Starting a credit card processing company requires merchant acquiring licenses, payment processor partnerships, and compliance with banking regulations
A credit card processing company sits between merchants and their customers' banks. You collect payments on behalf of merchants, deposit funds into their accounts, and handle the technical infrastructure or partner with someone who does. The barrier to entry is not capital — it is regulatory approval and the relationships you need to build with banks and payment networks.
You cannot process cards without a merchant acquiring license from Visa and Mastercard, which means you must first partner with a bank that holds an acquiring license. Most new processors do not become banks themselves; they become independent sales organizations (ISOs) or payment facilitators (PayFacs) under an existing bank's license. The path you choose determines your liability, your costs, and how much control you have over pricing and customer experience.
Key Takeaways
- You must partner with a bank that holds a Visa and Mastercard acquiring license — you cannot process cards independently without one.
- Independent sales organizations (ISOs) resell processing services under a bank's license and keep a portion of the interchange fees; payment facilitators (PayFacs) onboard merchants directly and assume more liability but keep more revenue.
- Compliance costs include undergoing a Visa audit, implementing PCI DSS security standards, and maintaining fraud monitoring systems — these are not optional.
- Your bank partner will require you to maintain a reserve account and carry errors and omissions insurance, typically costing thousands per year.
- Building relationships with acquiring banks takes months; most will not partner with you until you have a business plan, proof of capitalization, and a track record or industry experience.
Understand the ISO versus PayFac model
An ISO is the simpler entry point. You recruit merchants, sign them to processing agreements under your bank partner's license, and earn a cut of the interchange — the fee the customer's bank pays to the merchant's bank on each transaction. The bank handles settlement, fraud monitoring, and regulatory compliance. Your role is sales and customer service. An ISO typically keeps 20 to 40 basis points (0.20 to 0.40 percent) of the interchange, depending on your volume and the bank's appetite.
A PayFac is more complex but more profitable. You onboard merchants directly into your own system, handle their underwriting, and assume liability for their transactions. You keep a larger share of the interchange — sometimes 60 to 80 basis points — but you also carry the risk if a merchant commits fraud or a customer disputes a charge. PayFacs require more capital, more compliance infrastructure, and more insurance. Most new processors start as ISOs and graduate to PayFac status after proving they can manage risk.
A third model, reseller, requires even less infrastructure: you straightforward refer merchants to an existing processor and earn a commission. This is not processing; it is sales. If you want to build a processing company, not just earn referral fees, you need to be an ISO or PayFac.
Find and partner with an acquiring bank
Your first step is identifying banks that sponsor ISOs or PayFacs. Not all banks do this; most large banks have closed their ISO programs or made them extremely selective. Regional and community banks are more likely to partner with new processors, particularly if you have industry experience or a specific vertical (restaurants, e-commerce, nonprofits).
Banks will ask for a business plan that includes your target merchant type, your sales strategy, your projected volume, and your compliance infrastructure. They will also ask for proof that you have capital — typically $50,000 to $250,000 in liquid reserves, depending on your model and the bank's risk appetite. Some banks require you to maintain a reserve account with them; others require a letter of credit from a third party.
The underwriting process takes two to four months. The bank will conduct background checks on you and your principals, verify your business registration, and sometimes require you to pass a Visa audit before you sign. Once you are approved, you receive a merchant acquiring agreement that defines your revenue share, your compliance obligations, and the circumstances under which the bank can terminate the relationship.
Obtain Visa and Mastercard certifications
Visa and Mastercard require all processors to complete formal training and pass an audit. For ISOs, your bank partner usually handles the Visa audit, but you must still complete Visa's ISO training program, which covers compliance, fraud prevention, and dispute resolution. Mastercard has a similar program called the Mastercard Processor Certification Program.
These certifications are not one-time events. Visa and Mastercard update their rules annually, and you must recertify or attend updates every year. The cost is typically $1,000 to $3,000 per certification, plus your time. If you become a PayFac, the audit requirements are more stringent; Visa will audit your merchant onboarding process, your fraud controls, and your financial reserves.
Build your technology infrastructure or partner with a processor
You have two paths: build your own payment processing software or white-label an existing platform. Building from scratch requires hiring developers, obtaining a Payment Card Industry Data Security Standard (PCI DSS) Level 1 certification, and maintaining that certification indefinitely. This costs $100,000 to $500,000 upfront and $20,000 to $50,000 per year in compliance and security audits.
