Underwriting
On this page
- Why Processors Underwrite
- PayFac vs. Traditional: Why Stripe Approves in Minutes
- What Documents You Need
- Risk Factors Processors Evaluate
- Common Rejection Reasons
- Tiered Approvals and Volume Limits
- Ongoing Monitoring
- Critical Thresholds to Know
- Reserve Requirements
- What Processors Check on Your Website
- Billing Descriptors
- Enhanced Due Diligence Industries
- Scale Callout
- Test to Run
- Where This Breaks
- Next Steps
- See Also
Before applying for processing:
- Know your monthly volume and transaction mix
- Understand your MCC and risk profile
- Have basic business documentation ready
- Underwriting = risk assessment. Processors decide if you're worth the liability before letting you accept cards.
- PayFacs approve instantly because they absorb initial risk and monitor you later. Traditional accounts take days/weeks because the bank underwrites upfront.
- Your limits reflect your risk tier. Low limits at first are normal. Demonstrate good behavior to graduate.
- Documents prevent rejection. Missing paperwork is the #1 reason for delays and declines.
- Ongoing monitoring never stops. Volume spikes, chargebacks, or business changes trigger re-review.
You clicked "Apply" on a payment processor's website. Now they're asking for your business license, bank statements, and government ID. What's going on?
This is underwriting. It's the process where the processor decides whether to take you on as a customer and, if so, under what conditions.
Why Processors Underwrite
When you accept a card payment, money moves from the cardholder's bank to yours. But here's the catch: you get paid before the cardholder's bank has fully committed.
If the cardholder disputes the charge 60 days later, that money gets pulled back. If you're already gone (or broke), the processor eats the loss. Underwriting is how they avoid that.
What they're really asking:
- Are you a real business?
- Will your customers be happy (low chargebacks)?
- If disputes happen, can you cover them?
- Are you likely to disappear with the money?
Every document request, every verification step, exists to answer these questions.
PayFac vs. Traditional: Why Stripe Approves in Minutes
There are two paths to accepting payments, and they have very different underwriting experiences.
Payment Facilitators (PayFacs)
Examples: Stripe, Square, PayPal, Toast
How it works: You become a "sub-merchant" under their master merchant account. They're already approved by the banks. You're riding on their approval.
| Aspect | PayFac Model |
|---|---|
| Approval time | Minutes to hours |
| Initial limits | Low ($10K-$50K/month typical) |
| Documentation | Minimal upfront (ID, bank account) |
| Risk approach | Approve fast, monitor closely, shut down bad actors |
| Who eats losses | PayFac absorbs initial losses, passes to you via reserves |
Why it's fast: They accept the risk upfront and manage it through:
- Low initial limits
- Aggressive monitoring
- Quick account termination if problems arise
- Reserves held from your payouts
Traditional Merchant Accounts
Examples: Direct bank relationships, Worldpay, First Data (Fiserv), traditional ISOs
How it works: You get your own merchant account. The acquiring bank underwrites you directly.
| Aspect | Traditional Model |
|---|---|
| Approval time | Days to weeks |
| Initial limits | Based on underwriting (can be higher) |
| Documentation | Extensive upfront |
| Risk approach | Underwrite thoroughly before approving |
| Who eats losses | You (via reserves) or the processor |
Why it takes longer: The bank does full due diligence before saying yes. Less monitoring after approval because they've already vetted you.
Which Path for You?
| Situation | Recommendation |
|---|---|
| Just starting, under $50K/month | PayFac (Stripe, Square) |
| Established, $100K+/month | Get quotes for both |
| High-risk MCC | Traditional (PayFacs often reject) |
| Need higher limits fast | Traditional with good docs |
| Hate paperwork | PayFac |
What Documents You Need
The documentation ladder scales with your risk level and volume.
