Merchant of Record vs PayFac: MOR Explained: What Everyone Gets Wrong - Know The Difference | PEP110

“Merchant of record” gets thrown around nonstop, but it changes who owns the customer, the descriptor, and the liability. We break down what it really means and what it is not.

“Merchant of record” sounds like a neat shortcut in payments until you realize it can change who owns the customer experience, who appears on the billing descriptor, and who gets stuck holding the bag when disputes, taxes, or regulators show up. We dig into what we’re seeing with Visa VAMP in the real world, including why the feared wave of mass shutdowns has not really materialized for legitimate merchants. Instead, many businesses are treating VAMP as an expensive new cost of doing business, especially when their ratios run hot.

If you take the card, you might inherit the mess: chargebacks, refunds, sales tax, and even state platform fees. Merchant of record models can scale fast, but compliance gets weird fast.
Christopher Dryden, Esq., and Jeremy Stock talk with Matthew Steinbrecher of Sound Commerce (https://sound-commerce.com/) break down what VAMP is actually doing in the market, why most merchants are paying the extra fees instead of getting shut down, and where subscription businesses get unfairly hit. Then we get precise about what “merchant of record” really means, how it differs from a true PayFac, and why tax and money movement rules can become the hidden risk.

• VAMP impact showing up more in fees than shutdowns
• Subscription disputes driven by TC40 and customer laziness
• RDR and alert tooling dynamics with Verifi and Ethoca resellers
• Downstream markups from sponsor banks, ISOs, and agents
• Amex OptBlue threshold changes and basis point tradeoffs
• MasterCard refund rate monitoring and why blanket rules misfire
• Merchant of record explained as a large reseller with descriptor responsibility
• PayFac defined role vs merchant of record as “just a merchant” in scheme rules
• Money movement structures like FBO accounts vs direct redistribution risk
• Indirect sales tax exposure and state platform fee surprises

We also unpack why subscription businesses can look “high risk” on paper even when they are not. If customers can’t be bothered to cancel and just call their bank, those TC40 signals and chargebacks add up fast. That flows into the ecosystem around Rapid Dispute Resolution (RDR) and alert products like Verifi and Ethoca, where big merchants may get direct pricing while smaller merchants often pay through resellers with multiple layers of markup.

VAMP panic vs VAMP reality: are merchants actually getting shut down, or just paying to play? Plus why subscription businesses get hammered by TC40 when customers call the bank instead of canceling.

From there, we get specific about definitions. A real PayFac is a defined network role with underwriting and financial liability. A merchant of record, in plain terms, is often just a large reseller or distributor that takes the card, owns the descriptor, and handles customer service, which can create downstream exposure for indirect sales tax, money transmission, and even state specific platform fee laws. If you’re building a marketplace, platform, or merchant of record model, this is the compliance map you want before you scale.

Subscribe, share this with someone building in payments, and leave a review if it helped. What part of the merchant of record vs PayFac debate do you want us to go deeper on?

**Matters discussed are all opinions and do not constitute legal advice.  All events or likeness to real people and events is a coincidence.**

PEP Links:
https://www.globallegallawfirm.com/podcasts/

A payments podcast of Global Legal Law Firm

Transcript

Sponsor Bank Shutdowns And Matching

0:00

You go to the sponsor bank, a lot of these peptide merchants they get matched after they get approved. You go to the sponsor bank, and the sponsor bank's like, I don't know what to tell you. Like they didn't really give us any reason, they just told us to close the account and match the person. And it's like, you know, I mean, they they don't I don't know if I have that in writing anywhere, but uh essentially that's the story. And then, you know, depending on on again, another podcast, but Bryce has a whole thing with with some of these sponsor banks that have uh that have routinely underwritten peptide merchants that this has happened to. It's like, well, look, like you know, show me in the rules, or here, let's just what do you need from us to show the due diligence to give some sort of comfort that hey, we shouldn't be matched because we're following whatever, regardless of MasterCard's guidelines, right? Like, that's the thing, and it's uh you know, the inherent uh the inherent flaws in the architecture and operation of the system, but we won't get into all that necessarily in this subject matter.

