How Banks Review Payment Processors

Banks and card networks treat third-party payment processors as a risk category. Here is what regulators flag and what a bank must do about it.

Oct 11, 2026

A third-party payment processor is a bank customer that handles payments for lots of other firms. FinCEN says some of these processors may carry a higher risk. If you sell through one, this is why its bank watches it closely.

What a third-party payment processor is

FinCEN's advisory says third-party payment processors are financial institution customers that provide payment processing services to merchants and other businesses. FinCEN's advisory says payment processors use their own deposit accounts at a financial institution to process transactions.

So the bank holds the processor's accounts, and the processor holds your sales.

Why processors carry a higher risk profile

FinCEN's advisory says payment processors may now service a variety of domestic and international merchants, including Internet gaming enterprises. FinCEN's advisory says payment processors serving telemarketing and Internet merchants may present a higher risk profile to a financial institution than other businesses.

The FDIC adds a reason. FDIC guidance says payment processors pose greater money laundering and fraud risk if they cannot effectively verify their merchant clients' identities and business practices.

Phone sellers are one of the groups that draw this attention. If that is you, read the FTC rules on billing authorization.

How criminals can use processors

FinCEN's advisory is blunt about this. FinCEN's advisory says payment processors can be used by criminals to mask illegal or suspicious transactions and launder proceeds of crime.

It gives one method. FinCEN's advisory says payment processors have been used to place illegal funds directly into financial institutions using ACH credit transactions from foreign sources.

The advisory also names a pattern worth knowing. Some processors in this group go after weak banks. FinCEN's advisory says payment processors engaged in suspicious activity have solicited business relationships with distressed financial institutions in need of revenue and capital.

Consolidation accounts and hidden return rates

FinCEN lists account tricks that hide bad numbers:

Processors in this group often keep accounts at more than one bank.
FinCEN's advisory says some payment processors use separate deposit accounts for returned check items to make return and error rates harder to identify.
FinCEN's advisory says payment processors can use consolidation accounts to conceal high return or chargeback rates from banks and regulators.

FinCEN notes both accounts may sit at the same bank or at two different banks. FinCEN's advisory says this account structure severely inhibits a financial institution's ability to monitor and report suspicious activity.

What banks should check during due diligence

FinCEN's advisory says financial institutions should determine during due diligence whether payment processors have obtained all necessary state licenses, registrations, and approvals. The FDIC guidance says banks should watch customer complaints. Some may show that a processor's merchants are wrongly grabbing people's account details.

FinCEN's advisory says financial institutions providing services to payment processors may find it necessary to update their anti-money laundering programs. So signing a processor can mean the bank changes its own controls too.

What banks must do when they see suspicious activity

Visa has its own rules for acquirers, and they are Visa's rules. Visa's standards say acquirers must monitor TPA transaction activity to detect threats and unusual or suspicious activity. Visa's standards say acquirers must check sales patterns and volumes regularly. The goal is to spot odd or suspicious activity.

When something looks wrong, Visa's standards say an acquirer must immediately report any suspicious activity by a TPA to Visa and include a remediation plan. Visa's standards say acquirers must report a TPA's suspicious activity to the authorities.

The FDIC guidance says financial institutions should act promptly when they believe fraudulent or improper activities have occurred related to a payment processor.

What this means for merchants

Your processor's bank reviews the processor, and the processor reviews you. FinCEN's advisory says some processors can use accounts to hide high return or chargeback rates from banks.

See why banks watch payment processor accounts to learn more.