Before a single consumer swipes a credit card, taps a mobile wallet, or enters a digital checkout form, a complex financial ecosystem makes a critical calculation. Behind the scenes, a payment processor or acquiring bank must weigh a fundamental question: Should we take on this business and its inherent payment risk?
For decades, the onboarding process—often termed merchant underwriting—was treated by some industry players as a routine administrative hurdle. Businesses submitted basic identification, a corporate name, and bank account details, and if the paperwork checked out, they were cleared to accept payments.
However, a sweeping regulatory reckoning has fundamentally rewritten the rules of engagement. Two landmark enforcement actions by the Federal Trade Commission (FTC) in September have sent shockwaves through the payments industry, underscoring that payment processors can no longer act as passive conduits for high-risk or deceptive merchants. With tens of millions of dollars in penalties, stringent court-mandated monitoring requirements, and intense scrutiny on the horizon, the message from Washington is unequivocal: processors are the ultimate gatekeepers of the payments highway, and failing to inspect the traffic carries catastrophic legal and financial consequences.
Main Facts: The Regulatory Crosshairs on Payment Processors
The modern digital economy relies entirely on trust. Consumers trust that the merchants they buy from are legitimate; merchants trust that their acquiring banks will safely route funds; and payment processors trust that their clients are operating within legal and ethical boundaries. When that chain of trust breaks down, the fallout can devastate consumers and taint the entire payments ecosystem.
The scale of the regulatory crackdown became glaringly apparent in September, when the FTC levied major enforcement actions against two distinct players in the processing space:
- Nuvei: The FTC alleged that major payment processor Nuvei opened or maintained processing accounts for merchants that it knew, or should have known, were engaged in deceptive trade practices. Under the terms of a subsequent court order, Nuvei agreed to a $4.85 million settlement dedicated to consumer redress and must implement robust, enhanced merchant screening and continuous monitoring practices.
- Humboldt Merchant Services: Just days after the Nuvei action, the FTC trained its sights on Humboldt Merchant Services. The agency accused Humboldt of knowingly facilitating unauthorized billing by processing payments for more than 1,000 "shell merchants." According to the regulatory complaint, these sham entities served as fronts or pass-through vehicles for bad actors. To settle these severe allegations, Humboldt agreed to a $12 million monetary judgment for consumer redress and accepted strict prohibitions regarding high-risk merchants.
Combined, these two enforcement actions have resulted in a staggering $16.85 million in financial penalties. More importantly, they have permanently altered how payment processors, independent sales organizations (ISOs), and acquiring banks approach the vetting of prospective clients. Underwriting is no longer merely an exercise in checking a box; it is a high-stakes legal shield against regulatory liability.
Chronology of Events: From Operational Blind Spots to Regulatory Action
To understand how the merchant acquiring landscape reached this critical juncture, it is necessary to examine the timeline of systemic vulnerabilities and regulatory investigations that culminated in the September FTC orders.
The Foundation of Vulnerability (2021 – 2023)
During the post-pandemic digital boom, e-commerce transactions skyrocketed, giving rise to an unprecedented volume of online storefronts. Amidst this gold rush, bad actors sought out vulnerabilities in the financial infrastructure to launder illicit funds, run unauthorized recurring billing schemes, and perpetrate widespread consumer fraud.
According to disclosures related to the Humboldt case, the core conduct at the center of the FTC’s investigation primarily took place between 2021 and 2023. During this period, bad actors realized that high-risk businesses—such as fraudulent subscription traps, bogus technical support services, and unvetted nutraceutical vendors—were routinely blocked by strict acquiring banks. To bypass these safety filters, bad actors allegedly utilized shell companies.
These sham merchants obtained legitimate merchant accounts under false pretenses and then routed transactions for undisclosed, high-risk third parties. To further evade detection, the FTC alleged that Humboldt placed these high-risk shell accounts onto lower-risk Bank Identification Numbers (BINs). By masking the true nature of the transactions on these preferred BINs, the processors artificially elevated the likelihood that card-issuing banks would automatically authorize the fraudulent charges.
