What you actually need to build a card processing business

A credit card processing company sits between merchants (stores, restaurants, online sellers) and the banks that issue credit cards. You take a transaction, route it to the right bank, confirm the funds, and deposit money into the merchant's account — minus your fee. To do this legally, you need a merchant acquiring license from your state's banking regulator, a relationship with at least one card network (Visa, Mastercard, American Express, Discover), and a connection to the banking system itself, usually through a larger processor or bank that will sponsor you.

The barrier to entry is not technical — the barrier is regulatory and financial. You cannot simply write software and start processing cards. You need approval from multiple bodies, each with their own requirements. You also need capital to cover fraud losses, chargebacks, and operational costs before you see revenue. Most new processors do not start from zero; they start as resellers or partners of an existing processor, then graduate to their own license if the business grows large enough to justify the cost.

Key Takeaways

  • You need a merchant acquiring license from your state banking regulator and sponsorship from an existing bank or processor before you can legally process cards.
  • Visa and Mastercard have their own rules for who can become a processor, including minimum capital requirements and compliance standards that vary by company size.
  • Most new processing businesses start as resellers or ISO (Independent Sales Organization) partners of an existing processor, not as independent processors.
  • Compliance costs — fraud prevention, PCI-DSS certification, chargebacks, and regulatory reporting — are ongoing and can exceed your early revenue.
  • The fastest path to market is partnering with an existing processor and building a merchant base, then applying for your own license once you have revenue and track record.

State licensing and banking regulation

Every state has a banking regulator — often called the Department of Financial Services, Division of Banking, or Superintendent of Banks. If you want to process cards in that state, you must register with them. The process varies by state, but most require you to submit an application, prove you have adequate capital (often $100,000 to $500,000 depending on the state and your transaction volume), and pass a background check on your owners and officers.

Some states treat card processors as "money transmitters" and require a separate money transmitter license. Others fold it into a general merchant services license. A few states have minimal requirements; others are strict. You will need a lawyer familiar with your state's banking code to file correctly. The application itself can take three to six months, and you cannot legally process cards until you have approval in writing.

Visa and Mastercard sponsorship requirements

Visa and Mastercard do not license processors directly — they certify them. To become a Visa-certified processor, you must be sponsored by a Visa member bank (a bank that already has a Visa relationship). That bank vouches for you and takes on liability for your actions. The same applies to Mastercard. Without a sponsor, you cannot process Visa or Amex cards at all.

Visa publishes a Visa Core Rules and Visa Product Rules document that outlines processor requirements. You must comply with PCI-DSS (Payment Card Industry Data Security Standard) at the highest level, maintain fraud monitoring, handle chargebacks correctly, and report to Visa on your transaction volume and merchant base. Mastercard has similar rules in their Rules for Mastercard Members. Both networks charge you an annual certification fee and audit you regularly. If you violate their rules, they can revoke your certification and shut down your business.

The ISO and reseller path — the realistic starting point

Most people who want to start a processing company do not actually become processors. They become ISOs (Independent Sales Organizations) or resellers. An ISO signs an agreement with an existing processor, recruits merchants, and earns a commission on each transaction. The processor handles all the technical work, compliance, and regulatory burden. You handle sales and merchant support.

This route requires far less capital — often just enough to cover your own operating costs and marketing. You can start with a few thousand dollars. You do not need state licensing (the processor you partner with handles that). You do not need to negotiate with Visa or Mastercard directly. You simply sign a contract with your processor partner, get access to their merchant onboarding system, and start recruiting customers.

Many successful processing companies started this way. They built a merchant base, proved they could manage customer relationships and handle disputes, and then applied for their own processor license once they had revenue and a track record. A bank or larger processor is far more likely to sponsor you if you can show you already have 500 or 1,000 active merchants generating real transaction volume.

