Could your company's payment processing practices be putting you at risk for regulatory penalties? If you work with payment processors or operate one, the FTC's recent enforcement action against Nuvei offers a clear guide on what regulators expect.
What This Guide Covers
This guide addresses merchant screening requirements for payment processors and the companies that depend on them. It's written for compliance teams who need to understand:
- What "robust merchant screening" means in regulatory terms
- How to implement ongoing monitoring programs
- Where your screening program is most likely to fail
- What the Telemarketing Sales Rule requires of payment processors
If your organization processes payments, acquires merchants, or contracts with payment processors, you need a screening framework that can withstand FTC scrutiny.
Key Concepts and Definitions
Payment Processor: An entity that facilitates electronic payment transactions between merchants and cardholders, typically through acquiring banks and card networks.
Merchant Acquiring: The process of establishing and maintaining payment processing accounts for businesses that accept credit card payments.
Chargeback Rate: The percentage of transactions that cardholders dispute and reverse. High chargeback rates signal potential fraud or customer dissatisfaction.
Load Balancing: A tactic where merchants split transaction volume across multiple accounts to avoid fraud detection thresholds. The FTC considers this a red flag.
Enhanced Screening: Additional due diligence steps beyond standard merchant onboarding, triggered by risk factors like merchant category, chargeback history, or prior terminations.
Merchant of Record: A platform that processes payments on behalf of other merchants, creating an additional layer between the end merchant and the payment system.
Requirements Breakdown
The FTC's proposed order against Nuvei establishes specific expectations. While the order applies to one company, it signals what the FTC considers reasonable screening practices across the industry.
Prohibited Merchant Categories
The order bans Nuvei from processing payments for tech support products or services sold through telemarketing or pop-up messages about device security or performance issues. This reflects the FTC's view that certain merchant categories carry inherently high fraud risk.
Your screening program should identify high-risk categories in your merchant portfolio. Tech support, outbound telemarketing, business opportunity schemes, and government impersonation services have all drawn FTC enforcement actions.
Screening Requirements
The order requires Nuvei to screen both prospective and existing clients. For certain merchant categories, including outbound telemarketing, enhanced screening is mandatory.
Enhanced investigation is required for any existing client whose chargeback rates exceed limits set in the order. This means your monitoring can't stop after onboarding. You need ongoing surveillance of merchant behavior.
Prohibited Practices
The order prohibits making false or misleading statements to obtain merchant accounts and engaging in tactics to avoid fraud monitoring programs. Load balancing, where transaction volume is deliberately spread across accounts to stay under risk thresholds, is specifically called out.
Implementation Guidance
Build a Risk-Based Screening Framework
Start with merchant category codes. Identify which categories carry elevated fraud risk based on FTC enforcement patterns, chargeback data, and industry guidance from card networks.
For standard-risk merchants, your screening should verify:
- Business registration and legal structure
- Principal ownership and control persons
- Business model and product descriptions
- Expected transaction volumes and patterns
- Prior payment processing history
For high-risk categories, add:
- Site visits or video verification of business operations
- Customer complaint research across public databases
- Review of marketing materials and sales scripts
- Background checks on principals
- References from prior processors (if available)
Implement Ongoing Monitoring
Your screening obligation doesn't end at onboarding. Set up automated monitoring for:
Chargeback rates: Establish thresholds that trigger enhanced review. The card networks typically use 1% as a warning threshold, but you may want lower triggers for high-risk categories.
Transaction pattern changes: Sudden spikes in volume, changes in average transaction size, or shifts in geographic distribution can signal problems.
Complaint volume: Monitor consumer complaint databases and your own customer service channels for patterns tied to specific merchants.
Termination notices: If another processor or acquiring bank terminates a merchant for fraud or excessive chargebacks, you need to know immediately.
Document Your Decisions
When you approve a merchant account, document why. When you terminate one, document why. If you conduct enhanced screening and decide to proceed despite red flags, write down your reasoning.
The FTC alleged that Nuvei processed more than $30 million in consumer payments for a tech support scam from 2017 to 2023. That's a six-year relationship. Your documentation should show that you either didn't have information that would have revealed the fraud, or that you took action when you did.
Train Your Underwriting Team
Your screening program is only as good as the people running it. Your underwriting team should understand:
- Common fraud schemes in each merchant category
- Red flags in application materials
- How to conduct effective enhanced due diligence
- When to escalate decisions to compliance leadership
- The legal consequences of processing for fraudulent merchants
Common Pitfalls
Treating onboarding as a checkbox exercise: If your underwriters are racing through applications to hit volume targets, they'll miss red flags. Quality matters more than speed.
Ignoring prior terminations: If another processor terminated a merchant for fraud or excessive chargebacks, that's not ancient history. It's a current risk factor that demands enhanced screening.
Failing to investigate chargeback spikes: A sudden increase in chargebacks is your early warning system. If you don't investigate promptly, you're facilitating fraud.
Accepting implausible business models: If a merchant's described business model doesn't make economic sense, or if their marketing materials contradict their application, don't process their payments until you understand what's really happening.
Relying entirely on automated screening: Technology helps, but human judgment matters. Complex fraud schemes require investigative thinking, not just algorithm outputs.
Skipping ongoing monitoring: The merchant who was legitimate at onboarding might not stay that way. Your monitoring needs to be continuous, not episodic.
Quick Reference Table
| Risk Factor | Standard Response | Enhanced Response |
|---|---|---|
| High-risk merchant category (telemarketing, tech support) | Additional documentation of business model and customer acquisition | Site verification, marketing materials review, sales script analysis |
| Chargeback rate exceeds 1% | Immediate investigation, written remediation plan required | Consider termination if pattern continues or merchant is unresponsive |
| Prior termination by another processor | Request termination letter and explanation | Verify reason for termination, assess whether issue is resolved |
| Sudden transaction volume spike (>50% increase) | Review transaction patterns, contact merchant for explanation | Temporary hold on processing pending investigation |
| Consumer complaints in public databases | Research complaint details, assess severity and pattern | Contact complainants if possible, review merchant's customer service practices |
| Load balancing detected | Immediate termination under FTC order requirements | Report to card networks and other relevant parties |
| Misleading application materials | Request clarification and corrected documentation | Termination if misrepresentation was material |
The FTC's enforcement action resulted in a $4.85 million settlement and a detailed compliance order. That's the cost of inadequate screening. Your program should be designed to prevent fraud, not just to survive an audit after fraud has already occurred.
If you're building or updating your merchant screening program, use this guide as a starting point. But remember: the specific requirements will depend on your business model, merchant mix, and risk profile. When in doubt, document your reasoning and err on the side of caution.
