The Payment Facilitator Model: A Complete Guide for Software Platforms

When a sub-merchant turns out to be fraudulent, the loss does not stay with that merchant. Visa's payment facilitator model makes the acquirer ultimately accountable for the payfac and every merchant sponsored beneath it, while the payfac handles sponsored-merchant compliance day to day (Visa). That puts the payfac on the front line, and in practice any loss a sub-merchant creates is pushed back to the payfac through its bank agreement.

One leading payfac that worked with Coris learned this the hard way. A single large merchant with clear fraud warning signs produced a sizable credit loss, and the team moved from manual, reactive review to automated monitoring of 15,000 to 20,000 merchants, cutting merchant analysis from 20 or more minutes to seconds (Coris case study). That is the trade at the center of the payfac model: onboarding in hours and a new revenue line, in exchange for carrying the risk of every merchant you approve.

A payment facilitator, or payfac, is a company that holds a single master merchant account with an acquiring bank and lets other businesses accept card payments as sub-merchants without opening their own bank accounts. It's the model behind Square, Stripe, and PayPal, and it's why millions of businesses can start accepting card payments the same day they sign up. Instead of going through the traditional process of applying for a merchant account, which can take weeks, businesses sign up as sub-merchants under the payfac and can often start processing within hours. The payfac handles everything in between: verifying the business, ensuring compliance, moving funds, and managing chargebacks.

For software platforms considering embedded payments, the payfac model represents both a significant revenue opportunity and a serious operational commitment. This guide covers how the model works, what distinguishes it from other payment structures, and what it actually takes to become one.

How the payment facilitator model works

Four parties make the payfac model function: the acquiring bank, the payment facilitator, the sub-merchant, and the payment processor. Each plays a distinct role. Understanding how they connect explains both why payfacs can onboard merchants so quickly and why they carry so much risk.

The role of the acquiring bank

The acquiring bank provides the master merchant account. Rather than opening thousands of individual accounts for small businesses, the bank has one relationship: with the payfac. Settlement flows through this single account. In payfac conversations the same institution is often called the sponsor bank, and this guide uses "acquiring bank" for the role.

The acquirer must perform due diligence on the payfac and complete its registration with the card networks, and it remains ultimately accountable for the payfac and its sponsored merchants (Visa). That means the bank depends on the payfac to vet every sub-merchant. When fraud happens or chargebacks pile up, the bank looks to the payfac, not the individual merchant who caused the problem.

The role of the payment facilitator

The payfac sits in the middle, taking on responsibilities that would otherwise fall to the bank. Before any sub-merchant can process a transaction, the payfac verifies the business, assesses risk, and makes an approval decision. After onboarding, the payfac monitors activity, handles disputes, and manages fund flows.

In return for carrying this operational and financial burden, the payfac controls the merchant experience and earns margin on every transaction.

The role of the sub-merchant

Sub-merchants are the businesses accepting payments through the payfac's infrastructure. They complete a streamlined verification process and start processing quickly, often the same day. From their perspective, the payfac is their payments provider. They never deal directly with the acquiring bank.

The role of the payment processor

The payment processor handles the technical plumbing: routing transactions to card networks, transmitting authorization requests, and moving data between systems. While the payfac manages the business relationship and compliance, the processor manages the infrastructure that actually moves the money. Some payfacs use third-party processors. Others build or acquire processing capabilities themselves.

Examples of payment facilitators

A few well-known companies illustrate how the payfac model works in practice:

• Square: Aggregates small businesses under its master merchant account, enabling them to accept card payments through Square's hardware and software.
• Stripe: Powers payments for millions of internet businesses, handling onboarding and compliance as a payfac.
• PayPal: Lets individuals and businesses accept payments without a traditional merchant account.
• Toast: A vertical SaaS platform for restaurants that embeds payments through a payfac structure, now earning 82–85% of revenue from fintech solutions.

What makes all of them payfacs is the same underlying structure: each holds a master merchant account and aggregates sub-merchants beneath it.

How payment facilitators make money

Payfacs earn revenue primarily through markup: the difference between what they pay their acquiring bank and processor, and what they charge sub-merchants. The main revenue streams break down like this:

• Transaction markup: The payfac adds margin on top of interchange and processor costs, typically expressed as a percentage plus a fixed fee per transaction.
• Monthly fees: Many payfacs charge recurring platform or account fees regardless of transaction volume.
• Value-added services: Premium features like advanced analytics, faster payouts, or fraud tools create additional revenue.

