For SaaS companies, becoming a payment facilitator (or PayFac) offers a ton of advantages—including but not limited to—boosting retention and profitability while exercising greater control over the customer experience.
However, several complex types of risks come along with this. Not only must PayFacs safeguard themselves and their clients against potential threats like fraud or cybersecurity breaches but also ensure PCI compliance, customer due diligence, and adherence to card regulations.
As such, PayFacs need to equip themselves with an effective risk management strategy that helps them continuously monitor risks and employ appropriate risk responses if needed. This article will help your business’s stakeholders understand the various risk factors to watch out for as well as the different types of risk management strategies to employ.
Let’s get started.
TL;DR
- Four main types of risks come with payment facilitation: compliance risks, operational risks, transactional risks, and reputational risks. PayFacs need to equip themselves with an effective risk management strategy that helps them continuously monitor risks and employ appropriate risk responses if needed.
- Common risk management strategies for PayFacs include proper merchant vetting and onboarding, transaction monitoring and fraud prevention, chargeback mitigation, KYC/AML compliance, and data breach prevention.
- To establish an effective risk management program as a PayFac, you must establish a dedicated risk management team, utilize the right tools and technology, develop proper risk management policies and procedures, conduct regular risk audits, and stay up-to-date with the latest industry regulations.
Mitigating Risks as a PayFac: Key Risk Categories
As you may already know, as a payment facilitator, you can enable your software users (or sub-merchants) to accept payments through your SaaS platform—without having to use a third-party payment gateway or provider.
This allows you to bring the payment experience in-house, keep it on-brand, gain customer trust, and provide a seamless checkout experience to end users.
However, you are likely to come across a wide range of threats and external risks as you go about facilitating payments for your sub-merchants. Broadly, these can be classified into the following categories:
Compliance risks
Potential risks that may arise from non-adherence to any card brand or governmental regulations come under this category. This means that PayFacs need to conduct a thorough risk analysis of their sub-merchants before onboarding them so they are screened against terror financing or money laundering.
Several US legislations (like the Patriot Act, anti money laundering laws, or FinCEN regulations) require PayFacs to know the identities of the business owner(s) they plan to facilitate payments for, during the underwriting stage. They must also ensure that sub-merchants are compliant with the regulations set by card companies, e.g. PCI compliance.
Operational risks
Also known as strategic risks, these are risks that may stem from a PayFac’s unsound business practices or faulty decision-making. The potential impact of failed or inadequate internal systems, processes, procedures, etc. could also be classified as operational risks.
For example, the breakdown of old hardware, human errors, or malware can cause a hindrance to payments. Inexperienced staff in high-pressure roles could also cause serious lapses. Even the organizational shake-up that comes with the decision to become a PayFac may disrupt your core business.
Transactional risks
These are the risks that may arise from the processing of transactions on your platform. The PayFac is liable for all the transactions that happen on its platform. So you must have risk avoidance, risk identification, and risk reduction strategies in place to combat fraudulent transactions. You should also have contingency plans or initiatives in place to mitigate the impact of a risk.
For instance, a customer may order a product and receive it but claim they didn’t. They would then request a chargeback from their bank instead of requesting a refund from the seller—which essentially constitutes friendly fraud. Since PayFacs are responsible for processing and settling funds, they are liable for chargebacks as well.
Reputational risks
Risks associated with things like data breaches, poor customer service, company controversies, etc. could result in financial losses, litigations, law enforcement action, and damage to reputation.
Any illicit activity on the part of your sub-merchants can also cause a serious loss of reputation and customer trust. PayFacs must therefore keep track of dubious/high-risk merchants and immediately terminate the contracts of those engaged in any illegal activity.
Risk Management Strategies for PayFacs
Now that we’ve covered the various types of risks you need to watch out for, let’s take a look at some risk management strategies you could employ.
1. Merchant onboarding and vetting procedures
To authenticate prospective sub-merchants, PayFacs must collect all relevant information about their business—in line with all applicable laws and regulations. Once you collect the information, make sure to validate it so that any fraudulent merchant applications may be avoided.
Once the information is collected, PayFacs must render an underwriting decision to approve or decline sub-merchant applications. This requires sound underwriting policies and procedures. After, the PayFac performs due diligence during the merchant underwriting process and ensures that a merchant poses no undue financial risk, causes no harm to the payment system, and operates within an allowed jurisdiction.
2. Transaction monitoring and fraud prevention techniques
As a PayFac, you must diligently monitor the daily transactions of your sub-merchants and look out for any unusual activity.
- Velocity checks. Any abrupt or unusual deviation from a sub-merchant’s usual transaction pattern should be a cause for alarm. Monthly sales amount (volume), average transaction amount, sales-to-purchase return ratio, etc. are some of the common metrics you need to track.
- Fraud detection and prevention. Early detection can help in the rapid mitigation of fraud. PayFacs must, therefore, bring any potential losses under the scanner (from sub-merchants engaged in questionable business activities). Any unusual activity in a user’s normal course of doing business should set off alarm bells immediately. You must then find the root cause and remedy it.