Capital requirements and fraud reserves

If you do become an independent processor, you need capital for three things: regulatory reserves, fraud losses, and operating costs. Regulatory reserves are money you must keep on hand to cover chargebacks and disputes — typically 1 to 2 percent of your monthly transaction volume, held in a segregated account. Fraud losses are real money you lose when a merchant or cardholder disputes a transaction and you cannot recover it. Operating costs are payroll, office space, compliance staff, and technology.

A processor handling $10 million in monthly volume might need $100,000 to $200,000 in fraud reserves alone, plus another $200,000 to $500,000 for operating costs and contingencies. You will not see profit for at least 12 to 24 months. Most new processors either raise capital from investors or bootstrap slowly by starting as an ISO first.

PCI-DSS compliance and ongoing regulatory costs

PCI-DSS (Payment Card Industry Data Security Standard) is a set of security rules you must follow if you handle card data. As a processor, you must achieve Level 1 compliance, the highest tier. This means annual audits by a may have access to security assessor, encryption of all card data, network segmentation, intrusion detection, and detailed logging of every transaction. The audit alone costs $10,000 to $50,000 per year depending on your size and complexity.

Beyond PCI-DSS, you must monitor for fraud, investigate chargebacks, file regulatory reports with your state and the card networks, and maintain detailed records of every merchant and transaction. You need a compliance officer, a fraud analyst, and legal counsel on retainer. These are not one-time costs — they are ongoing. A small processor might spend $50,000 to $100,000 per year on compliance alone.

Technology and integration infrastructure

You need software to route transactions, store merchant data securely, generate reports, and integrate with banks and card networks. You can build this yourself, license it from a vendor, or use a combination. Most new processors license core processing software from a company like Fiserv, FIS, or Repay, then build custom integrations on top.

The software itself is not the hard part — the hard part is integrating it with the banking system. You need a connection to the ACH network (for bank transfers), the card networks (Visa, Mastercard), and your sponsor bank. These integrations are not plug-and-play. They require technical work, testing, and certification by each network. Budget six to twelve months for this work before you can process your first transaction.

The realistic timeline and path forward

If you want to start a processing company, here is what the timeline actually looks like. Year one: become an ISO or reseller with an existing processor. Recruit merchants, build relationships, learn the business. Year two: grow your merchant base to 500 or more active accounts. Year three: approach a sponsor bank about becoming an independent processor. Year four: apply for state licensing and card network certification. Year five: launch as an independent processor.

This is not a fast path, but it is the path that works. The alternative — trying to start as an independent processor with no track record — is nearly impossible. Banks and card networks want to see that you can manage merchants, handle disputes, and run a stable operation before they sponsor you. Proving that takes time and real transaction volume.

Frequently Asked Questions

Can I process credit cards without a license?

No. Processing cards without a license is illegal in every state. You will face civil penalties, criminal charges, and civil lawsuits from card networks and banks. The only legal way to process cards is through a licensed processor or as an ISO under a licensed processor's sponsorship.

How much does it cost to get a merchant acquiring license?

State licensing fees range from $500 to $5,000 depending on the state. But the real cost is the capital you must hold in reserve and the compliance infrastructure you must build. Total startup cost for an independent processor is typically $250,000 to $1 million, depending on your transaction volume and complexity.

What is the difference between a processor and an ISO?

A processor is licensed and regulated; it holds the merchant accounts and takes on the legal liability. An ISO is a sales partner that recruits merchants for a processor but does not hold the accounts or take on liability. ISOs earn commissions; processors earn the spread between what they charge merchants and what they pay the card networks.

Do I need to be a bank to sponsor a processor?

No, but you need a bank to sponsor you. Only banks that are members of Visa and Mastercard can sponsor new processors. You cannot sponsor yourself. You must find a bank willing to take on the regulatory risk of sponsoring your company, which usually requires a track record and capital.

How long does it take to get certified by Visa and Mastercard?

Certification typically takes three to six months after you submit your application, assuming you meet all their requirements. But you cannot even apply until you have a sponsor bank and state licensing in place. The full process from zero to independent processor usually takes three to five years.