Payment Facilitator (PayFac): Models, Risks & Real Build Lessons

Most platforms discover the payment facilitator model the same way: a merchant signs up, hits a conversion problem at checkout, and the product team realizes that owning the payment experience end-to-end would fix it. Then someone builds a spreadsheet of what that actually involves, and the timeline and liability exposure come into focus.

That pivot from “let’s offer payments” to “let’s understand what we’re legally taking on” is where most teams spend too little time. The payment facilitation model gives platforms direct control over payment revenue and sub-merchant experience. It also puts chargeback liability, underwriting obligations, and ongoing AML monitoring on the platform’s balance sheet. Getting that trade-off wrong is expensive in ways that don’t appear until the first scheme audit or fraud wave.

This guide is for product and commercial leaders at platforms, vertical SaaS companies, and marketplace operators who are deciding whether to become a payment facilitator, use a PayFac-as-a-service, or partner with an ISO. It is written from the perspective of a team that has built payment acceptance infrastructure across regulated fintechs for 15+ years, including for clients operating payment platforms in 37+ countries.

What Is a Payment Facilitator?

A payment facilitator is a company that aggregates multiple merchants (called sub-merchants) under a single master merchant account held with an acquiring bank, enabling those merchants to accept card payments without establishing a direct relationship with an acquirer.

That single-sentence definition carries more regulatory and operational weight than it looks. Under card network rules (Visa, Mastercard, Discover), a PayFac is a registered entity that takes on direct responsibility for its sub-merchants: it underwrites them, funds them, manages their chargebacks, and is liable if a sub-merchant commits fraud or becomes insolvent.

One disambiguation worth making early: payment facilitation in financial compliance refers to the payment facilitation model described here. “Facilitation payment” is a distinct legal term under the FCPA and UK Bribery Act; it refers to a bribe paid to expedite a routine government action. The two terms appear in the same search results and mean completely different things. This article covers payment facilitation in the acquiring sense only.

Payment facilitator vs payment processor. A payment processor handles the technical routing of transaction data between the merchant’s bank and the issuing bank. It does not hold a merchant relationship. A PayFac is a specific type of merchant service arrangement: the PayFac holds the master account and represents sub-merchants to the acquirer. Understanding the difference between a payment gateway and a payment processor is a useful starting point before designing a PayFac architecture, since both gateway and processor functions typically sit inside or alongside the PayFac stack.

How Payment Facilitators Work: Money Flow and Sub-Merchant Onboarding

The fundamental money flow in a PayFac structure runs through three layers.

Layer 1: The acquiring/sponsor bank. The PayFac holds a master merchant account with an acquiring bank (called the sponsor bank in many frameworks). The sponsor bank approves the PayFac’s operation, sets underwriting standards and transaction limits, and bears ultimate reserve and fraud risk alongside the PayFac.

Layer 2: The PayFac’s master merchant account. All transactions from all sub-merchants are aggregated here. The PayFac settles with the sponsor bank as a single entity, then disburses funds to individual sub-merchants minus fees and reserves.

Layer 3: Sub-merchants. Merchants onboarded by the PayFac receive simplified, fast onboarding because the PayFac has already been vetted by the sponsor bank and takes on the sub-merchant risk.

KYB underwriting. Sub-merchants must be underwritten before they are onboarded. The PayFac runs Know Your Business checks: verifying legal entity, beneficial ownership, business type, transaction volumes, and risk profile. Card networks require PayFacs to maintain sub-merchant data and monitor ongoing risk. Underwriting thresholds are set by the sponsor bank and enforced by the PayFac.

Chargebacks and liability. When a sub-merchant receives a chargeback, the liability sits with the PayFac. The PayFac must respond to the dispute and absorb the loss if it cannot recover from the sub-merchant’s reserve. This is the sharpest operational risk in the model: a platform with many small, hard-to-underwrite merchants faces concentrated chargeback exposure that it may not fully model before launch.

Funding and payouts. The sponsor bank settles the master account. The PayFac then funds sub-merchants, typically on a T+1 or T+2 cadence, after deducting its fee and any rolling reserve. Managing this float requires a properly designed ledger. Merchant acquiring covers how the acquiring relationship and settlement mechanics work from the bank’s side, which is the counterpart to the PayFac’s sub-merchant ledger.

PayFac Model Compared: Full PayFac, PayFac-as-a-Service, ISO, and Merchant of Record

Most platforms choose between four commercial models when they decide to offer payments. Each allocates underwriting responsibility, chargeback liability, and revenue differently.

Full PayFac is the highest-revenue, highest-responsibility path. Your platform sets pricing, owns the sub-merchant relationship, and keeps the spread between what you charge merchants and what you pay the scheme and processor. The trade-off is that you carry chargeback liability, build and maintain underwriting infrastructure, and register directly with Visa and Mastercard.

