Merchant of Record Is Not a Model

In our work with clients across the industry and around the globe, we are persistently asked if we can help a company “become a Merchant of Record” in one jurisdiction or another. Fair enough—it’s a hot term. There’s just one problem: the card networks have never heard of it.

Visa and Mastercard recognize a specific set of roles in the merchant processing ecosystem: acquirer, issuer, merchant, cardholder, Independent Sales Organization, Payment Facilitator, aggregator, and several others. However, “Merchant of Record” isn’t on that list, because MoR was never a payment processing designation—it’s a commercial concept describing who is actually the seller in a transaction. The name on the statement. The party in the contract of sale. The entity holding the liability when a cardholder disputes a charge.

When that’s genuinely true, MoR is a real and legitimate role. Apple is the Merchant of Record when it sells you an app, not the developer. Nobody’s confused about who the seller is.

But that’s not what most companies mean when they pitch “MoR-as-a-service” to a platform with hundreds of underlying businesses. In practice, they’re running those businesses’ transactions through their own merchant account, while the underlying businesses keep their branding, their customer relationships, and often real exposure of their own. Strip away the label, and what’s actually happening is payment aggregation—which the card networks require to be registered, sponsored, and monitored as a Payment Facilitator. “MoR” has quietly become a term to describe that activity—but in our experience, it doesn’t necessarily mean a specific entity has gone through the due diligence process and registration that governs it.

This isn’t a hypothetical risk. In 2025, the U.S. Federal Trade Commission (FTC) settled with Paddle.com ($5M according to some accounts) over exactly this pattern—using an MoR model without the network-mandated oversight a registered Payment Facilitator is required to carry, which the agency tied directly to elevated fraud and money-laundering exposure. That’s not a legal technicality or a misunderstanding of terminology.

Ultimately, the FTC held Paddle directly liable under ROSCA (Restore Online Shoppers’ Confidence Act) and the TSR (Telemarketing Sales Rule) for the deceptive subscription practices and tech-support scams run by vendors using Paddle’s platform (specifically schemes like Restoro/Reimage). The FTC’s stance was clear: If your name is on the credit card statement, you are the primary actor, not a neutral software pipe.

And even if you’re a registered Payment Facilitator somewhere other than the U.S., it doesn’t provide carte blanche to acquire for U.S. merchants—or merchants of any other jurisdiction other than where the Payment Facilitator is registered and licensed to operate. A few things to keep in mind:

Local Sponsorship Required: A Payment Facilitator must be sponsored by an acquiring bank licensed specifically in the region where the merchant operates. A European or Hong Kong acquiring bank cannot process U.S. domestic transactions for a U.S.-domiciled sub-merchant.

Cross-Border Limitations: If a U.S. merchant is onboarded under an EU or Hong Kong PayFac entity without local U.S. acquiring sponsorship, it violates card network cross-border rules. Card schemes routinely flag and fine entities that route U.S. domestic transactions through foreign acquiring Bank Identification Numbers (BINs) to avoid local regulations.

Transaction Laundering / Offshore Transaction Aggregation: Funneling U.S. domestic sub-merchant volume through offshore acquiring MIDs or BINs without a U.S. sponsor or proper local disclosures will lead to card scheme fines, program termination, and frozen settlement accounts by card networks.

So when someone tells us they want to “become an MoR,” here’s the real question: You’re asking whether you can become a Payment Facilitator. Those are different questions with very different requirements—sponsorship, underwriting, PCI compliance at scale, capital to cover sub-merchant losses, and ongoing monitoring obligations that don’t go away because you called it something else.

Call it what it is, register for what it actually requires, and build accordingly. The label doesn’t change the liability. The card networks were never asked, and they were never going to say yes to a role they don’t recognize.