What You Actually Need Before You Start

Starting a credit card processing company requires a merchant account with a bank or processor, a way to connect to payment networks (Visa, Mastercard, Discover, American Express), and the legal structure to handle other people's money. You cannot simply decide to process cards — you must be registered with the card networks themselves, which means passing underwriting, proving you have the capital to cover chargebacks, and maintaining compliance with their operating rules. Most new processors do not build their own infrastructure; they partner with an existing processor or acquiring bank and resell those services under their own brand.

The barrier is not technical complexity — it is regulatory and financial. You are handling customer funds, storing card data, and touching transactions that move between banks. Every step is audited. The card networks (through their rules, called the Payment Card Industry Data Security Standard, or PCI DSS) set the floor for how you must operate. Your bank or processor partner sets additional requirements. Regulators in your state may add more. If you skip any of these, you lose your ability to process, and your customers' transactions fail.

Key Takeaways

  • You must partner with an acquiring bank or existing processor to access the card networks — you cannot connect directly without years of compliance history and millions in capital reserves.
  • PCI DSS compliance is mandatory, not optional, and covers how you store data, who can access systems, how you handle breaches, and what you must audit annually.
  • You need a merchant account in your own name, proof of business registration, personal and business credit checks, and typically $25,000 to $100,000 in liquid capital to cover chargebacks and reserves.
  • State money transmitter licensing is required in most states and involves background checks, net worth requirements, and ongoing reporting to your state's financial regulator.
  • Your processor partner will require you to maintain errors-and-omissions insurance, undergo annual audits, and comply with their underwriting rules for every merchant you onboard.

The Partnership Model: How Most Processors Actually Work

Almost every credit card processor that is not a major bank (Stripe, Square, PayPal, Chase) operates as a reseller or ISO (Independent Sales Organization) under an acquiring bank. You do not build the payment rails yourself. Instead, you sign an agreement with a bank or processor that already has direct access to Visa, Mastercard, and the other networks. You then sign up merchants, collect their transaction data, and pass it to your partner. Your partner processes the transaction, holds the funds, and pays you a commission.

This model exists because the card networks require any entity touching transactions to meet strict capital and compliance standards. A new company cannot meet those standards alone. By partnering with an established processor, you inherit their compliance infrastructure — their PCI DSS certification, their fraud monitoring, their chargeback handling — but you remain responsible for your own merchants and your own underwriting decisions.

The alternative is to become a payment facilitator (PayFac), which means you take on more of the compliance burden yourself but gain more control over pricing and merchant experience. PayFacs still partner with an acquiring bank for settlement, but they handle merchant onboarding, underwriting, and dispute resolution directly. This requires more capital, more staff, and more regulatory oversight. Most startups begin as ISOs and graduate to PayFac status only after they have proven their compliance track record.

State Money Transmitter Licensing

Most states require anyone who moves money on behalf of others to hold a money transmitter license. Credit card processors fall into this category because you are accepting funds from customers and moving them to merchants. The requirements vary by state, but they typically include a net worth requirement (often $250,000 to $500,000), a background check on all owners, proof of a physical office address, and an annual audit by a certified accountant.

Some states have streamlined the process; others require you to post a surety bond (typically 5 to 10 percent of your projected annual transaction volume, up to a cap). A few states exempt payment processors if they partner with a licensed bank, but you cannot assume this — you must check your state's financial regulator website and confirm the rules for your specific business model. The application process takes two to four months on average, and you cannot legally process transactions until your license is approved.

If you operate in multiple states, you must hold a license in each one (or meet that state's exemption criteria). This is a real cost: licensing fees range from $500 to $5,000 per state, and some states require you to renew annually. Keep a spreadsheet of every state where you have merchants and track renewal dates.

PCI DSS Compliance and Data Security

The Payment Card Industry Data Security Standard is a set of rules written by Visa, Mastercard, Discover, and American Express that governs how you handle card data. If you store, process, or transmit card information in any form, you must comply. The standard covers 12 major requirements: firewalls, encryption, access controls, regular security testing, incident response procedures, and annual audits by a may have access to assessor.

Compliance is not a one-time checkbox. You must maintain it continuously. Your systems must be scanned for vulnerabilities quarterly. Your staff must receive security training annually. You must have a written incident response plan and test it. If a merchant's data is breached through your systems, you are liable for the costs — notification letters, credit monitoring, fines from the card networks, and potential lawsuits. This is why processors require errors-and-omissions insurance; the premiums alone can run $5,000 to $25,000 per year depending on your transaction volume.

Most new processors do not build their own PCI-compliant infrastructure. Instead, they use a hosted payment page or payment gateway provided by their processor partner. This means the card data never touches your servers — it goes directly from the merchant's customer to the processor's encrypted system. You handle the merchant relationship and the business logic, but your partner handles the sensitive data. This is the fastest and safest way to start.

Capital Requirements and Chargeback Reserves

You must have liquid capital available to cover chargebacks and operational costs. A chargeback occurs when a customer disputes a transaction with their bank and the bank reverses the payment. The merchant loses the money, and the processor (you, in this case) is responsible for investigating and either defending the transaction or absorbing the loss. If you do not have reserves, a spike in chargebacks can bankrupt you.