The Regulatory Awakening and September 2026 Actions
As unauthorized billing complaints mounted, federal regulators began digging deep into the paper trails connecting victimized consumers to the front-end merchants, and ultimately to the back-end payment processors. Investigators found that while processors collected standard onboarding fees, their internal risk management systems frequently ignored glaring red flags—such as mismatched business models, excessive chargeback spikes, and erratic transaction velocity.
- Early September: The FTC formally announced its enforcement action against Nuvei, zeroing in on systemic failures in onboarding and oversight regarding deceptive merchants. The resulting court order established an aggressive framework of mandatory enhanced screening parameters and proactive monitoring thresholds.
- Late September: The FTC swiftly followed up with its complaint and subsequent $12 million settlement against Humboldt Merchant Services, officially blocking the firm from onboarding high-risk merchant accounts and penalizing it for allegedly facilitating a massive network of pass-through shell companies.
Supporting Data: The Rising Tide of Fraud and the Imperative of Verification
The recent FTC actions do not exist in a vacuum. They arrive against a backdrop of escalating digital fraud and sophisticated criminal tactics that have put payment institutions under intense operational pressure.
Recent research conducted by PYMNTS Intelligence in collaboration with Plaid paints a vivid picture of a threat landscape in flux. According to the study, 57% of executives operating within payment-heavy industries reported that fraud attempts had actively increased over the preceding 12 months. This pervasive threat has forced a strategic pivot across the financial sector: nearly two-thirds of surveyed executives (65%) stated that they planned to aggressively strengthen their identity verification protocols over the subsequent year.
Furthermore, additional PYMNTS Intelligence research conducted alongside Trulioo highlights the multi-layered nature of modern defense strategies. Companies are no longer relying on a single checkpoint; they are deploying digital identity verification across an average of 4.4 distinct workflows. Among the 350 companies surveyed in that research:
- 67.7% utilize digital identity verification during account opening.
- 74.6% apply it to online transactions.
- 70.6% deploy it for ongoing fraud tracking.
The Cost of Delayed Detection
Perhaps the most telling data point for payment processors and risk officers involves when payment anomalies are discovered. A May study of middle-market companies by PYMNTS revealed a striking operational vulnerability: 57% of firms typically identified fraud or payment nonclearance only after settlement had already occurred.
The timing of discovery dictates the severity of the financial loss. The data revealed a stark contrast between early and late detectors:
- Instant Bank Account Verification: 81% of companies that caught payment problems before settlement used instant bank verification, compared to just 47% of those that discovered issues post-settlement.
- Open Banking Ownership Verification: 76% of early detectors utilized open banking-based ownership verification, contrasted with a mere 35% of later detectors.
The takeaway for merchant acquirers is absolute: information and verification protocols deployed before money moves can successfully prevent catastrophic financial exposure. Conversely, information discovered after the fact inevitably transforms into costly investigations, painful chargeback disputes, unrecoverable losses, and, in worst-case scenarios, federal regulatory enforcement.
Official Responses and Industry Accountability
In the wake of multi-million-dollar settlements and binding court orders, the accused processors and industry stakeholders have had to publicly address their operational shortfalls while outlining pathways toward compliance.
The Humboldt Response
In response to the $12 million settlement and the FTC’s blistering allegations, Humboldt Merchant Services maintained its legal posture while acknowledging past operational vulnerabilities. Representatives for the firm stated publicly that the conduct cited by federal regulators involved a relatively limited number of third-party sales agents and specific merchant accounts.
Crucially, Humboldt emphasized that the problematic activity occurred primarily between 2021 and 2023 under former corporate leadership. The company noted that it made no admission of wrongdoing as part of the settlement terms. However, in a tacit acknowledgment of the changing regulatory realities, Humboldt reported that it had substantially overhauled and strengthened its internal compliance infrastructure and risk management protocols to prevent any recurrence of similar issues.