For software platforms, transaction markup often becomes a significant new revenue line that grows as merchants grow.

Payment facilitator vs other payment models

The term "payfac" gets confused with related concepts regularly. The key differences come down to who holds the merchant account, how fast merchants can onboard, and who handles risk day to day. Note that "payment aggregator" is generally treated as a synonym for payfac; both terms describe companies that aggregate merchants under a master account, and you'll see them used interchangeably in the industry.

In every model, the acquiring bank stays accountable to the card networks. The "day-to-day" label describes who underwrites and monitors, not who is ultimately answerable to Visa and Mastercard.

Payment processors and payment gateways aren't included in this table because they're technical infrastructure layers rather than merchant-account models; they don't hold accounts or own risk the way the models above do.

Payment facilitator vs payment processor

A payment processor routes transactions technically: connecting to card networks, transmitting data, facilitating authorizations. A payfac manages the merchant relationship, aggregation, and compliance. Processors don't onboard merchants. Payfacs do.

Payment facilitator vs ISO

An ISO (Independent Sales Organization) resells payment processing services, but each merchant gets its own merchant account with the acquiring bank. The ISO earns residuals on transactions but doesn't aggregate merchants under a master account. The acquiring bank, not the ISO, owns the underwriting relationship.

Payment facilitator vs PSP

PSP (Payment Service Provider) is a broader category that includes payfacs, gateways, and other payment services. A payfac is one specific type of PSP: the type that uses the master merchant account model.

Payment facilitator vs payment gateway

A payment gateway is technology that securely transmits payment data between merchants and processors. A payfac is a business model that includes merchant aggregation, underwriting, and compliance. Payfacs often use gateways as part of their infrastructure, but the two serve different functions.

Benefits of the payment facilitator model for software platforms

For software platforms considering embedded payments, the payfac model offers several distinct advantages.

Faster sub-merchant onboarding. Sub-merchants can start accepting payments in hours rather than weeks. Because the payfac handles underwriting under its master account, individual merchants don't fill out lengthy bank applications or wait for separate merchant onboarding approvals.

New payments revenue stream. Platforms can add margin to every transaction processed through their system. This creates recurring revenue tied directly to merchant success: as merchants process more volume, the platform earns more.

Ownership of the merchant experience. The platform controls the entire payments experience: branding, support, onboarding flow, and feature set. Merchants interact with the platform, not the acquiring bank, which strengthens the platform's position as the merchant's primary vendor relationship.

Control over pricing and payouts. Payfacs set their own pricing structures and control payout timing. This flexibility enables differentiated offerings: faster payouts for premium tiers, volume discounts for large merchants, or bundled pricing with other platform features.

Deeper product integration. Payments become native to the platform rather than a third-party redirect. That means fewer drop-off points at checkout, and transaction data stays within the platform instead of in a separate provider's dashboard.

Risks and responsibilities of becoming a payment facilitator

The benefits come with significant operational weight. The payfac takes on day-to-day responsibility for all sub-merchant activity, which means building robust risk infrastructure from day one.

Sub-merchant underwriting and KYB. KYB (Know Your Business) verification happens before onboarding any sub-merchant. This includes verifying business registration, reviewing website content, identifying beneficial owners, and assessing risk levels. Getting this wrong means onboarding fraudulent or high-risk merchants and absorbing the losses they generate. Coris's guide to KYB software for payment platforms covers how to evaluate the tooling.

Fraud and chargeback liability. The payfac is financially responsible, day to day, for fraudulent transactions and chargebacks from its sub-merchants. If a sub-merchant commits fraud or generates excessive chargebacks, the payfac is expected to absorb the loss. With global e-commerce fraud losses reaching $48 billion in 2025, that exposure is substantial. The acquiring bank, however, remains ultimately accountable to the card networks, so its protection is its contract with you. That is why a sponsor bank will examine your underwriting, reserves, and monitoring closely before it agrees to sponsor you.

A practitioner point worth sitting with: your liability is only as good as your balance sheet. If a sub-merchant loss exceeds what you can cover, the exposure does not disappear. It travels back to the bank. This is why banks ask what they can see about your merchant portfolio, not only whether you have controls, and why portfolio visibility can matter as much as the controls themselves.

