Transaction Laundering: Why You Can't Run Another Business's Sales Through Your Merchant Account

The request usually sounds reasonable. A friend's supplement store got dropped by Stripe and asks whether you can run their orders through your checkout until they find a processor. A second product line you started on the side does not seem worth its own application. A consultant offers a cut of every sale if you let another company's customers pay through your merchant ID. In the language of the card networks, every one of those arrangements is transaction laundering, and the merchant account that agrees to it is the one that gets terminated.

What Transaction Laundering Is

Transaction laundering, also called factoring or credit card factoring, is depositing card transactions through a merchant account that was not underwritten for the business that made the sale. Your acquirer approved a specific legal entity selling specific goods through a specific website or storefront, under a specific merchant category code. Anything else flowing through that account is unsanctioned by definition.

The rulebooks are blunt about it. The Visa Core Rules, in the 18 April 2026 edition, say an acquirer must only accept transactions from an entity it has a valid merchant agreement with, and in the US require every merchant agreement to prohibit depositing a transaction that does not result from an act between the cardholder and the merchant, which the rules call laundering. Mastercard's Security Rules and Procedures define it as a merchant submitting transactions not made under a merchant agreement in effect between the acquirer and that merchant. The OCC, which examines the banks that sponsor merchant accounts, describes factoring as processing transactions through a merchant account for a business other than the one that was screened and set up for it.

None of those definitions mention whether the goods were legal, whether the merchant took a fee, or whether anyone meant harm. The violation is the mismatch between who was underwritten and who made the sale. Intent affects what happens afterward, not whether the rule was broken.

The Forms It Takes

Front merchants for prohibited goods

The clearest recent example is the case built around the California cannabis marketplace Eaze. Two consultants, Hamid Akhavan and Ruben Weigand, were convicted in March 2021 in the Southern District of New York of conspiracy to commit bank fraud for routing more than $150 million of marijuana purchases through the card networks between 2016 and 2019, disguised as sales of dog products, diving gear, carbonated drinks, green tea and face creams, using phony merchant websites, offshore bank accounts and forwarded customer service phone numbers. Akhavan was sentenced to 30 months and ordered to forfeit $17 million; Weigand received 15 months. Eaze was not charged, but its former CEO pleaded guilty to the same conspiracy.

Visa's Payment Facilitator and Marketplace Risk Guide lists the categories most often behind this kind of laundering: illegal gambling, illegitimate online pharmacies, illegal drugs and counterfeit merchandise. When a risk analyst sees signs of laundering on your account, the working assumption is that one of those is on the other end.

Renting out a merchant ID

The OCC's examiner handbook describes the arrangement high-risk merchants are most often offered: a merchant that holds an account with an acquirer submits sales for a merchant that does not, and typically receives a percentage of the other business's volume for doing so. The person offering that percentage has usually already been declined or terminated somewhere. Your account is worth paying for precisely because theirs was closed.

The favor

Most laundering that acquirers catch is not a scheme. It is a merchant helping a friend whose processor dropped them, an owner running a second company's sales through the first company's account because it was faster than applying, or a store adding a product line the acquirer would never have approved. None of it was disclosed at underwriting, so none of it is covered by the merchant agreement, and the rules have no carve-out for good intentions.

Agencies and platforms processing for clients

Web designers, marketing agencies and software vendors sometimes fold client payments into their own account: the client's customers pay the agency, and the agency remits the balance. That is laundering from the acquirer's point of view, and where the sales are telemarketed it is conduct the FTC's Telemarketing Sales Rule names outright: under 16 CFR 310.3(c), it is a violation for anyone to obtain access to the credit card system through a business relationship or affiliation with a merchant when the merchant agreement does not authorize it. The legitimate version of this model is a payment facilitator, covered below.

Sales agents who open accounts for other people

The pattern also runs through sales agents. In May 2020, First Data Merchant Services agreed to pay $40 million to settle FTC charges that it processed payments for scams and assisted credit card laundering, after an independent sales agent working through a company called First Pay Solutions opened hundreds of merchant accounts under false names between 2012 and 2014 for at least four fraudulent operations. If an agent offers to set up an account in a nominee's name, or under a business description that is not yours, that is the pattern the FTC was describing.

Why the Rules Treat All of It the Same

Underwriting is a decision about a particular business. The acquirer checked who owns it, what it sells, what its refund and chargeback exposure looks like, whether its website makes claims the FDA or FTC would object to, and whether the category is something the networks allow at all. Visa's rules require an acquirer to complete adequate due diligence on every prospective merchant, including a site visit or an equivalent, specifically to meet its obligation to submit only legal transactions. Every one of those checks was performed on your business. When another business's sales enter through your account, all of them were skipped.

The acquiring bank is the party on the hook for that gap. Visa's rules make an acquirer responsible for submitting only legal transactions and liable for the acts of the payment facilitators and sponsored merchants it contracts with, the OCC reminds examiners that an acquirer is potentially liable for losses caused by merchant fraud, and acquiring banks carry Bank Secrecy Act obligations that a merchant account full of unidentified third-party sales plainly strains. So the response is not proportionate to the size of the favor. An account that has processed for an undisclosed second business has proven that its owner will let unknown parties onto the network, the bank cannot tell a friend's supplement store from the front for an illegal pharmacy without an investigation, and the merchant agreement lets it stop the account first and investigate second.

How It Gets Detected

Both networks run dedicated programs for this. Visa operates Transaction Laundering Detection, which its 2021 Payment Facilitator and Marketplace Risk Guide describes as using payment system data and machine learning to flag merchants with a high probability of laundering. Under Mastercard's Merchant Monitoring Program, participating acquirers engage Mastercard-approved monitoring providers to scan and persistently monitor every merchant URL, explicitly including the payment page and any members-only areas, for prohibited content and for transaction laundering.