PayFac-as-a-Service (also called managed PayFac) lets platforms use a third party’s master merchant account and underwriting infrastructure. Your platform still controls sub-merchant onboarding UX and pricing, but the risk, compliance, and scheme registration live with the provider. Revenue is lower, but the compliance burden and capital requirements are significantly reduced.

ISO/referral partnerships are the lightest model. Your platform refers merchants to an ISO or processor and earns a residual or referral fee. Onboarding is the processor’s problem; so is everything else.

Merchant of record is the appropriate model when the platform is selling its own inventory or digital goods globally and needs to handle VAT, GST, and cross-border tax compliance.

Segment-to-option map.

How to Become a Payment Facilitator

Becoming a full PayFac is a multi-step process involving commercial agreements, regulatory registration, compliance infrastructure, and an engineering build. Teams routinely underestimate the first-year timeline.

1. Sponsor bank agreement. The sponsor bank vets your business model, transaction volume, merchant mix, and risk controls before granting access to a master merchant account. Approval timelines vary, typically 3–6 months from first engagement. The sponsor bank sets your underwriting standards and reserve requirements.
2. Card network registration. Visa and Mastercard require a payment facilitator payfac to register directly with each scheme. Registration involves disclosing ownership, certifying compliance with their PayFac program rules, and paying registration fees. Non-registered entities operating as de facto PayFacs are subject to fines.
3. PCI DSS Level 1 certification. Operating a master merchant account means your platform is in scope for PCI DSS at the highest level. This requires an annual on-site audit by a Qualified Security Assessor (QSA) and quarterly vulnerability scans by an approved scanning vendor. PCI DSS Level 1 is a meaningful engineering investment; plan for 6–12 months of remediation before your first audit if starting from scratch.
4. KYB/AML program. The sponsor bank and card networks require a documented KYB underwriting methodology, ongoing transaction monitoring, and AML controls. This means building or integrating identity verification, business verification, sanctions screening, and adverse media monitoring—and maintaining audit evidence. KYC integration providers are one component of this stack; the underwriting logic and risk decisioning sit in your own platform.
5. Engineering stack. The minimum PayFac engineering build includes sub-merchant onboarding flows, a multi-entity ledger tracking per-sub-merchant balances and reserves, payout orchestration, dispute management tooling, and reporting/reconciliation for sponsor bank and scheme reporting obligations. Fintech integration services are typically required to connect the internal stack to acquiring KYB, fraud, and scheme APIs. Many PayFac builds involve 10+ vendor integrations before launch.

The sponsor bank relationship is a commercial and legal one that determines what your platform is allowed to do, at what volumes, and with what merchant types. Get it signed before you build.

PayFac-as-a-Service: When Managed Is Better Than Full

PayFac as a service is one of the most commonly adopted alternatives to a full PayFac build. It’s for good reason: it delivers most of the revenue upside of the payment facilitation model without requiring the platform to hold a master merchant account, register with card networks, or achieve PCI DSS Level 1 certification.

A managed PayFac provider gives your platform:

• A sub-merchant onboarding API your UX sits in front of
• Risk decisioning and underwriting handled by the provider
• Chargeback liability managed by the provider
• A revenue share negotiated at the platform level

What the platform still owns: the sub-merchant experience, pricing to merchants, and the relationship with the merchant if they have a dispute with the PayFac provider’s decisions. The platform is also typically responsible for the quality of the merchants it refers. A systematic failure of KYB due diligence by the platform is not a liability the provider absorbs.

Is Stripe a PayFac? Yes. Stripe operates as a PayFac, aggregating its merchants (including large platforms) under its master merchant account. This is why Stripe can onboard merchants in minutes. It handles the underwriting and carries the chargeback risk. It also means Stripe sets the underwriting rules: if a merchant type conflicts with Stripe’s acceptable use policy, that merchant cannot be served.

Is Adyen a PayFac? Adyen holds acquiring licenses directly in multiple markets, which means it can act as a direct acquirer rather than requiring a third-party sponsor bank. It also offers a PayFac-model onboarding product for platforms. The practical difference is that Adyen’s direct acquiring relationships give it more flexibility on merchant types and transaction limits than a managed PayFac running through a single sponsor bank.

The payment facilitator platform decision ultimately comes down to transaction volume, merchant mix, risk tolerance, and how much of the unit economics the platform needs to control. Payments as a service is the adjacent model for platforms that want payment infrastructure without owning the acquiring relationship at all.

PayFac Companies and Platforms: What the Market Looks Like

PayFac companies are not all the same product, and treating them as interchangeable is one of the most common sourcing mistakes platforms make. The relevant dimensions are which markets the provider acquires in, which merchant types they accept, what underwriting autonomy they give the platform, and what the revenue split looks like at scale.

The companies most platforms evaluate fall into three categories:

Managed PayFac providers (e.g., Stripe, Square, and PayPal) operate their own master accounts and underwrite merchants directly. Onboarding is fast, and compliance is delegated, but underwriting decisions are controlled by the provider, and pricing headroom is limited by their fee structure.