VAMP Rollout And Real Impact

1:03

Today's topic merchant of records, merchant of records, yeah, totally. Welcome to the Payments Experts Podcast, a podcast of global legal law firm. We hope you enjoyed this episode. Yeah, thanks for having me, yeah. Yeah, of course, man. I always love having you on. Um I talk to you more often than you're on the podcast. But yeah, it's uh it's been a little while. I think we we were on what September, October last year before VAMP. Uh VAT was like initiated. We were kind of doing some discussion around um Vamp, what it was, how it changed from the prior program, what could it mean, you know? Yeah. Um, in your estimation, you've had about a six-month ramp, if not longer, associated with Vamp. You know, what what are you seeing? Like, I I I I don't even know if we've talked about this offline, but what if what are you seeing in in the marketplace where you think it's having an impact both positively and negatively? Yeah, I think so. Most of the impact I've seen is really portfolio level from the acquirer side, which was, you know, the original vamp that came in was like portfolio level at the acquirer bin level, rather. And then, you know, now more recently it's cracked down to go to the individual mid-level. But I think like most of the stuff we've seen, you know, for for any merchants that are running, you know, let's call it running hot, right? They have high VAMP ratios. Like, most of them are agreeable to pay the additional fees that come with breaching the vamp ratios. And sometimes it sucks because you know, you may be a subscription business. I think subscription businesses are what Visa probably will eventually do a carve out for. Because there are a lot of low-risk subscription businesses that like American consumers are just, you know, they're easy to just call their bank and be like, hey, I didn't make this transaction, I don't remember this subscription, or I didn't subscribe to this, and then bam, like they're too lazy to just go do the one click unsubscribe on the merchant's website. Uh, so they just call their bank instead, and you know, it becomes a TC40 and hits VAMP. So I think there's some like really good actors in there, particularly in subscription space, that are probably getting hammered unnecessarily from you know the increased fees. But in terms of like these mass shutdowns and stuff like that, a lot of people were expecting, like, I haven't seen it at all. And the only time I have seen it is when, you know, an ISO's bin, for example, is it was already underwater on VAMP. And so they're just scrambling to try to protect their their ratios at their level. So they're just cutting off all their bad actors. But for the most part, you know, as long as you're doing everything legit and above board, even if you're running a little hot with Vamp and you have to pay some extra fees, most people have been pretty agreeable with it. So it's a lot more money in Visa's pocket, um, and certainly kind of forces you to enroll in RDR now. Um, but yeah, at the end of the day, I I don't think it was this huge issue that everyone thought it was going to be. It seems to have stabilized a little bit more. Still a pain in the ass, nonetheless, but it's definitely stabilizing.

RDR Economics And Verifi Access

4:08

Have you seen the because this is something of interest to me? It looks like this Vamp change also was kind of to shift RDR direct to visa, whereas that used to be a service that was sold kind of in the in the inner echelons between the card brands and the merchant, and there was some sort of uh you know, some sort of revenue aspect to it or profit profit center aspect to the players in the industry. Have you seen is it more of a shift direct to visa and with RDR, or is it has that been something that's required, or is there still an opportunity there to shift these merchants into RDR to allow them some flexibility and then also maybe make a little bit of money off of that? Yeah, I think the Yeah, the the main squeeze there is I think with larger businesses, like anyone doing you know over a billion in in gross revenue annually, I think is on the radar to go to Verify directly and work with one of their sales reps. And actually, it's kind of funny because there's all these resellers, there's you know, probably a hundred of them around the world that will resell, you know, verify and ethica alerts. And those resellers are largely touching like long tail smaller companies. But what Verify does is they usually make the buy rates on the resellers and like white label solutions who are obviously making an arbitrage on the difference to provide the service. They're making their fees higher than what they would offer, you know, a direct merchant that that onboards with Verify. So, but the problem is that Verify won't onboard small merchants, like they don't have the capacity and the bandwidth from a sales and account management and logistical perspective to onboard tens of thousands or hundreds of thousands of really small merchants. So they really just kind of cherry-pick the big ones, give them super good rates, and then you know, they largely leave the white label partners to handle the the rest of the industry. So it still kind of has has been the same. Like I do see larger merchants getting way better deals direct, but you have to be pretty large. And for the most part, most merchants are not really getting access to that stuff. And