In practice, laundering surfaces through a handful of signals:

• Volume, ticket size or timing that does not fit the underwritten business. Visa's risk guide specifically calls out sudden runs of rounded amounts as a laundering indicator.
• Cardholders who do not recognize the charge. When the descriptor says your business and the customer bought from someone else, disputes arrive from people who never bought anything from you, and the investigation of those disputes leads straight to the other seller.
• Web crawling. Monitoring providers follow the checkout from the URL on file, and a payment form taking orders for a product the merchant does not sell, or embedded on a domain the acquirer has never seen, is a straightforward catch.
• Mismatched merchant category codes and refund patterns, issuer complaints and law enforcement inquiries, all of which arrive at the acquirer and get traced back to the MID they were processed under.

What Happens to the Merchant Who Did It

Termination is the beginning, not the end. In roughly the order they arrive:

1. Your account is closed and settlement stops. Merchant agreements let the acquirer hold funds against chargeback exposure, and an account terminated for laundering has an unknown amount of it, because the acquirer does not know who the real sellers were or what they shipped. Expect reserves and pending deposits to be held while that exposure runs off.
2. You are reported to MATCH, and to Visa. Mastercard's rules require an acquirer that terminates a merchant for a listed reason to add it to the MATCH Pro system with a reason code; the code for this conduct is 03, which Mastercard's current rules label Transaction Laundering. Records stay for five years before they are automatically purged, and the system is queried during underwriting. Visa separately requires the acquirer to add a merchant terminated for laundering to Visa's terminated merchant file by the close of business the day after notice. The site's guide to checking the MATCH list covers how a listing works and how to keep processing while on it.
3. Visa can bar you and your principals. The Visa Core Rules let Visa permanently prohibit a merchant, and one or more of its principals, from the Visa program for laundering. The same rule lists signing a new merchant agreement under a new name to get around the rules as a separate ground for the same penalty, which closes the obvious workaround.
4. Fines flow downhill. Mastercard's noncompliance assessments for submitting illegal or brand-damaging transactions in breach of its merchant agreement rule are levied on the acquirer: $200,000 per merchant, or $2,500 a day back to the first day of the violation where the acquirer can show it began within the previous 80 days. Merchant agreements generally make the merchant liable for fines the acquirer incurs because of that merchant's conduct, and high-risk merchant applications commonly carry a personal guarantee.
5. Legal exposure. Where the sales were telemarketed, credit card laundering violates the FTC's Telemarketing Sales Rule. Washington and Oregon make unlawful factoring of a payment card transaction a Class C felony, rising to Class B on a repeat offense, and the OCC notes that several states criminalize it. Where the disguise involved lying to a bank about what was sold, federal prosecutors have charged it as bank fraud, which is what put the Eaze consultants in prison.

The Legitimate Ways to Do What You Were Trying to Do

Almost every laundering arrangement is a shortcut around something the payments system already has a sanctioned path for.

You want to add a second product line or a second brand

Tell your processor before the first sale. Adding a product category, a second website or a DBA is a routine underwriting update; depending on the category it may mean a new merchant category code on the existing account or a second merchant ID under the same ownership. If the new line is one your current acquirer will not approve, the right move is a separate account with a provider that underwrites it, not a quiet addition to the one you have.

You want to help a business that was dropped

They need their own merchant account, and being declined by a mainstream processor does not mean they cannot get one. High-risk providers exist for exactly the industries and histories that Stripe, Square and PayPal decline, and applications that explain a prior termination plainly are underwritten every day. Lending them your account converts their problem into yours without solving theirs.

You want to process payments for clients or sellers on your platform

That is a payment facilitator or marketplace, and both networks have a registration model for it. Under Visa's rules, a payment facilitator is a third party agent that its acquirer must register with Visa before any transaction activity begins. It must sign a contract with each sponsored merchant, is financially liable for every transaction it processes on their behalf, must provide the names and domicile of each sponsored merchant's principals on request, and must not process for a seller whose acceptance was terminated at the direction of Visa or a government agency. Once a sponsored merchant exceeds $1 million a year in Visa volume, the acquirer must generally sign a direct agreement with it. It is a real business model with real compliance costs, which is the point: processing for other sellers is a supervised activity, not something a merchant account entitles you to do.

You are an agency that gets paid when clients get paid

Bill your clients for your services on your own account, and let their customers pay them on theirs. If you want to sit in the flow of funds, you are back to the payment facilitator model above, or to referring clients to a processor and earning a residual as a registered agent, which the site has covered separately.

You want more than one merchant account

Multiple accounts for the same business are legitimate when each acquirer knows about the others, each account processes the business it was underwritten for, and ownership is disclosed identically everywhere. Opening a second account under a new entity to keep processing after a termination is the circumvention Visa's rules single out by name, and the fastest route from a five-year MATCH listing to a permanent bar.

If You Have Already Been Doing It

Stop the third-party volume now, before the monitoring catches it. Then talk to your processor about adding the second business or product line properly, or about placing the other business with its own account. An acquirer that hears about an undisclosed line of business from its merchant is having a very different conversation than one that hears about it from a monitoring vendor, and most would rather underwrite the new activity than lose an otherwise good account. If the volume you carried was for a business you no longer control, or for goods you now suspect were prohibited, speak to a lawyer first.

PayKings places merchants that mainstream processors decline, including businesses recovering from a termination and businesses in the categories most often hidden behind someone else's merchant ID: supplements, CBD, vape, adult, firearms and subscription billing among them. Each gets its own dedicated merchant account, underwritten by an acquiring bank that knows exactly what it is approving. If you have been asked to carry another business's sales, or you are the business that was asked, the answer is an account of your own.