3. Reserve accounts and chargeback mitigation strategies
PayFacs can use reserve merchant accounts to reduce risk exposure. In this case, you would be setting aside a portion of your sub-merchants’ funds to protect yourself against any risk. Reserve accounts can be used when sub-merchants offer delayed delivery of products or services, for example, businesses offering annual membership, events, or travel-related businesses.
However, note that reserve accounts are the property of sponsored merchants. They can only be drawn upon under applicable clauses in your payment services agreement.
Having chargeback mitigation strategies in place can help you reduce the losses from chargebacks and illegitimate disputes. Ideally, the goal behind such strategies should be to keep a low chargeback ratio. This can be ensured using a fraud detection system with a filter, maintaining transaction records, and implementing chargeback alerts.
4. Know your customer (KYC) and anti-money laundering (AML) compliance measures
Having a robust AML system in place mitigates the risks of criminals using your payment system for laundered money. However, to implement an effective AML system, it is important to have effective KYC controls in place. This involves having the basic information of your sub-merchants in your records. This includes their name, date of birth, address, identity documents, etc.
AML and KYC are mandated by the FATF as part of its comprehensive framework of measures to protect financial systems from vulnerabilities.
5. Data security and breach-prevention practices
All payment systems run on information. PayFacs are storing, organizing, and transferring sensitive information all the time. Any breach of this information can cause colossal losses to merchants, customers, and marketplaces.
Most PayFacs have technology in place to prevent these breaches. However, you must ensure that all systems comply with security standards such as PCI DSS. Regular cybersecurity audits, training your employees in security best practices, and sensitizing them against irresponsible behavior could significantly help safeguard against breaches.
Implementing Effective Risk Management Programs
As a PayFac, you must acknowledge that you can never have zero percent risk. However, risks can be managed well by employing some effective risk management programs. These would typically involve the following:
- Establish a dedicated risk-management team: Risk management is a full-time job. So hire experts, train human resources within the organization, and fix their responsibilities per a comprehensive risk management plan. The Electronics Transactions Association (ETA) recommends having industry experts and legal counsel to ensure compliance with various standards, laws, and procedures.
- Utilize risk management technology and tools: Just having a well-trained risk management team is not enough. As a PayFac, you have to invest in cutting-edge risk management technology to stay a step ahead of fraudsters. For instance, proper tools are required to spot and decline fraudulent applications during underwriting. These include negative databases, device fingerprinting, third-party validation, and geolocation checks.
- Develop and implement clear risk management policies and procedures: PayFacs must have sound risk management policies and procedures. These must be in line with the regulations in vogue and ensure all aspects are covered. A sound and unambiguous risk management policy provides an effective starting point for all the subsequent actions at the managerial and operational levels.
- Conduct regular risk assessments and audits: The risk management process is extremely dynamic with new risks and challenges emerging all the time. This means PayFacs always need to be vigilant. This calls for regular risk assessments and audits—preferably by an external agency—to close all the possible gaps in the security setup. Audits must again be in line with your policies, industry regulations, and legislation.
- Stay informed about evolving payment industry regulations: If threats are evolving, so must the mechanisms to tackle them. PayFacs need to be aware of changing regulations to align their business practices accordingly.
Final Words
Risks are a persistent factor for PayFacs and can be a cause for serious losses for the entire payment ecosystem. But with the right kind of policies, teams, and technologies, PayFacs can achieve significant risk mitigation for themselves, their sub-merchants, and of course end users.
However, the easiest way to go about becoming a PayFac while making sure effective risk management strategies are in place is to partner with an expert like Stax. Stax Connect can help you build a complete payments ecosystem quickly from scratch while helping you successfully manage risk efficiently and inexpensively. Contact our team today to learn how.
Join the Payments-Led Growth Movement
Sign up to keep up-to-date with the latest trends in payments, vertical SaaS, and technology from industry experts.
FAQs About Risk Management
Q: What is risk management?
Risk management in the context of Payment Facilitators (PayFacs) involves identifying, assessing, and controlling threats to an organization’s capital and earnings. These threats, or risks, could stem from a variety of sources, including financial uncertainties, legal liabilities, technology issues, strategic management errors, accidents, and natural disasters. A crucial aspect of risk management for PayFacs includes safeguarding against risks like fraud, cybersecurity breaches, and ensuring compliance with regulations such as PCI standards and anti-money laundering laws.
Q: Why implement risk management?
Implementing risk management is crucial for PayFacs to protect themselves and their clients from potential threats, ensuring a secure and trustworthy payment processing environment. Effective risk management helps in maintaining compliance with various legal and regulatory standards, preserving the integrity of the payment system, preventing financial losses, and safeguarding the reputation of the PayFac.
Q: What are the top risk management strategies?
Top risk management strategies for PayFacs include:
- Merchant Onboarding and Vetting Procedures
- Transaction Monitoring and Fraud Prevention Techniques
- Reserve Accounts and Chargeback Mitigation Strategies
- KYC and AML Compliance Measures
- Data Security and Breach-Prevention Practices
Q: What are examples of risk mitigation?
Examples of risk mitigation include setting up systems for real-time transaction monitoring to detect and prevent fraudulent activities. A PayFac can also establish strict protocols for merchant onboarding to ensure compliance with anti-money laundering regulations.
Another example? Implementing advanced cybersecurity measures to prevent data breaches and protect sensitive information.
