Third-party payment providers are companies that let businesses accept credit cards, debit cards, and digital wallet payments without opening a traditional merchant account at a bank. They sit between the buyer and the seller, bundling many merchants under a single master account with an acquiring bank so a freelancer or small shop can start taking card payments in a day or two instead of waiting through weeks of underwriting. In exchange for that convenience, you pay per-transaction fees, agree to the provider’s risk rules, and sit inside a federal and state regulatory framework that governs anti-money laundering, consumer disputes, tax reporting, and card data security.
How a Payment Provider Moves Your Money
When a customer pays, the provider captures the card details, sends an authorization request through the card network, and confirms the funds are available. Once authorized, it collects the money from the buyer’s bank and deposits it into your balance. For credit card payments, settlement into the merchant’s account typically takes one to three business days after the transaction.
Because the provider holds the master merchant account, you’re a sub-account under its umbrella. That’s what makes signup fast, and it’s also why the provider can freeze or close your account on its own terms if something looks wrong.
What It Costs to Accept Payments
Every transaction carries a fee. Credit card processing generally runs 1.5% to 3.5% of each transaction, often with an added flat charge of 5 to 30 cents per transaction. The flat portion makes small-dollar sales proportionally more expensive to process.
Most third-party providers use flat-rate pricing, which bundles card network fees, interchange, and the provider’s markup into one percentage. You pay the same rate whether the customer uses a basic debit card with low interchange or a premium rewards card with high interchange. Businesses with enough volume can seek out interchange-plus pricing, where you pay the actual network interchange rate plus a transparent markup.
Beyond the headline rate, several other charges show up:
- Monthly subscription fees. Some providers charge nothing; others charge $40 to $150 or more per month for advanced point-of-sale features, dashboards, or lower per-transaction rates.
- Chargeback fees. When a customer disputes a charge, you typically pay $20 to $100 per dispute on top of refunding the transaction.
- Cross-border fees. International transactions and currency conversions often add 1% to 3% on top of the standard fee.
- Manual-entry surcharges. Keying in a card number rather than swiping or tapping costs more, because manually entered transactions carry higher fraud risk.
Opening an Account
Signup is designed around the federal know-your-customer rules providers must follow. For an individual, you’ll need a Social Security Number and a government-issued photo ID such as a driver’s license or passport. For a business entity, you’ll need an Employer Identification Number, which you can apply for online through the IRS at no cost and receive immediately on approval.1Internal Revenue Service. Get an Employer Identification Number The underlying form is Form SS-4, though the online process handles everything without a paper filing.2Internal Revenue Service. About Form SS-4, Application for Employer Identification Number (EIN)
You’ll also hand over the routing and account numbers for the bank account where deposits should land. Enter your legal name exactly as it appears on government records; a mismatch is one of the most common reasons verification fails. Review usually takes one to three business days, and many providers confirm the bank account by sending two small deposits between $0.01 and $0.99 that you then verify in the portal.
High-Risk Categories
Not every applicant gets approved. Each business is assigned a merchant category code reflecting its industry, and certain codes are flagged as high-risk. Gambling, telemarketing, firearms sales, travel services, and digital goods are commonly on that list. If you fall into one of these categories, expect higher fees, a mandatory reserve (where the provider holds back a percentage of revenue for 90 to 180 days), or denial from some mainstream aggregators. Specialized high-risk processors exist, but their rates run significantly higher.
What Gets an Account Frozen
A chargeback happens when a customer disputes a transaction with their bank instead of asking you for a refund. The bank reverses the charge, pulls the money from your provider, and the provider pulls it from you. You lose the sale and pay the chargeback fee. Even disputes you win still count against your account’s risk profile.
Excessive chargebacks are the leading cause of account freezes and terminations. Most providers start scrutinizing accounts when the chargeback rate rises above 1% of total transactions. Other common freeze triggers include:
- Processing significantly more than your declared monthly volume or average transaction size.
- Selling goods or services not described in your original merchant agreement, especially prohibited categories.
- Factoring, meaning running another person’s or business’s transactions through your account. This violates every provider’s terms of service.
When a provider freezes an account, it holds your funds during an investigation. Holds can last weeks, and for high-risk accounts, reserve holds of 90 to 180 days are standard. In some cases, the hold extends indefinitely until the provider is satisfied the risk has passed. Prevention is the real protection: keep detailed records, respond to disputes quickly, use clear billing descriptors so customers recognize the charge on their statement, and stay within the volume you declared at signup.