Amex OptBlue Thresholds And Fees

6:17

and the additional fees that are coming in uh for people that can't stay within the threshold, are those uh are those penal, you know, or are they more um you know, just kind of like, hey, you got to pay a little bit more to play? I I recently saw the reason I'm asking this is because I don't know if you know this, and this came from one of our clients, but MX Opblue just uh increased the threshold for the program to three million from one million, yep, so that you don't have to go to ESA. And in addition to that, and I didn't know if this was something like you were talking about, where like, hey, it's like you're not gonna just get shut down. Well, with AMX, you're not gonna just get transferred over, but now you can actually be above the thresholds up to like 100 million or 250 million, and you're just playing extra basis points on the volume. Yep. And it allows people to stay in AMX.blue. And I just saw this. And look, it's not something that is widely published or anything. I had to go in and research on a particular case study that was being presented to me to know A, that the threshold had changed to be able to stay under the Amex.blue. Because you know, once a merchant's forced to go to ESA, the the ISO makes nothing. I mean, it's like you go from making a significant amount of income on a merchant to making absolutely zero under ESA. I mean, it is like a like you're you're making percentage points, like small percentage points on what you used to be making just because you eclipsed the threshold. And I didn't know if that was maybe in part because AMX was having blowback from it, or but I was unaware of any of this stuff. And then all of a sudden I did some research and found out, but you gotta you gotta like get into the granular. And I don't think anybody's really talking about it unless you're at a wholesale ISO level and you're a pretty high volume merchant. Like you have this actually was uh a car dealership, um, you know, kind of uh ISO where they were going out, not just car dealers, all dealerships, but you know, higher volume, you know, uh uh rooftops. So it was just kind of interesting to see that. I like and and and the extra basis points considering the addition to the threshold, like the new cap, they seemed really reasonable to me. I was wondering if the VAMP fines are similar. Yeah, I think Amex did that in response to VAMP and obviously just general pushback too, because you know the the ISO's acquirers they won't push Amex to their clients if they're not making money and they're making gateway fees on it versus you know tens or hundreds of basis points depending on the pricing. But I think that was partly what Amex did because they they just don't have a good system like Verifier Ethica. They haven't really built that yet. And the one that they I mean, they have one, but it's it's not good, it's not very effective. So that was part of the reason I think why they did it, just speculation. But for verifying Ethica, like the fees are not egregious by any means, especially when it starts from Visa. However, it comes downstream, right? And you have your bin sponsor who marks it up by a couple bucks, then you have your ISO who marks it up by a couple bucks, potentially an ISO on that ISO or a sub-ISO, and then an agent on top of that. So you got like, you know, anywhere from two to five hands in the cookie jar before it hits your bottom line. And I think as long as you know you're working with someone you like, usually costs you like an extra five, six bucks per chargeback, um, which is not terrible if you already are expecting that you're breaching ratios and you're decently high-risk business, you're kind of you're kind of already under the assumption that you're in that pay-to-play category. And so most people are okay with it, you know, adds a couple thousand bucks or whatever to their bottom line every month, and it's not the end of the world. Um, but again, there there are those good actors that just are not high-risk businesses, but for whatever reason their customers are just tough to work with, and that's just on them now. It's like, hey, you're either gonna pay to play with these Visa fines or MasterCard fines, or you need to increase your customer service and do other things that you can do to optimize. So it's kind of just teaching people a little bit more about like how to be better operators and be more transparent with their customers, especially in the subscription space. Um, but yeah, it it seems pretty reasonable overall. Like I haven't seen incredible blowback.

