFac without a sponsoring bank?

No. You must have a master merchant account with a bank, and that bank must sponsor your relationship with the card networks. The bank is the entity that holds the liability for your sub-merchants' transactions. You cannot process card payments without this relationship.

What is the difference between a PayFac and a Payment Service Provider (PSP)?

A PayFac holds a master merchant account and lets sub-merchants operate under it. A PSP typically does not hold the master account—instead, it partners with a PayFac or acquiring bank. If you want to offer payment processing to other businesses, you need to be a PayFac or partner with one.

Do I need to be a corporation, or can I operate as a sole proprietor?

Most acquiring banks require you to be a registered business entity (LLC, C-Corp, or S-Corp). Sole proprietorships are rarely accepted because banks want a legal entity separate from the owner. You will also need an Employer Identification Number (EIN) from the IRS.

What happens if one of my sub-merchants commits fraud?

You are liable. Your sponsoring bank and the card networks hold you responsible for your sub-merchants' actions. This is why fraud monitoring and sub-merchant vetting are critical. You must have systems in place to detect and stop fraudulent activity, and you must be able to demonstrate that you took reasonable steps to prevent it.

Can I start small and grow, or do I need all the infrastructure from day one?

You need the core infrastructure from day one: PCI compliance, fraud monitoring, KYC/AML programs, and technical systems. You cannot launch without these. However, you can start with a smaller number of sub-merchants and scale your operations as you grow. Your compliance obligations do not change based on size—they are the same whether you have 10 sub-merchants or 10,000.