What is transaction laundering and how to avoid it

Sometimes, the reason behind the rejection is simply being a startup. Large and well-established payment providers don't want to be the ones taking a chance on new companies. The process of getting them on board, dealing with compliance, and verifying all the application documents can be really costly. They don't want to take a risk on whether the startup will actually succeed or not. It's a lot of time and effort, and if 'the business doesn't take off, it's just a waste of their time and they end up losing out.

Sometimes, the problem lies in the nature of your business itself. Even if it's legal, certain types of businesses like adult entertainment, gambling, pharmaceuticals/nutritional supplements, travel, education, drop shipping, investments, or offshore operations may face difficulties with the card schemes. These restrictions are primarily put in place to mitigate risks associated with financial crimes, protect the integrity of the payment system, comply with legal and regulatory requirements, and maintain the trust of consumers and financial institutions.

Certain activities, even if legal, may carry a higher risk of financial crimes, fraud, or chargebacks. By placing restrictions on these activities, Visa and Mastercard aim to mitigate potential risks and safeguard their networks, as well as the interests of merchants and consumers. If these networks were associated with high-risk or controversial activities, it could harm their reputation and undermine trust in their services. We saw an example of this in December 2020 when both Visa and Mastercard suspended their credit card services with Pornhub.

Visa and Mastercard therefore uses Merchant Category Codes (MCC), which is a four-digit number assigned to business types in order to identify the type of products or services provided by a merchant. The MCC is essential to categorize and track transactions accurately. It helps facilitate the proper routing of payments and enables the implementation of specific rules or restrictions for different types of merchants. For example, certain MCCs may be subject to additional security measures or have different processing requirements.

As payment consultants, we deal with these challenges on a daily basis, especially since we focus mainly on high-risk cases.

We know how banks think and why they reject certain businesses. We also know the alternatives and who can provide further assistance. But every now and then, we have clients who come to us with excitement, telling us that despite getting rejected by multiple payment processors, they managed to get approval from a lesser-known gateway on their own. We hate to burst their bubble, but often it's not as great as it seems.

Transaction laundering refers to a deceptive practice where high-risk (or even illegal) transactions are disguised as lower risk (or legitimate) transactions within the payment processing system. This method is used to hide the true nature of transactions, making them appear as lower risk. The process typically involves a low-risk online merchant profile, acting as a "front" for these activities. The launderer sets up a seemingly low risk business profile and processes payments under the lower risk Merchant Codes (MCC) to "hide" the real activities and bypass the restrictions and fraud prevention tools. The higher risk transactions are mixed with lower risk ones, making it difficult for authorities, card schemes or even financial institutions to detect the activities. Regrettably, numerous gateways are employing this system to meet the requirements of lucrative yet high-risk industries. This activity is known as "miscoding".

Transaction laundering can also occur when a merchant processes payment card transactions on behalf of another merchant.

Often this done with good faith where the merchant is not aware of this restriction and integrates the same Merchant ID connection codes to his other website(s) without alerting the payment provider first. Since payment gateways have no resources to educate their clients, it is not uncommon to see merchants unknowingly engage in improper practices.

If transaction laundering discovered, the payment processor faces a significant penalty and blacklisting from both Visa and Mastercard and the access of the international banking system. Although many times the penalty is then shared with the merchant, this can lead to the bankruptcy of the smaller payment gateways, which results to non-settlement and frozen/disappeared funds of the merchant.

Since the payment industry is very saturated and is dominated by the major players, starting a new payment processing enterprise is not easy. Many lesser known, new gateways try to enter the market by catering for these "fringe", higher risk industries, for a much higher fee. (Just to compare normal processing is around 2-5% while miscoded transactions can go on the market for 12-15%!). Desperation can be a big motivator when these gateways decide to accept startups or "grey market" companies for a high profit, to get at least a piece of the market, in order to grow.

Technically speaking, miscoding is not very complicated, as these gateways or payment processors are collecting and sending the payer's data (so called "traffic") to the acquiring bank as a whole, under one Merchant ID (the gateway appears as the main merchant, aggregating all their client's transactions). It's often difficult to figure out which transaction belongs to which client or activity. Sadly, many merchants are unaware of this, which means they can unintentionally get caught up in a miscoding scheme without even realizing it.

Read more