A payment processor is the company that handles the technical movement of money during a card or digital transaction. When a customer taps, swipes, dips, or types a card number, the processor encrypts that payment data, routes it to the card network and the customer’s bank for approval, and then coordinates the actual transfer of funds into the merchant’s account. Without a processor, a business has no way to accept cards or mobile wallet payments at all.
The processor is not the same thing as the bank issuing the card, and it is not always the same as the bank holding the merchant’s account. It sits in the middle, as the messenger and the record-keeper, and the terms of your relationship with it shape your fees, your cash flow, and how easily you can keep accepting payments at all.
How a Card Payment Actually Moves
Every card transaction runs through two stages: authorization and settlement.
Authorization happens in the seconds between the card touching the reader and the receipt printing. The processor captures the card data, encrypts it, and sends an authorization request through the card network (Visa, Mastercard, and so on) to the bank that issued the card. The issuing bank checks whether the customer has the credit or funds available and returns an approval or decline code.1Stripe. Credit Card Payment Authorization and Transaction Settlement Process That whole round trip finishes in a few seconds, which is why checkout feels instant even though the data is bouncing between several institutions.
An approved sale is not the same as money in your account. The processor collects the day’s approved transactions into a batch and submits them for clearing, usually at the close of business. During clearing, the card network moves the funds from the issuing bank to the acquiring bank, which then deposits the money into the merchant’s account. Most merchants see the deposit within one to three business days, depending on the processor and the contract.
Who the Processor Talks To
Four parties are involved in every card transaction. The processor’s job is to keep the messages and money flowing correctly among them.
- The cardholder is the customer paying. Their cardholder agreement obligates them to repay the issuing bank for authorized charges.
- The merchant is the business accepting the card. Merchants have to follow card network rules on fraud and chargebacks to keep their account in good standing.2Mastercard. Chargeback Guide Merchant Edition
- The issuing bank issued the customer’s card. It decides in real time whether to approve or decline each request.
- The acquiring bank holds the merchant’s account and receives the settled funds. It also carries the financial exposure: if the merchant commits fraud or cannot cover chargebacks, the acquirer absorbs the loss.3Office of the Comptroller of the Currency. Merchant Processing
Some processors are also the acquiring bank. Others partner with one. Either way, the processor routes authorization requests, transmits approval codes, batches settlements, and reconciles the data.
Two Ways to Have a Processor
Not every processing relationship is structured the same way, and the structure matters more than most new business owners expect.
A payment service provider like Square or PayPal runs your transactions through its own master merchant account. Your business is a sub-merchant sharing that infrastructure. Signup is fast, often just an online form with no credit check, and you can start processing the same day. The cost of that speed is stability. Because you do not have your own merchant identification number, the provider’s automated risk systems can freeze funds or close your account with little warning, and this happens most often during sudden sales spikes or when a business grows into higher volume.
A dedicated merchant account gives your business its own direct relationship with a processor, its own merchant ID, and rates negotiated for your volume and industry. Approval takes one to three business days and involves an application, business verification, and sometimes a credit check. Because the processor has already looked at your risk profile up front, surprise holds and terminations are much less common. For a business running more than a few thousand dollars a month, a dedicated account almost always makes better financial sense over time.
What a Processor Charges
Processing fees come in three layers. Understanding the layers lets you tell what a processor is actually charging you versus what it is just passing through.
Interchange fees are the biggest layer. The card networks set them, and they go to the issuing bank on every transaction. Rates vary by card type, how the transaction was taken, and the merchant category. Rewards and corporate cards cost more than basic debit cards. For debit cards issued by banks with $10 billion or more in assets, interchange is capped by the Durbin Amendment at $0.21 plus 0.05% of the transaction, with a possible $0.01 fraud-prevention adjustment.4Federal Reserve. Regulation II – Average Debit Card Interchange Fee Smaller banks and credit unions are exempt from that cap.
Assessment fees are the second layer. These are smaller charges the card networks collect for use of their infrastructure. Visa charges 0.14% per transaction. Mastercard charges 0.14% on transactions up to $1,000 and 0.15% above that.
The third layer is the processor’s own markup, and this is where the pricing model matters:
- Interchange-plus separates the network cost from the processor’s markup, which usually runs 0.10% to 0.50% depending on volume. It is the most transparent option.
