Nuvei and Humboldt Merchant Services Show Why Merchant Approval Is Really a Risk Decision

Two September FTC cases are a reminder that merchant onboarding is not a box-checking exercise. For PSPs and acquirers, the question is not just whether a company exists, but who controls it, what it sells, how it sells, and whether the transaction profile already looks toxic.

1. The FTC alleged that Nuvei opened or maintained processing accounts for merchants it knew or should have known were engaged in deception. The agency’s order shows what enhanced screening can look like in practice: Nuvei must collect information on what the business sells and how it sells it, plus details on principals, controlling persons, majority owners, business names, trade names, websites and physical locations.
2. That same order goes well beyond basic corporate paperwork. For merchants covered by the enhanced screening requirements, Nuvei must also review five months of chargeback data and, when available, six months of processing statements. It must determine whether the merchant or a related party was recently placed in a card network chargeback monitoring program or terminated by a processor, acquirer, financial institution or payment system because of excessive chargebacks.
3. The point is straightforward: underwriting files can contain much more than proof that a company was formed. A processor can compare who controls the merchant, where it operates, and how that profile fits into the wider payments history. In high-risk verticals, that history often matters more than the legal name on the application.
4. Days later, the FTC accused Humboldt Merchant Services of processing payments for more than 1,000 shell merchants allegedly used as fronts or pass-throughs for companies engaged in unauthorized billing. The agency said those sham merchants typically generated chargebacks at rates almost 10 times the levels card brands consider excessive.
5. The FTC also alleged that Humboldt placed sham merchant accounts on a lower-risk bank identification number, or BIN, in an effort to increase the likelihood that issuers would authorize the transactions. PYMNTS reported that Humboldt said the conduct at issue involved a limited number of third-party sales agents and merchants, occurred primarily from 2021 through 2023.

The backdrop is not exactly subtle: PYMNTS Intelligence research released last month with Plaid found that 57% of executives at firms in payment-heavy industries said fraud attempts had increased during the previous year, and 65% planned to strengthen identity verification during the following 12 months. For PSPs selling into high-risk verticals, the message from these FTC cases is that approval controls now need to catch both the merchant and the merchant behind the merchant.