Most acquiring banks require you to maintain a reserve equal to 1 to 3 percent of your monthly transaction volume, held in a dedicated account. If your merchants process $1 million per month, you may need $10,000 to $30,000 in reserve. This money is not yours to spend — it sits in escrow and is released only after a set period (usually 6 to 12 months) if chargebacks remain low. On top of this, you need working capital to cover payroll, office space, compliance audits, and insurance.

Most startups need $50,000 to $150,000 in total capital to launch. Some of this comes from your own savings; some may come from investors or a business line of credit. Your processor partner will ask to see proof of this capital during underwriting. They want to know you can survive a bad month and still pay them.

Choosing and Partnering With an Acquiring Bank or Processor

Your first step is to identify which bank or processor you want to partner with. Major options include First Data (now Fiserv), Global Payments, Worldpay, Elavon, and regional banks that offer processor partnerships. Each has different underwriting standards, commission structures, and support levels. Some are easier to work with as a startup; others require you to have an existing merchant base before they will sign you.

When you approach a potential partner, have these documents ready: your business plan (showing how you will acquire merchants and what you will charge them), your personal and business tax returns (usually three years), proof of business registration (articles of incorporation or an LLC operating agreement), and a description of your compliance infrastructure (or a commitment to use their hosted payment page). The partner will run a background check and a credit check on all owners. They will ask detailed questions about your underwriting process — how you will vet merchants, how you will monitor for fraud, and what you will do if a merchant starts processing high-risk transactions.

Expect the underwriting process to take four to eight weeks. During this time, you cannot legally process transactions. Use this period to build your merchant acquisition strategy, set up your back-office systems, and draft your merchant agreements.

Merchant Agreements and Underwriting

Once you are approved by your processor partner, you can begin signing up merchants. Every merchant must sign an agreement that outlines the fees you will charge, the terms of service, and the compliance requirements they must meet. Your processor partner will provide a template, but you can customize it. The agreement must include language about PCI DSS compliance, chargeback liability, and your right to terminate the merchant if they violate the rules.

You must also conduct underwriting on every merchant. This means verifying their business registration, checking their credit, reviewing their business model, and assessing the risk they pose. High-risk merchants (those in gambling, adult services, pharmaceuticals, or other regulated industries) require additional scrutiny and may be rejected outright. Your processor partner may have a list of prohibited industries; you must follow it.

Document everything. Keep copies of the signed agreement, the underwriting checklist, and any communications with the merchant. If a chargeback dispute arises, you will need to prove that you conducted proper due diligence. Sloppy underwriting is the fastest way to lose your processor partnership.

Ongoing Compliance and Audits

After you launch, compliance does not stop. Your processor partner will conduct annual audits of your operations. They will review your merchant files, your chargeback handling, your security practices, and your financial records. If they find problems, they will give you a timeline to fix them. Repeated failures can result in termination of your partnership.

You must also file annual reports with your state's financial regulator (if you hold a money transmitter license) and maintain your errors-and-omissions insurance. Some states require you to file a net worth statement annually; others require audited financial statements. Keep a calendar of all deadlines and assign someone to track them.

The card networks also conduct periodic reviews. Visa and Mastercard publish compliance requirements that your processor partner must enforce. If you fail to meet them, your processor may impose fines or restrictions on your ability to process transactions. These fines can be substantial — $5,000 to $50,000 or more — so take compliance seriously from day one.

Frequently Asked Questions

Can I start a payment processor without a partner bank?

No. The card networks require direct access to be granted only to entities with substantial capital reserves (typically $10 million or more), years of compliance history, and dedicated compliance staff. New companies must partner with an acquiring bank or existing processor. After you have been in business for several years and have proven your compliance track record, you may be able to apply for direct access, but this is rare.

How much will I make per transaction?

Your processor partner will pay you a commission based on the transaction volume and the merchant's risk profile. Typical commissions range from 0.1 to 0.5 percent of transaction volume, though this varies widely. You will then charge merchants a higher rate and keep the difference. Most processors charge merchants 2 to 3 percent plus a per-transaction fee. Your profit margin depends on how efficiently you operate and how much you can undercut competitors.

What happens if one of my merchants commits fraud?

You are responsible for investigating and either defending the transaction or absorbing the loss. If the fraud was caused by your failure to conduct proper underwriting, your processor partner may hold you liable for the full amount. This is why underwriting is critical and why you need chargeback reserves. Document your underwriting process and keep detailed records of every merchant.

Do I need to be a bank to process credit cards?

No. You can be a sole proprietor, an LLC, or a corporation. However, you must be registered with your state and hold a money transmitter license (in most states). You must also have a business bank account and maintain separate accounting for merchant funds and your own revenue.

How long does it take to launch?

From the time you decide to start until you process your first transaction, expect six to twelve months. This includes forming your business (one to two weeks), applying for a money transmitter license (two to four months), finding and undergoing underwriting with a processor partner (four to eight weeks), and setting up your back-office systems (four to eight weeks). Plan accordingly and do not expect revenue in the first year.