- Flat-rate bundles everything into a single percentage, commonly 2.6% to 2.9% plus a per-transaction fee. Easy to understand, but you pay the same rate whether the underlying interchange is low or high. It fits low-volume businesses best.
- Tiered pricing sorts transactions into “qualified,” “mid-qualified,” and “non-qualified” buckets defined by the processor. A keyed-in rewards card can quietly get pushed into the most expensive tier. This is where merchants most often overpay.
On top of per-transaction pricing, expect recurring charges. Monthly account maintenance, PCI validation, and statement fees together commonly run $10 to $100 a month.
How a Processor Can Affect Your Cash Flow
A processor is not just a pipe. It has authority over your money once it is in the pipeline, and that authority shows up in a few specific ways.
Holds and Rolling Reserves
Processors can hold funds when something in your activity looks off. Common triggers are sudden sales spikes, a jump in average transaction size, higher-risk product categories like electronics or gift cards, and a cluster of refunds or chargebacks. The hold protects the processor and the acquiring bank from absorbing losses if transactions later reverse.
For higher-risk merchants, processors often impose a rolling reserve, withholding 5% to 15% of each transaction and holding it for 90 to 180 days, sometimes up to a year, before releasing it. A business running $50,000 a month with a 10% reserve has $5,000 a month tied up at any given time. If you are not planning for that, it hurts.
Chargebacks
When a cardholder disputes a transaction and the issuing bank reverses the charge, the merchant loses the sale and the product and pays a chargeback fee that typically runs $15 to $50. The fee applies whether you win the dispute or not.
Volume is the real danger. Visa places merchants into its Dispute Monitoring Program when chargebacks pass 0.9% of monthly transactions and 100 disputes in one month, and Mastercard has a similar threshold. Once you are in a monitoring program, extra per-chargeback fines apply, and if the ratio does not come down, the account gets terminated.2Mastercard. Chargeback Guide Merchant Edition
The MATCH List
The worst outcome of a bad processing relationship is landing on the MATCH list (Mastercard Alert to Control High-risk Merchants), a shared database of merchants terminated for cause. Processors must add a business within one business day of termination if MATCH criteria are met. Qualitative triggers include data breaches, transaction laundering, fraud convictions of an owner, PCI DSS non-compliance, and illegal transactions. Quantitative triggers include, for Mastercard, a chargeback rate above 1% with at least $5,000 in chargebacks in a month, or a fraud-to-sales ratio of 8% or higher with at least $5,000 in fraudulent transactions in a month. Businesses stay on the list for five years, and most traditional processors will decline an application from anyone on it.
Compliance the Processor Requires or Triggers
PCI DSS
Every business that accepts card payments has to comply with the Payment Card Industry Data Security Standard. The current active versions are PCI DSS v4.0 and v4.0.1, which replaced v3.2.1 when it retired on March 31, 2024. The standard covers how card data is stored, who can access your systems, how intrusions are monitored, and how staff is trained. The update added 64 new requirements, including mandatory quarterly vulnerability scans by an approved scanning vendor for e-commerce merchants.5PCI Security Standards Council. Now Is the Time for Organizations to Adopt the Future-Dated Requirements of PCI DSS v4.x
Compliance is not optional. Processors require it, non-compliance usually means monthly fees, and a breach at a non-compliant business can result in placement on the MATCH list.
1099-K Reporting and Backup Withholding
Processors also carry tax reporting duties that hit merchants directly. A processor that qualifies as a Third Party Settlement Organization must file Form 1099-K for any merchant whose gross payments exceed $20,000 and whose transaction count exceeds 200 in a calendar year.6Internal Revenue Service. IRS Revises and Updates Form 1099-K Frequently Asked Questions That threshold was reinstated by the One, Big, Beautiful Bill Act of 2025, replacing the lower $600 threshold that had been scheduled to phase in. If you cross both thresholds, your processor reports your gross payment volume to the IRS and sends you a copy of the 1099-K.
If you fail to give the processor a correct taxpayer identification number, or if the IRS notifies the processor that you have underreported income, the processor must apply backup withholding at 24% on your payments.7Internal Revenue Service. Backup Withholding Twenty-four cents of every dollar goes to the IRS before it reaches you. Keeping your W-9 accurate and current with every processor you use is what prevents that.