If your merchant ID has been withdrawn, or your provider has started asking questions about your business model, this is almost certainly the reason. It is not a dispute you can win, and it is not fixed by changing provider.
The structure under review is almost always the same: a single merchant account through which funds are collected and then paid out to a group of sellers, on the basis that the account holder is the merchant of record and the sellers are its suppliers.
Card scheme rules apply a different test to the one contract law applies. The entity holding the merchant agreement must be the party actually selling to the cardholder, unless it is registered as a payment facilitator or a marketplace. From an acquirer's standpoint the arrangement is payment aggregation, and both major schemes have been tightening enforcement, with penalties passed down to acquirers directly.
This is the part worth internalising: it is a change of the last few years rather than a long-standing position. Visa introduced a substantially stricter integrity programme in 2021 and Mastercard tightened its registration rules around the same period, and both now fine acquirers for unregistered aggregation sitting in their portfolios.
The structure has not changed. The enforcement has. That is why an arrangement which operated for years without challenge can suddenly fail a due diligence review, and why the decision is usually not recoverable through discussion.
The instinct after a withdrawal is to find another acquirer. It ends the same way, frequently faster, because the newer providers run automated risk systems that identify aggregation patterns early.
Standard terms across mainstream providers prohibit processing on behalf of third parties. Their answer is a platform product, and every major provider has one. This is not a provider problem. It is a structure problem, dictated by the schemes rather than by any individual acquirer, which is precisely why changing acquirer cannot resolve it.
When a provider responds to a withdrawal by offering you their platform product, that offer is a structural verdict politely worded. They are telling you that you are not a merchant of record, you are operating as a payment facilitator, and you should use the product built for that.
Yes, and it is the wrong question. Scheme rules are private contract terms enforced through acquirers. Breaching them is not unlawful. It means no acquirer can knowingly process for you, which is functionally indistinguishable from prohibition.
Most businesses in this position have genuine merchant-of-record characteristics. They may hold the stock and fulfil the orders, which is real substance and worth arguing.
The two factors acquirers weight most heavily usually point the other way. The sellers set their own prices, and a true reseller sets the retail price and owns the margin. And the cardholder believes they are buying from the seller's branded shop rather than from the platform. Scheme rules anchor on cardholder perception and on pricing control, not on logistics.
The closest analogy is large-marketplace fulfilment. The marketplace warehouses and ships the goods, but because the third-party seller sets the price and owns the listing, the seller is the merchant, and the marketplace still had to register as a marketplace to collect on their behalf. Centralised fulfilment is an operations choice. Merchant of record is a pricing and liability posture.
| Genuine merchant of record | You set retail prices, your name is on the cardholder statement, you own refunds, chargebacks and consumer liability. Sellers move to a wholesale or commission arrangement. Inverts the client proposition entirely. Months. If the category is regulated, you also take on the licensing in your own name. |
| Registered payment facilitator | Aggregation becomes explicitly permitted once each seller is individually underwritten as a sub-merchant. In practice this is the provider platform product: sellers complete their own verification, hold their own account, and settle directly. Your fee is carved out at transaction time. Weeks to months. Commercially almost nothing changes. Acceptance per seller is not guaranteed. |
| Your own authorisation | You become the regulated entity and handle the funds flow yourself, with separate scheme registration through an acquirer and, ultimately, PCI DSS Level 1. Indicatively 125k minimum capital for the tier covering acquiring, around 5k application fee, up to 80k in legal and consultancy, 6 to 12 months. Then annual fees, a dedicated compliance function and safeguarding with annual audits. |
The third route is what the platform providers have already done at scale. Their platform products let you rent it rather than build it, which is the honest way to think about the trade.
You hold the master platform agreement. Each seller is onboarded as a sub-merchant, completes verification directly with the provider, holds their own merchant account, and receives settlement directly. You never touch their funds. Your platform fee is carved out natively, and the provider's systems handle routing, per-seller fee levels, refunds and onboarding.
Two things to be clear-eyed about.
Each seller is individually underwritten and acceptance is not guaranteed. That individual underwriting is exactly the control the schemes want, and precisely what the previous structure was bypassing from the provider's perspective.
If your category is high-risk, onboarding will not be the instant automated flow a generic marketplace enjoys. Categories such as pharmaceuticals carry mandatory registration, licence verification and per-merchant fees imposed on the acquirer. Expect enhanced due diligence, slower and sometimes manual approval, and some sellers declined or accepted at higher pricing. It is also likely to have contributed to the original decision, since aggregation of a high-risk category is the combination acquirers are penalised for most heavily.
Worth saying plainly, because it is usually underestimated. A platform product shares a provider's name and essentially nothing else: separate business unit, separate contract, separate API, fundamentally different model. Nothing from the existing integration carries over, including stored card tokens that any subscription billing depends on.
So the integration effort and the card data migration question are broadly the same whichever provider you choose. Which means the decision should be made on structure, terms and underwriting appetite rather than on which migration looks cheaper, because they are all the same migration.
Continuing unchanged. Under the current enforcement regime no mainstream acquirer will support it indefinitely, and the failure modes include funds being frozen and directors being placed on scheme blacklists.
None of the options is trivial. The fourth is the only one that gets worse by waiting.
If you need formal confirmation before committing capital or engineering time, the right purchase is a payments regulatory specialist. For a memo covering the above, expect roughly 10k to 20k and two to three weeks. That puts professional indemnity behind the conclusions, which experience alone does not carry.
What we do is the layer underneath that: establishing where your structure actually sits, what each route would cost you specifically, and building the migration once the decision is made.
We audit payment structures against scheme rules, cost the routes out, and build the migration. If you have had a withdrawal or a difficult question from your provider, a short conversation will tell you which of the three routes applies.