MasterCard Refund Rule Concerns

10:40

We are getting a lot of people that are freaking out about MasterCard scam um uh whatever you want to call it, protocol or new rules that they're pushing. I don't know if that's actually gonna shake out the way they want it to, but um that's a whole other conversation, I think. But what is uh okay. Um yeah, that might be too off topic, but totally like I was gonna I was gonna have you unpack that, but you know, well I can do a quick one on the back. Yeah, I can do a quick one. Like basically, I think one of the biggest things they're going after smaller businesses that are new, and what they're looking for is like refund rates in particular. So if the refund rate, I think it's a five percent threshold, is over that, then they'll flag you and put you into a program. And like imagine if you're an apparel business and you sell t-shirts, like a lot of people are refunding their t-shirts, and we're not talking about refunds from like a vamp ratio perspective, we're talking about just straight up refunds, and that's the metric they're looking at because with Ethica Alerts, you can programmatically refund an incoming chargeback, but they're not looking at that, they're just looking at like what's your total percentage of refunds, and I think that's crazy. Like for a new business that breaches five percent in refunds, that that is what you're you know, if they break it down by MCC or something, it makes way more sense. But uh what their blanket rules right now don't make any sense to me. And I think I don't know, enough of the people I know in the industry aren't freaking out about it. Well, look, man, they got a ton of blanket rules that don't make any sense. And and and and I'll just say, like, that's another podcast with Bryce and Peptides, and yeah, you know, I mean, yeah, I mean, they just won't let anybody process on their rails associated with with peptides, and it doesn't even matter if it's coming from a legitimate doctor, like it's there, there's a no size fits all uh kind of mentality with them. And and and I'll tell you, like, you go to the sponsor bank, a lot of these peptide merchants they get matched after they get approved. You go to the sponsor bank, and the sponsor bank's like, I don't know what to tell you. Like they didn't really give us any reason, they just told us to close the account and match the person. And it's like, you know, I mean, they they don't I don't know if I have that in writing anywhere, but uh essentially that's the story. And then, you know, depending on on again, another podcast, but Bryce has a whole thing with with some of these sponsor banks that have uh that have routinely underwritten peptide merchants that this has happened to, it's like, well, look, like you know, show me in the rules, or here, let's just what do you need from us to show the due diligence to give some sort of comfort that hey, we shouldn't be matched because we're following whatever, regardless of MasterCard's guidelines, right? Like, that's the thing, and it's uh you know, the inherent uh the inherent flaws in the architecture and operation of the system, but we won't get into all that necessarily in this subject matter today's topic merchant of records, merchant of records, yeah, totally. But this

