What is Merchant Risk?

how does the money actually move?

Merchant risk starts with the legal path of the transaction: the buyer pays a seller, the seller’s processor settles funds, and the card networks monitor whether fraud and disputes stay inside programme limits. In a standard merchant-account setup, your entity is the merchant, your MID, meaning merchant identification number, is underwritten to your product and billing model, and your acquirer is accountable to Visa and Mastercard for what you run through it.

A Merchant of Record, or MoR, changes the front-facing seller. Paddle defines the MoR as "a legal entity responsible for selling goods or services to an end customer," and its terms say Paddle handles sales tax collection, reporting and remittance. FastSpring describes the same reseller structure for digital goods. ClickBank goes further for direct response: it says "ClickBank is the retailer of products on this site," which is why physical supplement offers can run there when the offer passes ClickBank’s own review.

That structure doesn't make the sale risk-free.

We counted three separate exposures that matter more than the label: who is the legal seller, who is named on the card statement, and who ultimately eats refunds or chargebacks. Paddle’s terms move card-network seller liability to Paddle, but clause 10.4 says the vendor reimburses the full refund or chargeback plus fees. If your current question is whether you are a high risk merchant or do you process payments, the answer is usually both: the network sees a merchant category, while the processor sees an offer, a funnel and a refund pattern.

what does the fee stack look like end to end?

The fee stack is the visible transaction fee plus the hidden cost of underwriting, reserves, disputes, retries, failed rebills, delayed payouts and remediation work. The cheapest posted rate is rarely the cheapest structure once the offer has a 60-day refund window, recurring billing, international cards, affiliate traffic or a VSL, meaning video sales letter, that pushes aggressive claims.

For MoR platforms, the public numbers split hard. Paddle publishes 5% + 50¢ per checkout transaction on its pay-as-you-go tier, per Paddle’s pricing page. Polar publishes 5% + 50¢ on Starter, down to 3.4% + 30¢ on Scale, plus international-card and dispute costs. ClickBank states that it takes "a 7.5% + $1 transaction fee from the total purchase price," before vendor and affiliate splits. Digistore24’s calculator states $1 + 7.9% of the pre-tax gross amount on US sales.

High-risk acquiring looks cheaper until you attach the risk controls. PaymentCloud’s guidance cites average high-risk processing at 3.49%–3.95% per transaction plus item fees, monthly fees, added gateway or PCI costs, chargeback fees around $20, and rolling reserves of 5%–10%, with 15%+ for higher-risk merchants. Those figures are not PaymentCloud’s own published rates; it directs merchants to a custom review. For e commerce high risk merchant services, the signed reserve schedule matters as much as the discount rate.

what gets an account shut down?

Accounts get shut down when the processor sees unmanaged fraud, disputes, prohibited products, undisclosed routing, misleading negative-option billing or a mismatch between what was underwritten and what is actually being sold. The shutdown risk is not moral theatre; it is portfolio math. Once your MID damages an acquirer’s ratios, the acquirer has a direct incentive to terminate you before Visa or Mastercard escalates.

Visa’s VAMP, Visa Acquirer Monitoring Program, took effect on 1 April 2025 and replaced several older fraud and dispute programmes with one card-not-present ratio. Visa’s fact sheet defines the ratio as fraud reports plus disputes divided by settled transactions, and says it "excludes disputes resolved through pre-dispute solutions." As of 1 April 2026, the excessive merchant threshold in the US, Canada, EU and AP regions is 1.50%, with a monthly count floor of 1,500 fraud plus dispute items, per Visa’s VAMP fact sheet.

Mastercard uses different machinery. Its ECM, Excessive Chargeback Merchant programme, starts at 100-299 Mastercard chargebacks in a month and a 1.50%-2.99% chargeback ratio; HECM starts at 300 or more chargebacks and 3.00% or higher, per Braintree’s Mastercard programme summary. MATCH, Mastercard’s terminated-merchant database, is worse than a bad month: Stripe documents that excessive chargeback and excessive fraud listings generally cannot be removed by remediation and stay for five years.

The account-killer most buyers underprice is not chargebacks. It is undisclosed processing: routing one entity’s sales through another entity’s MID, or moving a new product through a merchant account underwritten for something else. Multiple MIDs can be legitimate when the acquirer knows the structure. Hidden aggregation is transaction laundering, and Venable’s payments analysis ties it to network fines, bans and possible wire-fraud, bank-fraud or money-laundering exposure.

who carries the liability?

Liability follows the contract first, then the card-network rules, then the economics of who must repay the loss. A Merchant of Record can be the legal seller to the buyer while still passing economic chargeback cost back to the vendor. A payment facilitator, high-risk ISO or gateway can help route transactions, but it doesn't make prohibited claims, unclear billing or refund defects disappear.