Ongoing merchant monitoring. Underwriting isn't a one-time event. Payfacs monitor sub-merchant activity continuously, watching for risk signals like changes in transaction patterns, negative reviews, website content changes, or business closures. Manual processes break down quickly once a portfolio reaches any meaningful size, a problem Coris covers in its guide to merchant risk management operations that scale.

Transaction monitoring and compliance. Beyond merchant-level monitoring, payfacs rely on transaction monitoring to detect anomalies, fraud patterns, and policy violations in real time. This requires infrastructure that can analyze live payment activity and trigger alerts or blocks before money moves. Coris's practical guide to transaction monitoring automation walks through how to set it up.

Reserves and capital requirements. Payfacs typically hold reserves to cover potential losses, and sponsor banks commonly set reserve and capital expectations in the sponsorship agreement. Visa's own requirements for equity and risk rating apply to the acquirer, which is another reason banks screen payfacs closely. Both tie up cash and add financial complexity to the operation.

Requirements to become a payment facilitator

Becoming a registered payfac involves several concrete steps. Six months to over a year is a common range, and complex builds can run longer, depending on sponsor bank negotiations and how much infrastructure you build.

Step 1: Secure a sponsor bank relationship. A payfac needs an acquiring bank, the sponsor bank, willing to provide the master merchant account and accept accountability for the program. Banks evaluate the platform's business model, projected volume, and risk management capabilities. Visa requires the acquirer to complete a comprehensive risk and financial review of the payfac before registration.

Step 2: Get registered with the card networks. The acquiring bank, not the payfac, completes the payfac's registration with Visa, and Mastercard likewise has acquirers register payfacs under its rules (Visa, Mastercard). Expect the bank's review, rather than a network application you file yourself, to be the gating step.

Step 3: Achieve PCI DSS compliance. PCI DSS (Payment Card Industry Data Security Standard) certification demonstrates secure handling of cardholder data. All v4.0.1 requirements became fully mandatory on March 31, 2025, and payfacs are expected to be compliant before engagement as part of acquirer due diligence, providing an Attestation of Compliance that the networks review. Sub-merchants remain accountable to the acquirer for their own PCI scope, so a clear shared-responsibility split matters (PCI Security Standards Council).

Step 4: Build underwriting and onboarding infrastructure. Systems are required to collect merchant information, verify identities, assess risk, and make approval decisions. Automation becomes essential at any meaningful volume; manual review doesn't scale. See Coris's overview of automated merchant underwriting.

Step 5: Stand up risk and transaction monitoring. Monitoring systems for merchant behavior and transaction surveillance are required before launch. This includes alert workflows, case management, and escalation procedures.

Step 6: Set up funding, reserves, and reconciliation. Operational systems for managing money movement round out the infrastructure: funding sub-merchants, holding reserves, reconciling settlements, and handling disputes.

Given the scope of that build, not every platform needs to become a full payfac to get payfac-like economics.

Payment facilitator vs PayFac-as-a-Service and managed payfac models

Alternative models offer different tradeoffs between control, speed, and investment:

• Full payfac: You own the registration relationship, day-to-day liability, and operations. Highest margin, highest investment.
• PayFac-as-a-Service: A provider handles infrastructure while you maintain some control and branding. Faster to market, shared economics.
• Managed payfac: A provider handles most operations under their license. You get payfac-like benefits with minimal build. This is sometimes called branded or white-label payments.

These ranges are indicative, not network requirements, and actual timelines depend on the sponsor bank and your build. For a broader comparison that also covers referral models, see Coris's guide to how to choose a payments model for your software platform.

How to decide if the payment facilitator model fits your platform

Transaction volume and merchant count. The full payfac model makes economic sense at scale. Platforms with lower volume may not generate enough margin to justify the investment in infrastructure, compliance, and ongoing operations.

Time to market. Becoming a full payfac takes many months. If speed matters more than margin optimization, PayFac-as-a-Service or managed models get you live faster while you evaluate the long-term path.

Risk appetite and operational capacity. Does your team have risk operations expertise? Are you prepared to build or buy underwriting, monitoring, and compliance infrastructure? Be honest about readiness before you commit.

Merchant growth and graduation. Visa's payment facilitator model document notes that a sponsored merchant may be required to sign a direct merchant agreement with the acquirer once its annual Visa sales volume passes a threshold set in the Visa Rules, with some categories treated differently (Visa). If your best merchants are likely to outgrow the model, the economics of owning the relationship change, so confirm the current threshold with your sponsor bank before you model revenue.