Your Rights When Something Goes Wrong
The Electronic Fund Transfer Act gives you specific rights when money moves electronically, and the Consumer Financial Protection Bureau extends those protections to payment providers that aren’t traditional banks.3Office of the Law Revision Counsel. 15 USC 1693b – Regulations Two of those rights matter most in daily use.
Unauthorized Transfer Liability
If someone takes money from your account without permission, your maximum liability is $50, provided you notify the provider promptly.4Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability If you don’t report a lost or stolen card or access device within two business days of learning about it, your exposure rises to $500. Wait more than 60 days after your statement is sent, and the provider has no obligation to reimburse losses that happen after that 60-day window. Report fast.
Error Resolution
When you report an error, the provider must investigate and deliver a determination within 10 business days.5Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution If it needs longer, it can extend to 45 days, but only if it provisionally credits your account for the disputed amount within those first 10 business days. You have use of the money while the investigation continues.6Consumer Financial Protection Bureau. Regulation E 1005.11 – Procedures for Resolving Errors For new accounts (within 30 days of the first deposit), those timeframes stretch to 20 business days and 90 days. If the provider finds no error, it must explain its findings and may debit the provisional credit back.
Form 1099-K and Your Tax Reporting
Payment providers must report the gross dollar amount of reportable transactions they settle for each seller to the IRS using Form 1099-K. The obligation falls on what the tax code calls “third-party settlement organizations.”7Office of the Law Revision Counsel. 26 USC 6050W – Returns Relating to Payments Made in Settlement of Payment Card and Third Party Network Transactions You get a copy; so does the IRS.
The threshold has moved around. The American Rescue Plan Act of 2021 lowered it to $600 with no transaction count, but that figure was repeatedly delayed and never took full effect. The One Big Beautiful Bill retroactively reinstated the original threshold: a provider is not required to file a 1099-K unless your payments exceed $20,000 and your transactions exceed 200 in a calendar year.8Internal Revenue Service. IRS Issues FAQs on Form 1099-K Threshold Under the One Big Beautiful Bill Both conditions must be met.
When a 1099-K is required, the provider must furnish your copy by January 31 of the following year.9Internal Revenue Service. Publication 1099 (2026) Fail to give the provider a valid taxpayer identification number and backup withholding kicks in: the provider withholds a percentage of your gross payments and sends it to the IRS.10Office of the Law Revision Counsel. 26 USC 3406 – Backup Withholding The current rate is 24%, and recovering it means filing a return and claiming a credit. Give accurate tax information at signup and this never comes up.
The Rules Providers Operate Under
Any provider that transmits funds is a money services business under federal law. The Bank Secrecy Act directs the Treasury Department to require these businesses to keep records and file reports aimed at detecting money laundering and terrorist financing.11Office of the Law Revision Counsel. 31 USC 5311 – Declaration of Purpose A provider must register with the Financial Crimes Enforcement Network within 180 days of starting operations and renew that registration before the end of each calendar year.12eCFR. 31 CFR 1022.380 – Registration of Money Services Businesses Providers must also maintain anti-money laundering programs that verify user identity, monitor transactions for suspicious patterns, and file reports when activity looks like it could involve illegal conduct. This is why signup asks for your SSN or EIN and ID.
Federal registration is only the starting point. Nearly every state separately requires money transmitters to hold a state license, with Montana as the notable exception. Some providers use an “agent of the payee” exemption that certain states offer when the company receives money from a buyer strictly to pay a seller for goods or services, though not every state recognizes it.
On the data side, any business that accepts card payments must comply with the Payment Card Industry Data Security Standard, a set of 12 requirements covering network security, encryption, access controls, and vulnerability management. Compliance levels are tiered by annual transaction volume, with the smallest merchants facing the lightest documentation and the largest undergoing formal audits. Using a third-party provider shifts much of this burden to the provider, because card data flows through their systems rather than yours. The shift isn’t total. If a breach traces back to your systems or your handling of card data, you can still face fines from the card networks, the cost of reissuing compromised cards, and liability for resulting fraudulent charges. Any business, at any volume, can be reclassified to the highest compliance tier after a breach.