Tier 1: Basic (Most SMBs)
Required for almost any processor:
| Document | Why They Need It |
|---|---|
| Government-issued ID | Verify you're a real person (KYC) |
| Business registration | Prove the business exists (EIN letter, articles of incorporation) |
| Bank account details | Where to send your money (voided check or bank letter) |
| Website URL | Review what you're selling |
Tier 2: Elevated ($50K+/month or Higher Risk)
| Document | Why They Need It |
|---|---|
| 3-6 months bank statements | Verify cash flow matches claimed volume |
| Processing statements | See your history with previous processor |
| Beneficial ownership | Identify all 25%+ owners (required by law) |
| Business license | Verify you're legally operating |
Tier 3: High Volume or High Risk
| Document | Why They Need It |
|---|---|
| Financial statements | Assess ability to cover chargebacks |
| Business plan | Understand your model if it's unusual |
| Personal financial statement | Backup if business can't cover losses |
| Product samples/marketing | Verify you're not selling prohibited goods |
Blurry photos, expired IDs, or bank statements with account numbers redacted = delays. Give them clean, complete documents the first time.
Risk Factors Processors Evaluate
Underwriters score you across multiple dimensions. Here's what moves the needle.
The Big Five
| Factor | Lower Risk | Higher Risk |
|---|---|---|
| MCC/Industry | Retail, restaurants, professional services | Supplements, travel, digital goods, subscriptions |
| Volume | Consistent, predictable | Spiky, rapidly growing |
| Average ticket | Under $100 | Over $500 |
| Time in business | 2+ years | Under 6 months |
| Chargeback history | Under 0.5% | Over 1% |
| Owner credit | 680+ | Under 600 |
| Delivery timing | Immediate | Delayed (travel, events, pre-orders) |
| Card-present vs CNP | Mostly card-present | Mostly card-not-present |
What Triggers Enhanced Review
Even if you're generally low-risk, these factors trigger extra scrutiny:
- MATCH/TMF listing - You or your business is on the industry blacklist
- Previous processor termination - Why did they drop you?
- International structure - Non-US owners, offshore fulfillment
- Negative option billing - Free trials that convert to paid
- Affiliate marketing - Who's selling on your behalf?
Common Rejection Reasons
Most rejections fall into a few categories. Knowing them helps you avoid them.
Prohibited Industries
Some processors won't touch certain MCCs regardless of your history:
- Adult content
- Cannabis/CBD (varies by processor)
- Weapons/ammunition
- Gambling (unlicensed)
- Cryptocurrency
- Debt collection
- Multi-level marketing
Solution: Find a high-risk specialist processor. They exist, they'll charge more, but they'll take you.
Documentation Issues
| Problem | Fix |
|---|---|
| Missing documents | Submit everything they ask for |
| Inconsistent information | Business name on application must match bank account |
| Expired ID | Renew before applying |
| PO Box as business address | Use a real address |
| Unverifiable business | Get proper registration |
Risk Profile Too High
| Issue | What To Do |
|---|---|
| Bad personal credit | Apply with a different principal, or improve credit first |
| High chargebacks at previous processor | Document what you've fixed |
| New business, no history | Start with PayFac, build track record |
| Volume too high for your financials | Apply for lower volume, graduate up |
MATCH/TMF Listing
If you're on the MATCH list (Mastercard's terminated merchant file), most processors will auto-decline. You got on this list because a previous processor terminated you for:
- Excessive chargebacks
- Fraud
- Violating card network rules
- Business failure with outstanding chargebacks
What to do:
- Wait 5 years (listings expire)
- Work with MATCH-friendly processors (they exist, expect higher rates)
- Document what changed if you want to appeal
Tiered Approvals and Volume Limits
Getting approved doesn't mean unlimited processing. Most SMBs start with limits and graduate up.