Paddle is the cleanest example because its terms say both sides out loud. It says the vendor appoints Paddle as reseller across all territories, and that Paddle may set the sale price as MoR. But clause 10.4 says that if Paddle prevents a chargeback or refunds a buyer, the vendor owes the full refund or chargeback and related fees. We checked the liability path, not just the checkout badge, because that is where operators misread MoR marketing.

For card-not-present fraud, 3-D Secure, meaning issuer authentication during checkout, can shift liability on authenticated first transactions, but Stripe says off-session merchant-initiated transactions do not support 3DS. That means rebills in continuity offers still leave fraud chargeback exposure with the merchant. If your stack depends on rebills, high risk merchant payment gateway selection should be judged by descriptor control, retry rules, alerts and pre-dispute tooling, not just approval rate.

The liability question is practical: who can debit the reserve, hold settlement, refund buyers, terminate the MID, report MATCH or require remediation? BuyGoods’ 60-day refund window for products sold through its sites is a commercial term a supplement owner inherits. ClickBank’s retailer model centralizes the seller relationship. A direct high-risk merchant account leaves you closer to the acquirer, with more control and fewer buffers.

what changes by country?

Country changes merchant risk through card-network region thresholds, local subscription law, acquiring location, issuer behaviour, currency handling and product restrictions. The offer may be the same $47 bottle, but the risk file is not the same if the buyer is in California, New York, Colorado, the EU or a cross-border market where the acquirer is outside the issuing country.

California’s amended Automatic Renewal Law took effect on 1 July 2025 and requires online cancellation through a prominently displayed direct link or click-to-cancel button. New York’s amended law took effect on 5 November 2025 and adds renewal and price-increase notice rules for longer subscriptions. Colorado’s SB25-145, effective 16 February 2026, extends auto-renewal protections to business-to-business subscriptions and requires a one-step cancellation link that stays visible even while a retention offer is shown.

Federal US law still matters after the FTC’s 2024 Click-to-Cancel Rule was vacated. ROSCA, 15 U.S.C. 8403, still requires clear material terms before billing information, express informed consent before charging, and simple mechanisms to stop recurring charges. We could not verify PayPal’s current nutraceutical wording because the legal hub page was blocked or truncated at check time; a fresh load of PayPal’s Acceptable Use Policy would settle the exact language.

Cross-border processing adds another layer. Visa’s public tokenization data says tokenised card-not-present transactions delivered a "4.6 percent lift in authorization rates globally, compared to PAN," and a 30% online fraud reduction versus PAN in the cited period. Published local-acquiring approval gaps range around 2-16 percentage points across markets, but the fact pack does not support one universal number, so a country-by-country processor quote needs checking before you build a forecast.

what does onboarding actually ask for?

Onboarding asks whether the processor can understand the seller, the product, the claims, the fulfilment path, the refund policy, the traffic source, the billing cadence and the expected risk ratios before money starts moving. For a clean SaaS checkout, that review can be light. For nutraceuticals, peptides, trials, autoship or affiliate traffic, underwriting becomes a product-and-compliance review, not just a bank-form exercise.

Expect questions about beneficial owners, tax IDs, prior processing history, chargeback history, supplier documentation, labels, fulfilment, customer support, refund terms, descriptor wording, affiliate controls, call-centre scripts, VSL claims and continuity disclosures. A MID, meaning merchant identification number, is not a generic pipe. It is underwritten to a merchant, MCC, product, geography and billing pattern. Changing any of those after approval can turn an ordinary account review into a termination event.

Visa’s Merchant Data Standards Manual gives 25 spaces for the merchant name in authorization and clearing and requires long names to be abbreviated rather than merely cut off. That sounds small until a cardholder sees an unrecognizable descriptor and files 10.4 fraud or 13.2 cancelled recurring transaction. For peptide-adjacent offers, the underwriting packet for a high risk merchant account for peptides has to prove the bank is not accidentally onboarding a prohibited or misrepresented health product.

Processors also ask for operating evidence because network monitoring looks backward. Recurly’s subscription payments report, using 2022 data from 2,200+ merchants and 50+ million active monthly subscribers, found 6.0% decline rates on credit cards and 13.0% on debit cards. If your approval plan assumes retries alone will fix failed rebills, Visa’s 15-in-30-days retry cap and Mastercard’s excessive-authorization fees make that a cost centre, not a recovery strategy.

when is this the wrong structure?

A Merchant of Record is the wrong structure when the platform prohibits your product, when you need direct control over underwriting, when the MoR’s reserve and payout risk is larger than its tax or compliance benefit, or when your offer cannot survive the seller’s acceptable-use review. Physical nutraceuticals are the cleanest example: Paddle and Polar prohibit physical products, and FastSpring markets itself around digital categories.

MoR is also the wrong answer when the real problem is the offer. If the VSL makes claims the seller cannot substantiate, if cancellation is hard to find, if the post-trial descriptor is unclear, or if support cannot process refunds quickly, moving to ClickBank, BuyGoods or another retailer-of-record only changes who catches the first complaint. It doesn't change the buyer experience that creates the complaint.