PayFac infrastructure vendors (e.g., WePay/JPMorgan, Finix, and PayFac-in-a-Box providers) give platforms the infrastructure to run their own PayFac: sub-merchant onboarding APIs, underwriting tooling, and payout rails. The platform still registers as a PayFac with card networks and holds the sponsor bank relationship, but the build effort is reduced.

Acquiring banks with PayFac programs (e.g., Elavon, Worldpay, and Adyen) offer a hybrid: the platform uses the bank’s acquiring infrastructure and often its PayFac registration but may retain more pricing control than a pure managed provider.

For platforms assessing what credit card processing really costs at the sub-merchant level, the relevant comparison is between scheme and interchange fees plus processor markup (full PayFac) versus the fixed or variable split the managed provider takes. At scale, the full PayFac keeps more per transaction—but that advantage only materializes if the underwriting and chargeback costs are controlled.

Payment Facilitation in Practice: DashDevs Build Evidence

PayFac is easier to design on paper than to operate under production load—fraud cycles, scheme rule changes, and unexpected merchant category distributions have a way of invalidating assumptions made during the build.

DashDevs has built payment acceptance infrastructure for clients across 100+ financial products delivered, integrating 70+ fintech providers across those projects. Three builds are directly relevant to the PayFac and sub-merchant model.

iOL Pay: global hospitality payment acceptance. The iOL Pay payment acceptance platform we built for hospitality is a global fintech platform operating in 37+ countries, designed to accept payments across the hospitality sector. The build required multi-currency settlement, multi-property merchant management, and PCI DSS-compliant card data handling across a geographically distributed merchant base. The same structural challenges a PayFac faces when operating across markets.

MuchBetter: payment app infrastructure. Our work with MuchBetter covers an e-wallet payment app available in 180+ countries, serving 400K+ users and 300+ merchants. The merchant-facing infrastructure required a payment platform that could handle merchant onboarding, wallet-to-merchant settlement, and multi-currency payouts at scale.

Twisto: BNPL orchestration on Fintech Core. A BNPL provider’s payment orchestration layer built on Fintech Core demonstrates how a platform can centralize payment collection across multiple rails (card, bank transfer, wallet) with a unified ledger tracking per-merchant flows and balances.

The hardest part of the PayFac build is the per-sub-merchant ledger: who is owed what, after what adjustments, subject to which reserves, and provable to the sponsor bank on demand.

Advantages and Risks of Running a PayFac

The case for the full payment facilitation model comes down to revenue control and merchant experience. The case against it comes down to liability and operational overhead. Both are real.

Advantages.

• Revenue margin. The PayFac keeps the spread between what it charges merchants and what it pays to the scheme, processor, and sponsor bank. At meaningful transaction volume, this is a significant P&L line.
• Merchant experience. Instant onboarding, embedded checkout, and same-platform settlement are differentiators for vertical SaaS and marketplace products where payment friction directly affects conversion.
• Data ownership. The PayFac sees every transaction across its merchant base—a competitive advantage in underwriting, fraud decisioning, and product development.
• Pricing control. Unlike the ISO model, the PayFac sets its own pricing to merchants and can customize fee structures by merchant segment.

Risks and watch-outs.

How to start a payment processing company covers the licensing and regulatory path in detail for teams building the infrastructure to operate as a PayFac or PSP.

The B2B merchant services framing is a useful companion for teams thinking about the acquirer relationship from the other side.

Payment facilitators that manage risk well do so through three operating disciplines: continuous transaction monitoring (not just onboarding-time KYB), rolling reserve policies calibrated to merchant risk tier, and a documented escalation path from automated flags to human review.

The PayFac License Is the Starting Line. The Risk Lives in the Operations.

Most platforms that decide to become payment payfacs underestimate the operational discipline required after registration. Sponsor bank approval, card network registration, and PCI DSS Level 1 certification are achievable milestones. The harder work is the continuous underwriting review, chargeback triage, scheme compliance tracking, and reserve management that runs every day the master merchant account is live.

The platforms that operate payment facilitation models well do so because they made the risk model explicit before they built the infrastructure.

For teams at this decision point, the relevant question is “Do we want to own what comes with the master account, or would a managed model preserve the revenue upside while delegating the liability?”

For infrastructure for licensed PSPs and EMIs, Fintech Core, DashDevs’s composable fintech infrastructure and orchestration platform for companies launching, expanding, or modernizing regulated financial products. It provides the ledger, KYB/KYC, payment integrations, and compliance controls that underpin a PayFac or PSP build, without requiring a full custom build from scratch.

Whether the decision is full PayFac, managed, or ISO, choosing between KYC vendors for the underwriting stack and scoping the full engineering footprint before the sponsor bank conversation will determine whether the timeline is three months or eighteen.