How Limits Work
| Limit Type | What It Controls |
|---|---|
| Monthly volume cap | Total $ you can process per month |
| Daily volume cap | Maximum $ per day |
| Single transaction cap | Maximum $ per transaction |
| Weekly payout cap | Maximum $ paid out per week |
Why You Got Low Limits
Low initial limits are normal, not a rejection. Processors:
- Don't know your actual chargeback rate yet
- Need to see you deliver products and handle customers
- Want to limit exposure until you prove yourself
How to Graduate to Higher Limits
| Timeframe | What Helps |
|---|---|
| 0-3 months | Process consistently, zero chargebacks, respond to all requests |
| 3-6 months | Request limit increase, provide updated bank statements |
| 6-12 months | Demonstrate sustained performance, provide financials if needed |
| 12+ months | Renegotiate terms, consider traditional account if PayFac limits constrain you |
The graduation request:
"I've been processing $30K/month for 6 months with a 0.2% chargeback rate. I'd like to increase my limit to $75K/month. Attached are my last 3 bank statements showing the volume."
Card Network Thresholds
PayFacs have hard limits set by Visa and Mastercard:
- $100K/month per sub-merchant - Standard threshold
- $1M/year - Must transition to direct merchant relationship
If you're approaching these, your PayFac will tell you. Start planning your transition to a traditional account.
The $1M Graduation Requirement
This is a hard rule. When you hit $1M in annual volume with Visa or Mastercard through a PayFac, you must "graduate" to a direct merchant account with the acquiring bank. This means:
- Re-underwriting under traditional standards
- Direct contract with the acquiring bank
- Different (often better) pricing
- More documentation requirements
- Settlement may flow differently
Plan ahead. If you're at $800K/year and growing, start conversations about graduation before you hit the threshold.
Ongoing Monitoring
Underwriting doesn't end at approval. Processors watch you continuously.
What Gets Flagged
| Activity | Why It's Flagged |
|---|---|
| Volume spike | 2-3x normal volume in a week |
| Chargeback increase | Approaching 0.9% (card network threshold is 1%) |
| Refund spike | Over 10% refund rate |
| Average ticket change | Suddenly processing much larger transactions |
| New product/service | Selling something different than approved |
| Bank account change | Could indicate ownership change or fraud |
What Happens When Flagged
How to Avoid Surprise Holds
- Warn your processor before volume spikes - "Black Friday is coming, expect 3x volume"
- Respond to document requests within 24 hours - Delays = holds
- Keep documents current - Updated bank statements, renewed licenses
- Report business changes proactively - New products, ownership changes, address moves
Critical Thresholds to Know
Cross these thresholds and you trigger enhanced monitoring, reserves, or termination.
Chargeback ratio: Stay under 0.9%. At 0.9%+ with 100+ disputes, card network monitoring programs kick in with $25K+/month fees. Over 1.8% risks termination and MATCH listing. See Network Monitoring Programs for detailed thresholds.
Refund ratio: Processors flag refunds over 4% (card-present) or 8% (card-not-present). High refunds signal customer dissatisfaction even without chargebacks.
Volume spikes: 150%+ of daily average triggers review. 200%+ of approved monthly volume likely triggers a funds hold pending explanation.
Reserve Requirements
Reserves are money the processor holds as protection against future chargebacks. Typical amounts:
| Risk Level | Reserve % | Hold Period |
|---|---|---|
| Low risk | 0-5% | 0-30 days |
| Medium risk | 5-10% | 30-90 days |
| High risk | 10-20%+ | 90-180 days |
After 6-12 months of clean processing, request a reserve reduction with evidence of low chargebacks and consistent volume.
For detailed guidance on reserves, holds, and what to do when funds are stuck: See Holds and Reserves.
What Processors Check on Your Website
Before approving you (and periodically after), processors review your website. Here's their checklist:
Required Elements
| Element | What They Look For |
|---|---|
| Business name and address | Must match your application |
| Customer service contact | Phone, email, or chat clearly displayed |
| Products/services | Clearly described, consistent with your MCC |
| Pricing | Transparent, in USD, no hidden fees |
| Refund/return policy | Clear and accessible |
| Privacy policy | Required for card acceptance |
| Terms and conditions | Especially for subscriptions |
| Card brand logos | Properly displayed (Visa, MC, Amex) |
Red Flags They Look For
- Products don't match your MCC (you said "retail" but you're selling supplements)
- No customer service information
- Unrealistic claims ("guaranteed results," "miracle cure")
- Fake testimonials or celebrity endorsements without proof
- Pre-checked boxes for additional purchases
- Hidden subscription terms
- Website content in different language than business location
- Shipping times don't match delivery model
Secret Shopping
Processors may buy from you without identifying themselves. They're checking:
- Is the product as described?