Most new processors white-label a platform from a payment processor service provider like Fiserv, FIS, or Repay. You pay them a monthly fee per merchant or per transaction, and they handle the technical infrastructure and PCI compliance. You focus on sales and customer service. This reduces your upfront cost to $10,000 to $50,000 but reduces your per-transaction margin because you share revenue with the platform provider.
Whichever path you choose, you must implement fraud monitoring and chargeback management. Most banks require you to use their fraud tools or a third-party service like Kount or Sift. These services cost $500 to $2,000 per month depending on your volume.
Implement compliance and risk management systems
PCI DSS compliance is not optional. If you handle card data directly — even encrypted card data — you must achieve and maintain PCI DSS certification. Level 1 certification (the highest) requires annual third-party audits, penetration testing, and continuous monitoring. Level 2 and 3 certifications have lower costs but explore only if you process fewer than a certain number of transactions per year.
You must also implement Know Your Customer (KYC) and Anti-Money Laundering (AML) procedures. This means verifying the identity of every merchant you onboard, checking them against government watchlists, and monitoring their transaction patterns for suspicious activity. Many processors use third-party KYC/AML services like Socure or Jumio to automate this; these services cost $1 to $5 per merchant onboarded.
Finally, you must carry errors and omissions insurance (E&O) and cyber liability insurance. E&O insurance protects you if a merchant sues you over a processing error or a dispute you mishandled. Cyber liability covers data breaches. Combined, these policies cost $3,000 to $10,000 per year for a new processor.
Recruit merchants and build your sales channel
Your revenue depends on merchant volume. Most new processors start by recruiting merchants in a specific vertical — restaurants, salons, nonprofits, e-commerce — where they have existing relationships or informed. This is more efficient than trying to compete with established processors for general merchants.
You can build a direct sales team, recruit independent sales agents who earn commissions, or partner with software providers who refer merchants to you. If you use independent agents, you must train them on your compliance obligations and monitor their sales practices; if an agent signs a merchant fraudulently or misrepresents your terms, you are liable.
Pricing is typically a combination of a percentage of transaction volume (1.5 to 3 percent) plus a per-transaction fee (10 to 30 cents). You must undercut established competitors enough to win merchants but keep enough margin to cover your costs and your bank partner's cut.
Plan for ongoing regulatory and operational costs
Once you are live, your costs do not end. You must renew your Visa and Mastercard certifications annually, maintain your PCI DSS compliance, and update your fraud and AML systems as regulations change. You must also monitor your merchant portfolio for fraud and chargebacks; if your chargeback rate exceeds Visa's threshold (typically 1 percent), Visa can fine you or terminate your acquiring license.
Budget for legal and compliance staff or consultants. Most processors hire a compliance officer or contract with a compliance consultant once they reach $1 million in annual volume. This person ensures you stay current with Visa, Mastercard, and federal banking regulations, which change frequently.
You must also maintain adequate capital reserves. Your bank partner will require you to hold a percentage of your monthly processing volume in a reserve account — typically 1 to 5 percent. This protects the bank if you go insolvent or if a merchant defaults on chargebacks.
Frequently Asked Questions
Do I need to be a bank to process credit cards?
No. You can process cards as an ISO or PayFac under a bank's acquiring license. The bank holds the license; you operate under their sponsorship. Becoming a bank yourself requires a federal charter, which takes years and costs millions.
How much capital do I need to start?
Most acquiring banks require $50,000 to $250,000 in liquid reserves, depending on your model and target volume. Add another $20,000 to $100,000 for technology, compliance, and insurance. Total startup cost is typically $100,000 to $400,000.
How long does it take to get approved by a bank?
Two to four months is typical. The bank will conduct background checks, verify your business, and sometimes require you to pass a Visa audit before approval. Some banks move faster if you have industry experience or a large merchant pipeline ready to sign.
Can I process cards without PCI DSS compliance?
No. Visa and Mastercard require all processors to achieve PCI DSS certification. If you do not handle card data directly, you can use a lower certification level, but you cannot avoid it entirely.
What happens if one of my merchants commits fraud?
If you are an ISO, your bank partner typically absorbs the loss. If you are a PayFac, you absorb it. This is why PayFacs require more capital and insurance. You must also implement fraud monitoring to catch suspicious activity before it becomes a loss.