Legal and Regulatory Frameworks for Operating a PFAC in the United States
Legal and Regulatory Frameworks for Operating a PFAC in the United States
You will meet these documents mid-launch. Better to meet them now.
A payment facilitator (PFAC) lets your platform onboard and pay its own merchants without sending each one through bank underwriting. The trade-off is a stack of agreements and regulatory obligations that most operators discover one at a time — usually when a sponsor bank asks for something they don't have. This guide puts all of it in one place: what you must sign, what you must comply with, and how the two connect.
What this report answers
• A master checklist — every document and requirement, by area, with who requires it and when it is due, from entity formation through first merchant
• Entity formation — Delaware C-corp vs. LLC, how a foreign parent fits, what changed in FinCEN beneficial-ownership reporting (final rule, August 2026), and what your sponsor bank will check regardless
• The sponsor bank relationship — the five agreements that make up a PFAC program, who signs each, what card network rules require in your sub-merchant agreement, and which obligations are law versus negotiated terms
• Money transmitter status (core chapter) — three funds-flow designs found in public agreements, the recognized exemption pathways (federal payment-processor exclusion, state agent-of-the-payee, bank-delegation, licensed partner), what each requires, and where it must be documented
• OFAC and AML — what the sponsor bank owns, what you run day to day, and the policies each side keeps
• Data security and privacy — PCI DSS levels by volume, the FTC Safeguards Rule and its 30-day breach reporting, and state breach-notification law
• Appendix A: real agreements, annotated — public bank-to-processor, ISO sponsorship, PFAC program and sub-merchant terms (including ProPay, Vantiv/Fifth Third and Stripe), with short excerpts, plain-English notes, and a list of questions to put to your own sponsor bank and counsel
Three things to take away
• Licensing is earned, not assumed. Whether you need state licenses turns on your funds flow and your contracts — not on the label "PFAC" or on having a sponsor bank.
• The bank holds more control than most operators expect. In the public agreements reviewed, underwriting criteria, merchant terms, reserves and exit rights were largely the bank's to set.
• Obligations start on day one. PCI scales with volume, but GLBA and state breach-notification duties apply from the first customer.
Who this is for
• Fintech and SaaS founders weighing a U.S. PFAC program
• Product and compliance leads preparing for sponsor bank diligence
• Parent-company and investor teams, including non-U.S. parents, assessing a U.S. payments subsidiary
What this is not
• Not legal advice or a form library. It identifies the frameworks that apply; it does not give a licensing conclusion for any program.
• Not a reproduction of card network rules. They are licensed material, so they are cited by section.
• Not a 50-state survey. State law is explained by structure, with Texas and Michigan as worked examples. Law and public documents as of October 2026.
Report details
Format: PDF
Length: 42 pages
Author: J. Michael Bradley, Co-founder & Chief Advisor
Sources: 32 numbered citations to statutes, regulations, card network rules and public filings
Language: English
