PayFac vs PayFac-as-a-service: who carries the risk

PayFac vs PayFac-as-a-service comes down to who is registered with the card networks and who pays when a sub-merchant fails. A registered payment facilitator (PayFac) is entered by a sponsoring acquirer, signs its own sub-merchants, funds them and absorbs their losses. With PayFac-as-a-service, the provider is the PayFac of record, and the contract decides how much risk and work the platform keeps.

The short answer: registration and liability

The card rules start at the acquirer. Visa’s Core Rules treat a sponsored merchant as a merchant of the PayFac’s acquirer and make an acquirer that contracts with a PayFac “liable for all acts, omissions, and other adverse conditions caused by the Payment Facilitator” and its sponsored merchants (Visa Core Rules and Visa Product and Service Rules, edition of April 18, 2026). Mastercard states it the same way: “The Acquirer is responsible for all acts and omissions of a Payment Facilitator” (Mastercard Rules, edition of June 2, 2026). The PayFac in turn carries its sellers, because Visa’s rules make it “responsible and financially liable for each Transaction processed on behalf of the Sponsored Merchant”.

Neither network lets that chain repeat. A Visa PayFac “Must not deposit Transactions on behalf of another Payment Facilitator”, and Mastercard writes that “A Payment Facilitator may not be a Sponsored Merchant of any other Payment Facilitator”. A platform buying PayFac-as-a-service is therefore a sub-merchant of its provider rather than a PayFac itself, and Stripe’s services terms say a user “must not act as or hold itself out as a payment facilitator”. The three models are introduced in embedded payments; what follows is the obligation-by-obligation split. Row order carries no meaning.

Obligations of a registered PayFac under Visa and Mastercard rules

Registration is the acquirer’s act, not the platform’s. Visa requires an acquirer to have its registration of the PayFac, including an attestation of due diligence, “confirmed by Visa before submitting Transactions”, and its public risk guide describes filing through the Visa Program Request Management system (Visa Payment Facilitator and Marketplace Risk Guide, April 2021). Mastercard’s support page is short about it: “An acquirer must register a service provider as a payment facilitator with Mastercard.” The acquirer also controls the paperwork. Visa’s guide says “The acquirer must approve the merchant agreement” a PayFac uses to sign sellers and any later updates, and a PayFac must hold a separate High Risk Internet Payment Facilitator registration before signing high-brand-risk merchants.

Funding is an obligation, not a service level. Mastercard’s rules require that “Each Payment Facilitator must pay each Sponsored Merchant for all Transactions” it submits, allow the sub-merchant agreement to withhold amounts for chargeback reserves, and limit the settlement funds a PayFac accesses to paying sponsored merchants. Delegation does not move the risk either: the acquirer “remains fully responsible” for the tasks it delegates, which is why acquirer policy reaches into underwriting, record retention and monitoring. Visa’s risk guide puts the economics plainly, saying PayFacs “provide an unsecured line of credit to their sellers”, with disputes possible up to 120 days after purchase “and in some up to 540”. Visa also shows the sponsored merchant descriptor as “PF*Seller DBA Name” and notes that local law may require a money transmission license to receive and transmit settlement funds (Beyond the Acquirer, February 15, 2024).

Large sub-merchants and Visa’s $1 million ceiling

Size ends the arrangement for an individual seller. Visa requires an acquirer to enter “a direct Merchant Agreement with a Sponsored Merchant that exceeds USD 1 million” in annual transaction volume: before processing any transactions for a new seller, and within two years for an existing seller whose volume crosses the line. The PayFac may continue to provide payment services, “including settlement”. Exceptions turn on the seller’s merchant category code and the tenure of the relationship (Visa Acceptance Risk Standards).

Mastercard’s rules set their own threshold, above which a sponsored merchant must contract directly with a Mastercard customer unless the “Sponsored Merchant Threshold Conditions” are met: registration of the PayFac as a Network Enablement Partner plus acquirer oversight, including read-only access to the PayFac’s systems and a monthly review of at least 5% of newly onboarded sponsored merchants, or a “Threshold Exception MCC”. A Network Enablement Partner “directly engages with Mastercard instead of leveraging the relationship of a Mastercard-Licensed Customer”, and Mastercard offers an “Acceptance-Lite package” for smaller payment facilitators. These ceilings do not vanish under PayFac-as-a-service; they apply to the provider’s portfolio, which includes a platform’s largest sellers.