The Nuvei Mandate
Unlike a standard settlement where a fine is paid and the case is closed, the Nuvei court order establishes an ongoing regulatory blueprint that redefines what a processor must legally demand from its merchant portfolio.
Under the terms of the federal order, Nuvei’s onboarding and underwriting file can no longer consist merely of proof of corporate formation and a basic credit check. For prospective merchants falling under enhanced screening mandates, Nuvei is legally required to compile a comprehensive dossier that includes:
- Exact details regarding what products or services the business sells and the specific marketing channels used to sell them.
- Full identification of all principals, controlling persons, and majority owners.
- Verification of all business names, trade names, active websites, and physical brick-and-mortar operating locations.
- At least five months of comprehensive chargeback data from prior processors or card networks.
- Where available, a minimum of six months of historical processing statements.
- Rigorous background checks to determine whether the merchant—or any related party—was recently placed into a card network chargeback monitoring program or terminated by another processor, acquirer, or financial institution due to excessive chargebacks.
Implications: A New Era of Continuous Risk Management
The dual shockwaves of the Nuvei and Humboldt settlements have created profound, long-lasting implications for the entire merchant acquiring and payments processing industry. The traditional "set-it-and-forget-it" model of merchant onboarding is officially dead.
1. Onboarding Becomes an Exhaustive Forensic Audit
For ISOs, payment facilitators (PayFacs), and acquiring banks, the barrier to entry for prospective merchants has risen exponentially. Underwriters are no longer evaluating mere credit risk; they are effectively conducting forensic audits. By comparing who legally controls a merchant, where they physically operate, and what their historical chargeback footprint looks like across the broader payments ecosystem, processors can spot shell companies and bad actors before they ever touch the payment rails.
2. The Shift to Continuous Monitoring
As mandated by the recent FTC orders, merchant screening cannot terminate the moment an account is approved and starts processing transactions. The regulatory framework establishes an active feedback loop between transaction activity and ongoing risk assessment.
For instance, Nuvei is now legally required to calculate chargeback rates on a strict monthly basis for every single client. If a client exceeds a 1% monthly chargeback rate alongside 75 or more chargebacks in any two months out of a preceding six-month window, an immediate, formal investigation must be triggered. For merchants under enhanced monitoring, processors must continuously audit customer complaints, flag unusual transaction velocity or geographic patterns, and routinely inspect active websites.
3. Squeeze on High-Risk Sectors
As major processors face severe liability for facilitating deceptive or high-risk billing models, many institutions are expected to retreat entirely from certain vertical markets, or alternatively, dramatically increase their compliance overhead costs. Legitimate high-risk merchants—such as legal nutraceutical brands, travel agencies, and multi-level subscription services—may find it increasingly difficult and expensive to secure reliable acquiring partnerships as processors exercise hyper-cautious risk aversion.
4. Technological Integration of Advanced Verification
To comply with mounting regulatory expectations without grinding profitable e-commerce to a halt, processors and merchants are aggressively investing in advanced verification technology. The integration of instant bank account verification, open banking-based ownership checks, and automated AI-driven fraud analytics into the onboarding and real-time processing pipelines will transition from a competitive advantage to an absolute baseline requirement.
Conclusion
The FTC’s September enforcement actions against Nuvei and Humboldt Merchant Services serve as a watershed moment for the financial technology and payments sectors. By demanding a combined $16.85 million in consumer redress and imposing strict, binding operational controls, federal regulators have made it abundantly clear that payment processors are co-responsible for the commercial behavior of the merchants they service.
For the payments industry, the path forward is clear. Underwriting must evolve from a superficial paperwork review into a rigorous, data-driven science. Continuous monitoring, advanced identity verification, and deep forensic auditing must be embedded into every layer of the transaction lifecycle. In this new regulatory era, the processors who thrive will be those that embrace their role not merely as facilitators of commerce, but as vigilant, uncompromising guardians of financial integrity.
