The High Cost of Oversight: How FTC Enforcement is Reshaping Merchant Risk Management
Before a single credit card transaction is authorized, a complex, high-stakes decision is made in the background: an acquiring bank or payment processor must decide whether to extend the privilege of payment acceptance to a merchant. While often viewed as a routine administrative hurdle, this "underwriting" process has recently become the focal point of intense regulatory scrutiny.
As fraud sophistication climbs, the Federal Trade Commission (FTC) has sent a clear message to the industry: processors are the gatekeepers of the financial system, and those who fail to monitor their own doors will face severe, multi-million-dollar consequences.
The Regulatory Crackdown: A Recent Chronology
September 2026 proved to be a watershed month for payment industry compliance, as the FTC brought two high-profile enforcement actions that underscore the dangers of inadequate merchant screening.
- Early September (Nuvei Settlement): The FTC reached a $4.85 million settlement with Nuvei, a major global payment processor. The agency alleged that the firm opened or maintained processing accounts for merchants that it knew, or should have known, were engaged in deceptive practices. The settlement mandates that Nuvei implement rigorous, "robust" screening practices to prevent future lapses in oversight.
- Late September (Humboldt Merchant Services): Just days after the Nuvei announcement, the FTC took aim at Humboldt Merchant Services. The agency accused the firm of knowingly facilitating payments for more than 1,000 "shell" merchants. These entities, according to the FTC, were used as fronts for third-party companies engaged in unauthorized billing—a classic "laundering" scheme where one merchant processes payments on behalf of another to hide the true source of high-risk activity.
These cases serve as a stark reminder that the "Know Your Customer" (KYC) requirements are not merely checkbox exercises; they are the primary defense against the systemic abuse of the global payment infrastructure.
Supporting Data: The Rising Tide of Fraud
The FTC’s aggressive stance comes at a time when the payments landscape is increasingly hostile. According to recent research from PYMNTS Intelligence, conducted in collaboration with Plaid, 57% of executives in payment-heavy industries reported an increase in fraud attempts over the last year.
The industry is responding, albeit slowly. Nearly two-thirds (65%) of these executives have indicated plans to strengthen their identity verification protocols over the next 12 months. This shift suggests a move away from static, point-in-time checks toward dynamic, continuous monitoring. The data suggests that companies that leverage advanced verification tools—such as instant bank account verification and open banking-based ownership checks—are significantly better at identifying and halting fraudulent activity before settlement occurs.
Indeed, a May study of middle-market companies revealed that firms using early-stage verification were far more likely to stop fraud before it resulted in a loss. Currently, 57% of firms still report that they only discover payment fraud after the settlement process, turning a preventable incident into a costly, time-consuming dispute.
Beyond the Business Name: The Anatomy of Underwriting
The Nuvei court order provides a blueprint for what the FTC considers "enhanced screening." It moves far beyond simply verifying that a business entity exists in a corporate registry.
For high-risk accounts, the burden of proof now includes:
- Principals and Ownership: A deep dive into the identities of controlling persons and majority owners.
- Operational Transparency: Full disclosure of what is being sold, how it is being sold, and the digital footprint of the business (websites, trade names, and physical locations).
- Historical Integrity: The requirement for five months of historical chargeback data and six months of processing statements.
- Network Standing: A mandatory check to determine if the merchant or its principals have been terminated by other financial institutions or placed into card network chargeback monitoring programs.
This level of scrutiny is designed to catch the "sham" merchant behavior identified in the Humboldt case. In that instance, the FTC alleged that Humboldt enabled shell companies to process payments on behalf of undisclosed third parties. These sham merchants were not just high-risk; they were engines of financial abuse, generating chargeback rates nearly 10 times the threshold that card brands define as "excessive." Furthermore, the FTC alleged that Humboldt attempted to obscure this activity by placing these accounts on lower-risk Bank Identification Numbers (BINs) to avoid triggering automatic fraud alerts.
Official Responses and Corporate Accountability
The impact of these two cases is not merely regulatory; it is financial. The combined $16.85 million in consumer redress payments—$4.85 million from Nuvei and $12 million from Humboldt—represents a significant bottom-line hit.
In response to the allegations, Humboldt Merchant Services has maintained a posture of remediation. The company reported that the conduct in question involved a limited number of third-party sales agents and merchants, and noted that the issues occurred primarily between 2021 and 2023 under former leadership. Humboldt stated that it has since overhauled its compliance and risk management frameworks to align with current best practices. Crucially, the company made no admission of wrongdoing as part of the settlement agreement.
The Implications: Moving Toward Continuous Compliance
The shift signaled by the FTC is clear: merchant screening is no longer a "set it and forget it" function performed at the inception of a contract. It has evolved into a continuous control loop.
The Feedback Loop
Modern risk management requires that transaction activity be constantly tested against the data collected at onboarding. Under the terms of the Nuvei order, the processor is now required to calculate chargeback rates on a monthly basis for every client. If a client exceeds a 1% monthly chargeback rate—and specifically crosses a threshold of 75 chargebacks in any two-month window within a six-month period—an investigation is triggered automatically.
The Cost of Post-Settlement Discovery
For processors, the message is unequivocal: information discovered after money moves is exponentially more expensive than information discovered before. Once a transaction reaches settlement, the power shifts from the processor to the consumer and the card issuer, often resulting in unrecoverable losses and regulatory fines.
Future Outlook
As we look toward the remainder of the decade, the integration of digital identity verification across the entire transaction lifecycle will become the industry standard. PYMNTS Intelligence data shows that the most successful companies are currently using digital identity verification across an average of 4.4 distinct workflows—covering everything from initial account opening to ongoing fraud tracking.
The FTC’s recent actions have effectively bridged the gap between "payment processing" and "risk management." Processors are no longer just service providers; they are, in the eyes of the law, the primary sentinels of the retail economy. For those in the sector, the choice is simple: invest in robust, transparent, and continuous screening now, or pay the price in regulatory settlements and reputational damage later.
By demanding greater transparency into ownership, physical operations, and historical performance, regulators are forcing the industry to strip away the anonymity that bad actors use to hide their activities. The era of the "shell" merchant is being brought to a close by a combination of technological vigilance and the firm hand of the Federal Trade Commission.