Defining Merchant Of Record Vs PayFac

13:43

is also a very big misnomer because a lot of people like to throw out the word payfac. Like, oh, you can be a payfac or a payfact light, you know, and and that's all nonsense, in my opinion. Like a registered payment facilitator is somebody who steps into the shoes of a true merchant of record, right? That's to me a true merchant of record, is a registered payment facilitator who basically is authorized to aggregate, um, you know, obviously based on certain criteria, transactions from unlimited submerchants, right? And you don't really have a lot of visibility into you know who who's submitting, and it's sort of a a trust parameter with it. But you know, these days everybody's you know throwing around the payfack word and they say merchant of record. And the crazy part is the merchant of record to me is like whoever's been you know underwritten and authorized for the mid. But yes, um, and we've even tried to do some uh you know, we to me, because a troop of payment facilitator is in in and I don't necessarily know how it always works because it's not one size fits all, but a payment facilitator touches touches the money, yes, they possess it and then they redistribute it, and in essence, they act as a fiduciary slash escrow slash. I mean, a lot of times the business activity that they're performing would require a license under state law in many instances. So like so it's a that's a real thing. But today we people want to say, Oh, I'm a PayFAC, and well, how are you a PayFAC? Well, I've got this like uh digital interface that I can have an API and ultimately I'm taking the information from the user interface that you have and I'm plugging it through my system and I'm connected through an API to the upstream processor, not even to the card brands, and now I'm a PayFAC. Right. And I don't necessarily know if that's the case, but maybe they're a merchant of record. I have no idea. But what's your take on what the actual definition of merchant of record is? Yeah, so it's this it's this funny. So I actually came into payments learning about merchant of record. That was like my uh, you know, my uh training wheels, let's say, coming into payments. Like I learned about this weird definition that didn't exist in Visa's terminology, but was still like had vendors that kind of coined themselves as this merchant of record thing. Now, at the time, it was whatever, 10 plus years ago now. At the time, you basically have pay facts and then you have what are considered aggregators, right? Which is kind of a blend between a payfax and a bad actor of a merchant of record, I would say. And ultimately what it shakes down to it took me a really long time to figure this out because there's all these things you have to think about when you're setting this up, and like the network rules are just one piece to it. Like there's also liability of like indirect sales tax, for example. Who's responsible for that if you're the one, if you're the entity taking money off the shopper's card, Arizona or California, like they're gonna come after you, man. Like they're looking for the person who has the money. Um and so, but if you're a if you're a payfack, you don't have that responsibility. You're saying, nope, we're you know, licensed payment facilitator, like we're a regulated entity, we don't have this responsibility. So, really what it boils down to, and it took me a really long time to figure this out because you know, my previous company, that's what we were building, is like a merchant of record model. We were always chatting with all the big acquirers in the space, and you know, of course, the the schemes and the network people, and just trying to help solidify this thing. All it boils down to, dude, is you're just a big merchant. Like you're a merchant that resells a bunch of different types of shit. That's like the easiest way I can describe it to people. A payfack is much different because you take financial liability as you would as, you know, if you owned a bin as an ISO or anything like that. You take financial liability, you have a responsibility to do underwriting and due diligence on, you know, anyone you board as a submit or however your structure is. Um, and you still have to do all that stuff as a merchant of record. Like no acquirer will board you if you have terrible KYC and underwriting policies, like they're gonna require you to do it. You basically do all the same stuff from that perspective. But what it really boils down to is like um the easiest way is thinking about it is you're like a distributor, right? You're like a wholesaler of this product, whatever it is, whether it's t-shirts or you know, software or whatever you're selling, or whatever the ultimate merchant is selling, like that merchant now acts as a supplier to the merchant of record, and then the merchant of record is the one that has a relationship to the end customer. They're the one that says, Hey, you're entering your Visa credit card on this checkout right now. Like, it's our mids. It's going to hit our bank account. And yes, like we are working with this downstream party to fulfill whatever the product or service is that you're buying, but like we're acting as the middleman. So they're just straight up like a really big distributor. Um, or like it's like a drop shipping bottle, is another way to think about it, right? It's it's like the merchant of record may not own the inventory of t-shirts or whatever, but they're able to be an authorized reseller of those t-shirts in software. We see it all the time, like licensing. I can go to Best Buy right now and buy Microsoft XL or whatever they call it, Office Now or whatever, but I can buy that through Best Buy, even though it's a Microsoft product, but Microsoft gives Best Buy a license to resell that product. And so Best Buy is now like an authorized distributor of that. And that's really what a merchant of record is at the end of the day. But they're not typically registered as PayFACs, they're just large resellers of different products. And as long as they don't bleed those lines too much, then that's really what they're doing. And the primary benefit and the change, I would say, is like when you're a PayFAC, you again, it's a payment facilitator. It's really well defined in Visa's rules. Like everyone knows what a payment facilitator is. Oh, it's a service provider. Yeah, it's a service provider, totally. Like it's actually a defined role in the payment scheme. And that's what sucks is with merchant of record, like it the term doesn't exist, right? And like Visa's rules. There's there's a PayFAC, there's an acquirer, there's a marketplace, and there's a merchant. And like a merchant of record is a merchant. Now, yes, they're acting as like a third-party merchant of record, let's call it. So it kind of bleeds into the PayFAC realm. But at the end of the day, like they're by by network rules, like they're responsible for customer service. It's their name on the descriptor, like their front line for everything to the end shopper, which is what the networks care about. They're like, you're the one taking the money off the card. Make sure you're disclosing that to the shopper. Now, of course, there's always bad actors in space that don't do things properly, right? But you get that with anything. Um, but really that's like what it boils down to. And the difference is that they're not regulated as a payfack.

