ISO (ISO)
In card payments, an ISO — Independent Sales Organization — is a company registered with a card scheme through an acquirer to sell and service merchant accounts. The same three letters also mean the International Organization for Standardization, which is why the abbreviation is never safe on its own.
Also called: independent sales organisation
An ISO sits between a card acquirer and the merchants that accept cards. It finds and signs merchants, often supplies terminals or gateway software, and handles day-to-day support, while the acquirer underwrites the merchant, holds the merchant agreement and settles the funds. Card schemes require an ISO to be registered through a sponsoring acquirer and to be disclosed to the merchant, precisely so that a merchant can tell who is actually carrying the risk.
The model varies. Some ISOs simply refer merchants for a share of the revenue. Others take on underwriting and portfolio risk, buy the residuals outright and look much more like a small acquirer. In the United States the term is standard; in Europe the same function is more often called a distributor, a reseller or a payment service provider, which makes cross-market comparisons less useful than they look.
The second meaning is the one that causes trouble. ISO is also the International Organization for Standardization, and financial writing is full of its standards — ISO 20022 for payment messages, ISO 8583 for card messages, ISO 4217 for currency codes, ISO 9362 for the BIC. On this site the standards body is the more common sense by a wide margin.
In practice
Registration with a card scheme is not a licence. An ISO has no authority to hold merchant funds, and where it does handle settlement the arrangement is usually a payment facilitator or an agent-of-the-payee structure with its own regulatory analysis. Confirm which one you are actually in before assuming the acquirer's permissions cover you.
Example
A merchant signs with what it believes is its payment company. The contract names an acquiring bank, with the ISO as a registered agent. When the merchant is later terminated for excessive chargebacks, the decision is the acquirer's — the ISO can argue, but it cannot overrule.
Commonly confused with
| Term | How it differs |
|---|---|
| International Organization for Standardization | The standards body behind ISO 20022, ISO 8583 and ISO 4217. Unrelated to card sales, and the more common meaning of the abbreviation in payments writing generally. |
| Payment Facilitator | A PayFac holds the merchant agreement itself and boards sub-merchants under its own master account. A classic ISO refers merchants to the acquirer and does neither. |
| Payment Processor | A processor runs the transaction plumbing. An ISO is a sales and servicing channel, and often does not operate any of it. |
See also
- AcquirerAn acquirer is the institution that contracts with a merchant to accept card payments, submits those transactions into the card schemes, settles the merchant’s proceeds, and carries the acquiring-side financial exposure — including the cost of chargebacks the merchant cannot fund itself.
- Payment FacilitatorA payment facilitator, or PayFac, holds one master merchant account with an acquirer and onboards sub-merchants beneath it. Those sub-merchants transact under the facilitator’s account instead of each contracting with an acquirer, and the facilitator underwrites and settles them.
- Payment ProcessorA payment processor carries out the technical steps of a transaction — authorization, capture, clearing and settlement instructions — for a merchant, an acquirer or an issuer. It generally handles the transaction rather than taking ownership of the money.
- Agent of the PayeeAn exemption in some US states under which a company collecting funds as the seller’s authorized agent is not treated as transmitting money. Payment to the agent discharges the buyer’s obligation to the seller, so nothing is in transit — the buyer has already paid.
- High-Risk MerchantA high-risk merchant is a business an acquirer classifies as elevated risk because of its dispute rate, its regulatory exposure or its reputation — gambling, adult content, crypto, nutraceuticals and retail forex are the usual examples. The label is the acquirer’s, not a regulator’s.