Direct high-risk acquiring is the wrong structure when you want someone else to own the consumer relationship, tax handling and global checkout rules. Conversely, MoR is the wrong structure when counterparty risk matters more than convenience. Digital River’s Chapter 7 filing on 1 May 2025, with reported unpaid merchant balances and less than $50,000 in assets against about $45.2 million in secured debt, is the hard lesson: settlement funds held inside an intermediary are still credit exposure.

The practical answer is to pick the structure that matches the failure mode you can actually control. If your biggest problem is sales-tax complexity on digital goods, an MoR can be rational. If your biggest problem is chargeback ratio, unclear rebill consent, affiliate compliance or card-network monitoring, you need risk controls before you need a different checkout label. For Visa-specific exposure, the Visa high brand risk merchant registration program question belongs in the same review as reserves and dispute monitoring.

Quick decision checklist

Use this page as a decision aid, not a generic blog post. The practical question is whether the reader needs faster evidence about what is already working in VSL-driven direct response, especially across nutra, supplements, GLP-1, weight loss, blood sugar, and adjacent high-intent health markets.

Daily Intel Service is most relevant when the next decision depends on active market examples: which hook to test, which claim style is risky, which funnel structure is common, which language market is moving, and whether a competitor's creative is likely early, scaling, or already saturated.

• Start with the TL;DR if you need the direct answer.
• Use the table to compare trade-offs quickly.
• Use the FAQ for answer-engine-ready summaries.
• Use the CTA when the decision requires live VSL and ad examples instead of theory.

Daily Intel's coverage advantage

Daily Intel Service is positioned around category-leading variety and actionability: one of the broadest direct-response catalogs of VSLs and ad creatives across blackhat, greyhat, and whitehat advertising patterns, with enough context to understand what the advertiser is doing beyond the visible creative. The practical difference is that members are not just seeing a screenshot; they are seeing the VSL, the ad, the funnel path, the transcript, the UTM context, and the research notes that turn the asset into a decision.

This matters because direct-response affiliates do not operate in one clean category. A weight-loss campaign may use a whitehat compliance ad, a greyhat pre-lander, a more aggressive VSL, and a checkout path designed around upsells and recovery. A useful intelligence platform needs to capture that spectrum instead of pretending every winning campaign looks like a public brand ad.

Blackhat, whitehat, and multilingual signal coverage

Daily Intel tracks patterns across both blackhat-style and whitehat-style campaigns so operators can understand the market without blindly copying risk. Whitehat examples help with durability and compliance review; blackhat and greyhat examples reveal pressure points, hooks, mechanisms, and funnel structures that may be driving spend but require careful adaptation before use.

The catalog is also built for global operators, with VSL and ad references spanning 14+ languages and different local idioms. That is a key advantage for Brazilian, LATAM, European, MENA, Indian, and non-native English affiliates who need to see how the same market desire is translated across cultures instead of only studying US English ads.

How to use the intelligence responsibly

The goal is modeling, not copying. Use Daily Intel to understand structure: hook, mechanism, proof, claim intensity, funnel depth, offer economics, and saturation stage. Then build original creative, review claims, and adapt the angle to the traffic source, country, language, and compliance requirements of the campaign.

A strong workflow compares multiple examples before acting. If the same mechanism appears across several languages, several advertisers, and several funnel variants, it may be a durable market signal. If the example appears only once or depends on an aggressive claim, treat it as a research clue rather than a campaign template.

• Model structure, not protected creative assets.
• Separate whitehat durability from blackhat persuasion pressure.
• Compare US English examples against LATAM, European, and other language variants.
• Use transcripts and funnel notes to build original briefs.
• Keep compliance review separate from market research.

Methodology and source context

Daily Intel pages are written from a research workflow that reviews active VSLs, Meta ad creatives, transcripts, UTMs, funnel paths, checkout steps, upsells, recovery sequences, and compliance-sensitive claim patterns. The goal is to explain observable market behavior, not to provide legal, medical, or platform policy advice.

When the topic touches health claims, platform policy, or GLP-1 market research, validate the observable campaign signals against primary references such as Meta advertising standards, FTC health claims guidance, and Google helpful content guidance. Daily Intel adds the proprietary direct-response layer by mapping how those rules show up in active VSLs, Meta creatives, funnels, transcripts, UTMs, and checkout paths.

For deeper evaluation, continue through Daily Intel compliance and legal disclaimer, Testimonial Disclaimers in Supplement Ads: What's Required, Are Antidetect Browsers Legal for Ad Research? 2026, Is Copying a Competitor's Landing Page Legal? The Line, Black Hat Affiliate Methods: A Field Guide to What Is Actually Running, and What is a VSL?. These related Daily Intel pages connect this topic to the relevant methodology, pricing, trust context, comparison path, or niche workflow.