What you actually need to build before you can process cards
Starting a credit card processing company means becoming a middleman between merchants (the businesses that want to accept cards) and the banks that issue those cards. You do not need to be a bank yourself. What you do need is a merchant services agreement with an acquiring bank, a payment processor (the software and infrastructure that handles the transaction), and PCI DSS compliance — a security standard that protects cardholder data.
Most new processors do not build their own infrastructure from scratch. Instead, they partner with an existing payment processor (like First Data, Worldpay, or Stripe) and resell access to their network. You handle the sales, customer service, and pricing; they handle the technology and the connection to the banking system. This is called a reseller model, and it is the path most people take when starting out.
The alternative — building your own payment processing network — requires millions in capital, years of development, direct relationships with Visa and Mastercard, and regulatory approval from multiple agencies. Unless you have venture funding and a team of engineers, this route is not realistic.
Key Takeaways
- You need a contract with an acquiring bank, a payment processor partner, and PCI DSS certification before you can legally process cards.
- Most new processors start as resellers, partnering with an existing processor and selling their services under your own brand.
- You must register as a money services business in most states and comply with state money transmitter laws, which vary by location.
- Your processor partner will handle the technical infrastructure; you handle sales, customer relationships, and support.
- Startup costs range widely depending on your model, but reseller partnerships typically require less capital than building your own system.
Getting a merchant services agreement with an acquiring bank
An acquiring bank is the bank that holds the merchant's money and settles transactions into their account. You cannot process cards without one. The acquiring bank underwrites the merchant (checks their credit, business history, and chargeback risk), sets the merchant's discount rate (the percentage they pay per transaction), and manages the relationship with Visa and Mastercard.
As a new processor, you will not have a direct relationship with an acquiring bank at first. Instead, you will partner with a payment processor who already has that relationship. The processor acts as the intermediary. You sign a reseller agreement with them, they sign an agreement with the acquiring bank, and the acquiring bank processes transactions on behalf of your merchants.
If you grow large enough and want to cut out the middleman, you can eventually explore for your own acquiring bank relationship. This requires a track record of processing volume, strong financial statements, and proof that you can manage merchant risk. Most processors wait three to five years before attempting this.
Choosing and partnering with a payment processor
Your payment processor partner is the company that provides the actual technology — the terminals, the software, the connection to the banking network, and the settlement system. Common options for resellers include Stripe Connect, PayPal Commerce Platform, Square for Developers, and Worldpay's reseller program. Each has different requirements, pricing, and support levels.
When evaluating a processor, ask about their residual income model — how much you earn per transaction or per month from each merchant you bring them. Ask whether they allow you to white-label the service (put your own branding on it) or whether merchants will see the processor's name. Ask about their underwriting speed (how fast they can onboard a new merchant) and their chargeback and fraud support. Ask whether they provide you with a sales team or whether you are responsible for all customer acquisition.
Negotiate the terms. Processors often have standard reseller agreements, but many will adjust pricing, support levels, or revenue splits if you commit to a minimum volume or a longer contract term. Get everything in writing, including what happens if either party wants to end the relationship.
Understanding PCI DSS compliance and security requirements
PCI DSS (Payment Card Industry Data Security Standard) is a set of security rules that anyone handling credit card data must follow. It covers how you store data, who can access it, how you encrypt it, how you test your systems, and how you respond to breaches. Visa, Mastercard, American Express, and Discover all require it.
Your payment processor partner will handle most of the technical compliance — they maintain the find servers, encrypt the data, and manage the infrastructure. Your responsibility is to may support that your own systems (your website, your customer portal, your internal databases) also meet the standard. This usually means working with a may have access to Security Assessor (QSA) — a third-party firm that audits your systems and certifies that you are compliant.
The cost of a QSA audit ranges from a few thousand dollars to tens of thousands, depending on the size and complexity of your operation. You will also need to conduct regular security testing, maintain detailed logs of who accesses what data, and have a written incident response plan in case of a breach. Your processor partner can often recommend a QSA or provide guidance on what you need to do.
Registering as a money services business and complying with state laws
Most states require payment processors to register as a money services business (MSB) or money transmitter. The rules vary significantly by state. Some states require a license before you can operate; others require registration after you start. Some states have no requirement at all.
To find out what your state requires, contact your state's banking regulator or financial services department. They will tell you whether you need a license, what the process process is, what fees explore, and what ongoing reporting you must do. Common requirements include a surety bond (a may provide that you will follow the rules), proof of net worth, background checks on owners and officers, and annual financial reporting.
If you plan to operate in multiple states, you will need to comply with each state's rules. Some processors handle this for you as part of the reseller agreement; others require you to manage it yourself. Clarify this before you sign the contract.
Building your sales and customer support operation
Once you have a processor partner and the compliance pieces in place, your job is to find merchants and keep them happy. This means building a sales team, creating marketing materials, setting up a merchant portal where customers can view their transactions and statements, and providing customer support when something goes wrong.
Your sales approach depends on your target market. Some processors focus on high-volume, low-margin merchants (restaurants, retail shops) and compete on price. Others focus on niche markets (nonprofits, medical practices, e-commerce) and compete on specialized features or support. Your processor partner can tell you which merchants they already serve well and which segments have room for new resellers.
Customer support is where you differentiate yourself. Your processor handles the technical infrastructure, but you handle the merchant's experience. If a merchant's terminal breaks, you replace it. If they have questions about their statement, you explain it. If they are being hit with chargebacks, you help them understand why and how to prevent them. Good support keeps merchants from switching to a competitor.
Understanding the economics and pricing structure
Your revenue comes from the difference between what you charge merchants and what you pay your processor partner. If your processor charges you 2.2% per transaction and you charge merchants 2.5%, you keep 0.3%. If you process $1 million in volume per month, that is $3,000 in gross profit — before your operating costs.
Most resellers also earn residual income — a small monthly fee per merchant, even if they process nothing that month. This might be $10 to $30 per merchant per month. If you have 100 merchants, that is $1,000 to $3,000 in recurring revenue, which helps cover your overhead.
Your operating costs include salaries (sales team, support staff), marketing, office space, compliance and audit fees, and technology (your website, your merchant portal, your internal systems). Most new processors operate at a loss for the first year or two while they build their merchant base. Plan for this and make sure you have enough capital to cover it.
Frequently Asked Questions
Do I need a bank license to process credit cards?
No. You need a merchant services agreement with an acquiring bank, but you do not need to be a bank yourself. Your processor partner handles the relationship with the acquiring bank. You do need to register as a money services business in most states, which is a regulatory registration, not a bank license.
How much does it cost to start a payment processing company?
Costs vary widely. A reseller operation can start with $10,000 to $50,000 in capital (for compliance, marketing, and initial operating costs). Building your own payment network costs millions. Most new resellers start lean and reinvest early profits into hiring and marketing.
Can I process cards without a processor partner?
Not practically. You could explore directly to an acquiring bank, but they will require proof of significant processing volume, strong financials, and years of experience in the industry. Starting as a reseller is the realistic path for new entrants.
What happens if one of my merchants commits fraud?
Your processor partner handles the fraud investigation and chargeback process. You are responsible for vetting merchants before you sign them up and for monitoring their activity for red flags. If a merchant is committing fraud, your processor can terminate them and you lose that revenue.
How long does it take to get a merchant approved and processing?
Most processors can approve a merchant within 24 to 48 hours if the process is complete and the merchant is low-risk. High-risk merchants (those with poor credit or in regulated industries like gambling or adult services) can take weeks or may be declined entirely. Your processor partner will tell you their typical timeline.