Merchant Underwriting Doesn't End at Approval

Merchant underwriting has a natural temptation built into it.

Get the application. Verify the business. Check the owners. Review the website. Assign the MCC. Run the risk checks. Approve the merchant.

Done.

Except that is not how merchant risk actually works.

A merchant can look acceptable on day one and become a completely different risk six months later. Transaction patterns change. Chargebacks rise. Complaints start coming in. Marketing gets more aggressive. Ownership becomes less clear. A merchant changes products. A previously terminated business pops up behind a different name.

And sometimes the warning signs are not subtle.

The Federal Trade Commission's September 2026 action against payment processor Nuvei is a useful reminder that merchant underwriting is not simply an onboarding function. It is an ongoing obligation to understand who is using the payments system and what happens after the account starts processing.

According to the FTC's complaint and announcement, Nuvei opened and maintained payment processing accounts for merchants that the agency alleges it knew or should have known were engaged in deceptive practices.

Under the proposed order, Nuvei would pay $4.85 million for consumer redress and implement stronger merchant screening and monitoring requirements.

The allegations are specific to Nuvei, and the FTC notes that the case will be decided by the court.

But for the rest of the payments industry, the operational lesson is much bigger.

Approval is not the finish line.

The Risk Decision Does Not End When Processing Starts

The payments industry puts enormous effort into merchant onboarding.

There is a good reason for that.

Before giving a business access to payment processing, somebody needs to understand what the business sells, who owns it, how it markets, where customers are located, expected transaction volumes, delivery timelines, refund practices, chargeback exposure, and whether anything about the application looks suspicious.

But onboarding only tells you what the merchant looked like when you onboarded them.

Processing tells you what the merchant actually does.

That distinction matters.

Once transactions start flowing, a processor, acquirer, PayFac, or other responsible party has access to a much richer set of risk signals. Chargebacks happen. Refund patterns emerge. Transaction sizes change. Consumer complaints appear. Fraud alerts arrive. Volumes spike. Processing behavior stops matching the business model described in the application.

Those signals should not live in separate systems that nobody connects until something blows up.

They are part of underwriting.

Just later underwriting.

The Nuvei Allegations Show What "Ongoing" Really Means

The FTC alleges Nuvei processed more than $30 million in consumer payments for Reimage, an offshore tech support operation, from 2017 through 2023.

The agency also alleges Nuvei maintained merchant accounts involving businesses selling opportunities using false or baseless earnings claims, businesses impersonating government tax authorities, and merchants that had previously been terminated by other processors or acquiring banks for excessive chargebacks or fraud.

Those are allegations, not a blanket description of Nuvei's merchant portfolio.

But they illustrate the kind of information a risk program needs to be capable of finding, escalating, and acting on.

A merchant being approved once does not answer questions like:

• Is the merchant still selling what it said it would sell?
• Are chargebacks increasing?
• Are consumers making similar complaints?
• Has the merchant changed its marketing practices?
• Has another processor or acquiring bank terminated the business?
• Is the merchant attempting to distribute volume across accounts to avoid monitoring?
• Does beneficial ownership still make sense?
• Is transaction behavior consistent with the merchant's stated business model?
• Has the risk profile changed enough that enhanced review is warranted?

If nobody owns those questions after onboarding, the payments program has a gap.

Chargebacks Are Not Just a Cost Metric

One particularly important piece of the proposed FTC order involves chargebacks.

The order would require Nuvei to screen and monitor existing and prospective clients and conduct enhanced screening and investigation of existing clients whose chargeback rates exceed thresholds specified in the order.

Payments companies already care about chargebacks.

Usually because they are expensive.

But chargebacks can also be information.

A rising chargeback rate can indicate poor customer service, confusing billing, fulfillment problems, unauthorized transactions, misleading marketing, fraud, or a business model behaving differently from what underwriting expected.

The percentage alone does not tell you which one.

That is why monitoring cannot just be a dashboard that turns red.

Someone has to investigate.

If chargebacks increase, what are the reason codes? Are complaints concentrated around a particular product? Did marketing change? Are refunds being denied? Did transaction descriptors change? Is the merchant generating a different mix of transactions? Are consumers describing the same issue repeatedly?

The purpose of monitoring is not to produce alerts.

It is to produce decisions.

"We Didn't Know" Gets Weaker When the Signals Are in Your Systems

There is a phrase in the FTC's announcement that every payments risk team should notice.

The agency alleges Nuvei maintained accounts for merchants it "knew or should have known" were engaged in deception.

That is an important distinction.

A payments company does not need a confession from a merchant before risk indicators matter.

The practical question is whether the organization had information that should have triggered additional review and, if so, what happened next.

That makes evidence incredibly important.

What alerts fired?

Who reviewed them?

What information did they see?