Revenue economics. Full payfac ownership offers higher margin but also higher cost and risk. Managed models trade margin for simplicity. The right choice depends on scale, strategic priorities, and how central payments are to your business model.

Operationalizing merchant risk as a payment facilitator

Whichever model a platform chooses, merchant risk operations sit at the center. This includes underwriting, monitoring, and fraud detection across the entire sub-merchant lifecycle, not just at onboarding. It is the infrastructure most platforms underestimate before they go live, and it determines whether the payfac model turns into a durable revenue line or an unmanaged liability. Coris's payment risk management guide for ISOs and payment platforms covers the full picture.

Coris Merchant Intelligence and the Coris Risk Platform give payfacs the underwriting, monitoring, and transaction risk tools to manage sub-merchant risk at scale. Coris monitors more than 1 million merchants and $50 billion in annualized transaction volume, and teams using Coris have reduced manual review volume by more than 80%. Book a Coris demo to see how it supports sub-merchant risk from onboarding through ongoing monitoring.

Frequently asked questions about the payment facilitator model

Is Stripe a payment facilitator?

Yes. Stripe operates as a payment facilitator by aggregating merchants under its master merchant account and handling underwriting, compliance, and fund settlement on their behalf. It absorbs the same onboarding and monitoring responsibilities any payfac carries, which is part of why Stripe merchants can start processing so quickly.

How long does it take to become a payment facilitator?

Becoming a registered payment facilitator typically takes six months to over a year, and complex builds can run longer. Timing depends on sponsor bank negotiations, the bank's risk and financial review, network registration through the acquirer, and how much underwriting, monitoring, and compliance infrastructure a platform builds versus buys before launch.

What is a sub-merchant in the payment facilitator model?

A sub-merchant is a business that accepts payments through a payfac's master merchant account rather than holding its own direct account with an acquiring bank. Sub-merchants complete a streamlined onboarding process with the payfac and never interact directly with the sponsoring acquiring bank.

What is a master merchant account?

A master merchant account is a single merchant account held by the payment facilitator with an acquiring bank. All sub-merchants are aggregated under this account for payment processing and settlement. This allows the payfac to onboard new merchants in hours instead of the weeks a traditional merchant account application takes.

Do payment facilitators need to be PCI compliant?

Yes. Payment facilitators are expected to achieve and maintain PCI DSS compliance to handle cardholder data, and acquirers typically check this during due diligence, with the payfac providing its Attestation of Compliance. Sub-merchants remain accountable for their own scope, so payfacs usually define a shared-responsibility split and offer hosted payment tools that reduce it.

Can a payment facilitator operate internationally?

Payment facilitators can operate internationally, though they navigate different regulatory requirements, card network rules, and acquiring bank relationships in each market. Expanding into a new country generally means a separate sponsor bank relationship and compliance review, since reserve requirements and card network rules vary by region.

At what volume does a sub-merchant need its own merchant account?

There is no single number that applies everywhere. Visa's payment facilitator model says a sponsored merchant may be required to sign a direct merchant agreement with the acquirer once its annual Visa sales volume passes a threshold set in the Visa Rules, with some categories treated differently. Confirm the current threshold with your sponsor bank.

These are the external links changes I want you to make to the article: [{"original_text":"Toast: A vertical SaaS platform for restaurants that embeds payments through a payfac structure.","replacement_text":"Toast: A vertical SaaS platform for restaurants that embeds payments through a payfac structure, now earning 82–85% of revenue from fintech solutions."},{"original_text":"If a sub-merchant commits fraud or generates excessive chargebacks, the payfac is expected to absorb the loss.","replacement_text":"If a sub-merchant commits fraud or generates excessive chargebacks, the payfac is expected to absorb the loss. With global e-commerce fraud losses reaching $48 billion in 2025, that exposure is substantial."},{"original_text":"PCI DSS (Payment Card Industry Data Security Standard) certification demonstrates secure handling of cardholder data. Payfacs are expected to be compliant before engagement as part of acquirer due diligence, and to provide an Attestation of Compliance that the networks review.","replacement_text":"PCI DSS (Payment Card Industry Data Security Standard) certification demonstrates secure handling of cardholder data. All v4.0.1 requirements became fully mandatory on March 31, 2025, and payfacs are expected to be compliant before engagement as part of acquirer due diligence, providing an Attestation of Compliance that the networks review."}]

Do not truncate your response at all, or use ellipses truncate. Return the entire article word for word with the changes requested.