PCI DSS levels for payment facilitators

Mastercard’s Site Data Protection program places payment facilitators “with more than 300,000 total combined Mastercard and Maestro transactions annually” in Level 1, which requires an “Annual PCI assessment resulting in the completion of a Report on Compliance”; at or below that count, an annual self-assessment questionnaire is enough. Visa uses the same 300,000-transaction line for service providers and requires an annual Report on Compliance by a qualified security assessor. The version in force is PCI DSS v4.0.1, after the PCI Security Standards Council retired v4.0 on December 31, 2024, and 51 of the 64 new requirements were future-dated to March 31, 2025. Under PayFac-as-a-service the provider validates as the service provider; Tilled, for example, calls itself “a Validated Level 1 PCI Compliant Service Provider”.

PayFac-as-a-service providers compared

Finix announced that “Finix is now a registered payment facilitator (payfac)” and sells both models on one API. Its documentation says that “For Finix Flex customers, Finix manages and approves Settlements”, while Core customers approve their own and hold platform credentials that Finix ties to more responsibility. Sellers pass through Finix underwriting via the Merchant API. Pricing is not published beyond “flat rate, dynamic, or custom”.

Stripe Connect turns the loss question into a configuration. Either Stripe is responsible, in which case “Stripe covers losses due to your connected accounts’ negative balances” and collects KYC information, or the platform is, in which case it can incur those losses, may face reserves on its platform account and collects KYC itself unless connected accounts use the Stripe Express Dashboard. The setting is one-way: “You can’t update their values later.” Stripe advises new platforms to let Stripe take negative balances and pulls from a platform reserve when a connected account stays negative for 180 days. Charge type matters too, since a connected account taking direct charges “is always the merchant of record”, while destination and separate charges leave dispute amounts debited from the platform account.

Adyen for Platforms starts from the contract: “your users have a contractual relationship with the payment methods”, and Adyen verifies those users before processing and payouts. A platform already registered with Visa or Mastercard onboards “as a payment facilitator” and can facilitate ecommerce payments on an aggregated MID. Negative balances land on the platform’s liable balance account, from which funds can be “deducted from this account if your users’ balance accounts incur negative balances”.

Worldpay for Platforms sells both tracks, describing PayFac-as-a-Service as carrying “minimal upfront costs or risk compared to establishing your own PayFac” and the PayFac track as one where “you manage risk and compliance”. Payrix’s own entity documentation defines the Facilitator as “assuming all risk and underwriting liabilities as a payment facilitation business”. Global Payments completed its acquisition of Worldpay on January 9, 2026. Infinicept splits its products the same way, offering “Launchpay, a modern PayFac-as-a-Service, and Payops, an operating platform for registered PayFacs”, with a path between them and “No merchant reboarding”. Tilled publishes revenue-share tiers and, in its own marketing wording, sells payment facilitation “minus the upfront cost, overhead, and liabilities”; its site lists registrations as an ISO/MSP of Pinnacle Bank dba Synovus Bank and an ISO of Citizens Bank. Rainforest is the PayFac of record, requires the descriptor prefix “RF *”, contracts with merchants “as an agent of a Sponsor Bank” (First Citizens Bank & Trust Company, on its sponsor page updated May 9, 2023) and publishes interchange-plus buy rates rather than a revenue share.

Provider order carries no meaning.

Moving from PayFac-as-a-service to your own registration

Providers publish the route. Finix says platforms can “choose to become payfacs themselves” while staying on the same API and dashboard, and its guide concedes that outsourcing keeps overhead “significantly lower” than registering with an enablement partner. Infinicept supports the same move on one platform with “No merchant reboarding”. Worldpay’s PayFac track says it empowers a partner “as an independent entity to underwrite sub-merchants”. On Stripe Connect the question is settled earlier, because the responsibility properties are defined when the merchant configuration is added and cannot be changed later.

Timelines come from vendors, not from the networks. Worldpay’s own guide claims “It takes 12 to 24 months to become a PayFac” unless a platform is already registered, and Infinicept’s published steps, which start with choosing a sponsoring acquirer and obtaining PCI DSS Level 1, say “the process typically takes six to 12 months”. Treat both as provider estimates. A platform that owns its registration also owns its processor relationships, which is where payment orchestration starts to matter.