Visa Third Party Agent Rules

Also called TPA registration, Visa agent registration, Mastercard service provider registration

Network rules requiring acquirers to register and oversee the ISOs, agents and service providers that touch their merchants.

What it is

Both major networks regulate the companies that sit between an acquirer and a merchant. Visa's rules require members to manage third party agents with proper oversight, and require that agents comply with anti-money-laundering, anti-terrorist-financing, sanctions, privacy and security, and consumer protection law. Mastercard's rules establish registration and validation requirements for service providers, and require acquirer sponsorship before an ISO may operate. Several structural points follow. ISOs cannot retain settlement funds. Only the acquirer has authority to terminate a merchant agreement. ISO and payment facilitator transactions carry specific identification requirements. And responsibility for payment facilitator and sub-merchant activity remains with the sponsoring acquirer, which cannot delegate core compliance obligations away. A change with a near-term date is worth flagging: a Visa rule change effective October 24, 2026 requires members to provide Visa with all numerical identifiers associated with each of their third party agents. Practically, that means acquirers will be collecting and reporting every merchant identifier tied to every agent, and agent onboarding paperwork is expected to tighten around that date. For merchants, the useful consequence is that an ISO marketing under its own brand is supposed to be registered and to identify its sponsoring acquirer in merchant-facing material. Unregistered ISO branding is itself a network violation.

Why it matters to your business

You can use these rules as a quick vendor check. Ask any payments company whose brand is on your paperwork: are you a registered ISO, who is your sponsoring acquirer, and whose name is on my merchant agreement. Those three answers tell you who you are actually contracting with and who has authority to terminate you. If the person selling you is a sub-agent of an office of an ISO of a processor, that is normal in this industry, but you should know it, because your service experience and your residual-driven attention depend on where you sit in that chain. This is education, not legal advice. Network rules are private contracts and merchants generally cannot enforce them directly.

Where it gets contested

The enforcement question is where this gets interesting. Network rules are contract, not law, and they bind members. Merchants are not parties to them and generally cannot enforce them. So a merchant harmed by an unregistered agent misrepresenting rates has a network rule violation and no direct network remedy, and must fall back on state consumer protection law. There is also an argument about who the oversight actually protects. Acquirers carry the compliance burden and the losses, so oversight is designed around acquirer risk, not merchant experience. That is why an agent can be perfectly compliant with registration requirements while selling in a way merchants would consider misleading. The October 2026 identifier reporting change is a genuine tightening, and its practical effect is more visibility for networks into which agent boarded which merchant. Whether that improves merchant-level conduct or simply improves loss attribution is not yet clear.

How to check it yourself

Ask your sales rep for the name of the registered ISO and the sponsoring acquirer bank in writing, then confirm those names appear on the merchant agreement you are asked to sign. A mismatch is worth a direct question before signature.

Receipts

Claims above that are checkable, with where to check them. Published so you do not have to take anyone's word for it.

Visa members must manage third party agents with oversight covering AML, sanctions, privacy, security and consumer protection, and a change effective October 24, 2026 requires reporting of all agent numerical identifiers
usa.visa.com ↗
Mastercard requires acquirer-sponsored service provider registration, ISOs cannot retain settlement funds, and acquirers retain responsibility for payment facilitator and submerchant activity
mastercard.us ↗
Channel conflict from the same merchant submitted through multiple agents is treated by regulators as a control gap
greensheet.com ↗