Money Movement MSB And Tax Liability

20:32

And that's, I think, what a lot of these merchants, I mean, there's tons of public. But they don't touch the money either. They don't touch the money either, right? I mean, like at the end of the day, they have contracts where whatever settled funds go to them, they owe money downstream to whoever the suppliers of the products are or maybe the services, but they're not actually getting in the way and redistributing money to somebody else that they've qualified to aggregate their transactions, right? Like there's a difference between aggregating a transaction and aggregating product for sale on your website, right? I mean, it uh I think that's what you're saying, or am I misreading it? In in some cases, they don't touch the money flow. That kind of comes down to now we get more into like money service business and money transmission regulatory realm, where it's like the networks don't really care about that as much as long as you're like playing by the rules. The acquirers certainly do, because if you're underwritten as a merchant of record, for example, at Addian, like you could use Adian or Stripe or, you know, pick one. You could use their payment rails to create FBO accounts for each of your submerchants or suppliers on the back end, and it'll all stay within Adian's realm as a money service business to move the cash from A to B, like what marketplaces do. You could use that same model where the marketplace technically doesn't own the money in their, you know. retailer commercial bank accounts. It's still living in a third party and like they can control the reserves and all that stuff, like a PayFAC would, but they're not regulated as an actual MSB in all 50 states and whatever jurisdictions that they're moving money in. So that's one option where you still lean on you know some sort of other regulated entity to move the cash. There are some though that do actually get the cash directly to them and then redistribute that money to the end supplier. And when they do that you have to be licensed right like you cannot take money on behalf of another service and then move it over like you there's MSB laws. There's exceptions. But most of the time yeah I get it. Yeah the pay RPA exception kind of encapsulates some of that stuff but um you know where you get outside the money transmission laws. But yeah it's yeah for the most part and it's also like Georgia is a strict state about it. State by state yeah well I was gonna say like you know for for all of our viewers Matt's in Texas that's the beautiful Austin uh nature line behind him like if anybody wants to go down there it's a nice place it's hot now but yeah um but you know Texas has this platform fee law. Like I don't know if you've ever seen that and I would wonder where the intersection between merchant of record and platform comes in because you know depending on the state you were just talking about sales tax and it kind of triggered my thought process of like yeah who's responsible for sales tax like there is a there's a US Supreme Court case out of Ida or uh South Dakota that happened maybe like 10 years ago. Yep. And it was all about e-commerce and like if I'm a New York company and I'm selling to a South Dakota resident who's responsible for the sales tax associated what sales tax is applied does that sales tax have to be can I assess that to a foreign company because they're selling to a South Dakota resident like yeah and the Supreme Court core came back and said no wherever the buyer resides then sales tax attaches. Yep and so I've seen with certain businesses like you know we did some spot work for a guy that we knew here in California that's in the debt settlement debt consolidation uh realm and and and that has state regulations from state to state not not everywhere but in some states far more egregious than others like as far as like the the scope of the oversight but uh but the fact is is that when I was doing that and I was talking to his accountant you know we got into talking about certain state laws and he was the one that told me that Texas had a like if you operate a platform and you have a subscription for the platform then you've got to pay per user on the platform of like whatever Texas residents are using. And I could see what you just described as merchant of record at least in that kind of context maybe like bleeding into these random state laws that you're not even aware of. That's exactly what it does. And that's like when when there's a lot of ambiguity like kind of the the defense I always had because I was I was one of the leaders in in our previous or in my previous company Reach where you know we were trying to position and posture ourselves because you kind of have like indirect tax legislators in all the states with all their crazy rules. Then you have like AML compliance which is more federal level and global as well with FinCEN and whatnot. And then you obviously have scheme compliance so you have to posture between these three compliant uh compliance bodies two of which are actual governments the other one's just the private company making rules but you still got to play by them and so you know finding that right posturing across all three is critical. So the key difference when we're like tying it from the network posturing of like a merchant of record is just straight up a merchant right they're like a dropshipper a wholesaler whatever you want to call it but they're categorized as a merchant per scheme compliance when you bring that over to compliance for um the indirect tax side like that merchant of record they're responsible for all that shit. If there's a platform fee in Texas and you're not paying it like guess what? You get audited by Texas boom they're coming

Closing Disclaimer And Where To Find Us

25:57

for you. Thank you for listening to this episode of the Payments Experts Podcast a podcast of Global Legal Law Firm. Visit us online today at Global Legalaw.com Matters discussed are all opinions and do not constitute legal advice all events or likeness to real people and events is a coincidence.