- Is the checkout experience clean?
- How easy is it to cancel or return?
- Does the billing descriptor match expectations?
Billing Descriptors
Your billing descriptor (what appears on customer card statements) is reviewed during underwriting. It must be recognizable to customers and include a working phone number. Poor descriptors cause "I don't recognize this charge" disputes.
For detailed descriptor optimization: See Descriptors and Communication.
Enhanced Due Diligence Industries
Some business models trigger extra underwriting scrutiny. If you're in these categories, expect more questions and higher reserves.
Subscription and Recurring Billing
What they check:
- How do customers cancel?
- Are terms clearly disclosed before purchase?
- What's your involuntary churn (failed payments) rate?
- Do you send billing reminders?
Free Trials (Negative Option)
Processors are especially cautious because of high chargeback history in this category.
Requirements:
- Trial must be long enough for product delivery and use (14+ days for physical, 10+ for digital)
- Clear disclosure of what happens after trial
- No pre-checked boxes for enrollment
- Easy cancellation process (can't require phone call if signup was online)
- Reminders before first charge
Affiliate Marketing
If you use affiliates to drive sales:
- You're responsible for their marketing claims
- Processors may check affiliate websites
- High-pressure tactics by affiliates = your problem
- Must be able to track which affiliate drove which sale
Future Delivery (Travel, Events, Pre-orders)
Higher risk because customers pay now, receive later:
- Expect higher reserves (sometimes 100% until delivery)
- Must demonstrate fulfillment capability
- May need to provide event/travel partner contracts
- Chargebacks spike if delivery fails
Tech Support / Remote Services
High fraud history in this category:
- Must demonstrate legitimate expertise
- No "cold call" or popup-based sales allowed by most processors
- Extra scrutiny on elderly customer demographics
- Must have clear service descriptions
Scale Callout
| Volume | Underwriting Experience |
|---|---|
| Under $50K/mo | PayFac, instant approval, low limits, graduate up |
| $50K-$250K/mo | Either path works. PayFac for simplicity, traditional for better terms |
| $250K-$1M/mo | Traditional recommended. Better rates, higher limits, more paperwork |
| Over $1M/mo | Direct acquiring relationship. Custom terms, dedicated support |
Test to Run
Before applying anywhere:
- Gather your documents - ID, business registration, bank letter, website
- Check your credit - Know your score before they pull it
- Calculate your actual volume - Monthly average, not peak month
- Review your website - Does it clearly show what you sell, pricing, refund policy?
- Search MATCH - If you've been terminated before, know before they tell you
Where This Breaks
-
High-risk industries with limited options. Sometimes one processor is willing to take you, and they know it. Expect to pay more.
-
Rapid growth triggering repeated re-underwriting. Growing 10x in 6 months means constant document requests and potential holds.
-
Previous processor problems following you. MATCH listings and bad history don't disappear. Plan for a longer, more expensive path.
-
International complexity. Non-US structures, offshore fulfillment, or international customers add underwriting friction.
Next Steps
Just starting out?
- Choose a processor - PayFac vs traditional
- Gather Tier 1 documents - ID, business registration, bank account
- Apply and accept initial limits - Build history first
Hit your limits?
- Request limit increase with documentation
- Consider adding a second processor
- Evaluate transition to traditional account
Got rejected?
- Ask for the specific reason
- Fix what's fixable (documents, credit, website)
- Try a different processor or high-risk specialist
See Also
- Processor Selection - Choosing the right processor
- Contracts - Contract terms and fee breakdown
- Holds and Reserves - Managing cash flow impact
- Processor Management - Ongoing relationship
- MCC Codes - Industry classification