Was enhanced due diligence performed?

Was the merchant asked for documentation?

Was processing restricted?

Was the account escalated?

Who approved the decision to continue processing?

When was the merchant reviewed again?

A strong risk program should be able to answer those questions without reconstructing the story from Slack messages six months later.

Growth Teams and Risk Teams Need the Same Facts

Here is where merchant monitoring gets uncomfortable.

Good merchants make money for payment companies.

High-volume merchants make more money.

That can create tension when the same merchant generating revenue also starts generating risk signals.

This is why risk governance cannot depend on whether the merchant is commercially important.

Sales can provide context. Relationship managers can explain the merchant's business. Operations can help resolve anomalies.

But risk thresholds and escalation rules need to mean something even when the account is valuable.

Otherwise, the process becomes:

"This looks bad."

"Yes, but they process a lot."

That is not a control.

The FTC's joint statement in the Nuvei matter specifically alleges that internal concerns were not always followed when continuing to process was profitable. Whatever ultimately happens in the case, that allegation should make payments operators think carefully about how exceptions are approved and documented.

If your risk policy says one thing but your most profitable merchants routinely receive another standard, you do not really have the policy you think you have.

ISVs and PayFacs Should Pay Attention Too

It would be easy for an ISV to read this case and think, "We're not Nuvei. We're a software company."

That misses the point.

If your platform embeds payments, facilitates merchant onboarding, acts as a PayFac, operates a marketplace, serves as a merchant of record, or otherwise controls access to payment processing, merchant risk is part of the product whether you call it that or not.

Your processor or sponsor bank may perform important compliance and underwriting functions.

That does not mean your platform can ignore what it sees.

In many cases, the ISV has information the processor does not.

You know what the merchant is doing inside the software.

You may see appointments, orders, invoices, fulfillment, customer communications, subscriptions, inventory, refunds, or marketplace behavior.

If the payments data says one thing and the software activity says another, that difference may be a valuable risk signal.

Embedded payments creates an opportunity to make underwriting better because software platforms have context.

It also creates an obligation to decide what you do with that context.

Monitoring Needs an Escalation Path

A mature merchant monitoring program does not need a human staring at every transaction.

It needs rules for when humans get involved.

Start with the obvious categories:

Transaction behavior. Monitor unexpected changes in volume, average ticket, geography, card-not-present mix, refunds, declines, and other activity relevant to the merchant's expected profile.

Chargebacks and fraud. Track rates, reason codes, trends, network alerts, and concentrations rather than treating chargebacks as a single monthly number.

Consumer complaints. Repeated complaints describing the same deceptive or unauthorized behavior should not remain trapped in customer support.

Business changes. Material changes to ownership, websites, products, fulfillment, marketing, or business models may warrant re-underwriting.

External signals. Prior processor terminations, regulatory actions, sanctions concerns, negative information, or other credible risk indicators may justify additional review.

Exceptions. When a merchant exceeds a threshold but processing continues, document why, who approved it, what controls were added, and when the decision will be revisited.

Most importantly, define what happens next.

An alert without an owner is just a notification.

Do Not Build a Risk Program Around the Regulatory Minimum

There is another mistake payments companies make.

They look at an enforcement action and ask, "What exact threshold do we need to avoid this?"

That is the wrong lesson.

The better question is whether the controls can identify when a merchant no longer looks like the merchant you agreed to process.

Rules and network thresholds matter. So do contractual obligations and sponsor-bank requirements.

But fraudsters are not designing their businesses around your policy manual.

They adapt.

Your monitoring program needs to do the same.

That means risk teams need access to useful data, authority to escalate, support from leadership, and enough operational capacity to investigate alerts instead of simply closing them.

It also means underwriting should be treated as a lifecycle.

Application.

Approval.

Early processing.

Ongoing monitoring.

Enhanced review.

Restriction when necessary.

Termination when necessary.

And documentation through all of it.

The Takeaway

The FTC's Nuvei case is still a case involving allegations and a proposed settlement.

It should not be turned into a simplistic story that every merchant Nuvei processed was fraudulent or that every processor facing merchant fraud has failed.

Payments companies process enormous numbers of legitimate transactions, and identifying deceptive merchants is not always easy.

But that is exactly why the operational lesson matters.

Merchant screening cannot be a one-time compliance ceremony.

The risk changes after the merchant starts processing.

Chargebacks tell you something.

Complaints tell you something.

Transaction behavior tells you something.

Changes in ownership or business models tell you something.

Prior terminations and fraud signals tell you something.

The job is to put those signals together, investigate when necessary, make defensible decisions, and keep evidence showing how those decisions were made.

Because approving the merchant is only the beginning.

The real test of a payments risk program is what happens after you learn something new.

Want to get featured on the Cents Chat podcast? Complete our survey.