Originally published November 2025
This report reflects our leadership team's perspectives on the evolving ISO and merchant relationship, specifically how compliance, data intelligence, and proactive partnership are redefining value in the payments chain. The core arguments have continued to play out since publication. Regulatory and scheme enforcement pressure on merchants and acquirers has increased, the margin for reactive compliance has narrowed, and the operational gap between merchants with strong ISO partnerships and those without has widened. The report remains a useful reference for payment, finance, and operations teams thinking through what a strategic ISO relationship should deliver.
One forward-looking reference in the report warrants a note. The "Looking Ahead" section references PSD3 as an upcoming regulatory development. The timeline and transposition status of PSD3 across EU member states has advanced since publication. For current information on PSD3 requirements and implementation timelines relevant to your market, speak to your ISO or compliance team directly.
Competition in payments doesn’t look the way it used to.
The walls between processors, platforms, and partners are fading, replaced by something far more fluid: a network of players who all sit somewhere between access, intelligence, and influence.
For merchants, this creates both pressure and possibility.
- Pressure to perform under faster scheme enforcement and rising fraud accountability.
- Possibility to turn compliance and data insight into commercial strength.
The result? A new kind of partnership, one built not just on processing power, but on context, clarity, and the ability to translate real-time data into foresight.
Because when every player in the payments chain is competing to provide access (i.e. to merchants, to schemes, to data, to rails) the access itself stops being a differentiator. Everyone can technically connect.
The real competitive edge then shifts to understanding. Understanding how those connections work, where value is created or lost, how data flows, and how to use that knowledge to improve performance.
Merchant performance is no longer just about processing transactions. It’s about navigating scrutiny, risk frameworks and scheme rules with precision.
As the year closes out, our leadership team sat down to share their broader, forward-looking perspectives on where the industry is heading.
In our latest report, they explore:
How the payments value chain is being redefined
The changing role of intermediaries and ISOs
How insight, compliance, and collaboration now determine value, not just access
And why innovation increasingly happens in the spaces between stakeholders, not just at the endpoints
What is a Smart ISO partnership and how is it different from a traditional ISO relationship?
A traditional ISO relationship focused primarily on providing merchants with access to acquiring infrastructure. A Smart ISO partnership goes further. It adds data interpretation, compliance support, and real-time performance intelligence to the relationship. Rather than acting as an intermediary that connects a merchant to an acquirer, a Smart ISO acts as a strategic partner that helps merchants operate more efficiently, compliantly, and profitably across all aspects of their payment stack. The distinction is between providing access and creating measurable operational value.
How has the role of ISOs in payments changed in recent years?
The ISO's function has expanded from transaction facilitator to merchant performance partner. Three forces are driving this shift. Faster scheme enforcement has shortened the window between a risk signal and an enforcement action, meaning merchants need partners who can identify and act on early warning signals, not just process transactions. Higher compliance stakes mean a single failed control in customer verification or recurring billing can now put an entire acquiring relationship at risk. And tighter margins have made payment optimization a direct financial lever, where understanding where authorizations drop or fraud spikes affects profitability, not just operations. In this environment, the traditional ISO role is no longer sufficient on its own.
How does an individual merchant's performance affect their acquirer relationship?
Acquirers do not assess merchants in isolation. They manage risk across their entire portfolio, and each merchant's performance contributes to the acquirer's aggregate standing with the card schemes. A single failed control in how a merchant verifies customers or manages recurring transactions can affect not just that merchant's account but the acquirer's overall risk profile. Acquirers are now required to act before problems escalate rather than after. This means merchants are being assessed continuously, not just at onboarding, and the quality of their payment operations has a direct bearing on the stability and terms of their acquiring relationship.
What payment data should merchants be monitoring to stay ahead of scheme enforcement?
The most actionable signals appear before a chargeback ratio moves. Fraud counts often rise before chargeback ratios do, and scheme enforcement windows have shortened significantly. Merchants should monitor authorization approval rates segmented by market, channel, and customer type, fraud flag rates at the transaction level, refund and dispute rates both separately and in combination, and how those figures compare to peer-group benchmarks for their merchant category. A single metric in isolation rarely tells you anything useful. The pattern across multiple signals is where early warning lives.
How do ISOs use portfolio-level data to benefit individual merchants?
ISOs work across multiple merchants, verticals, and markets simultaneously. That breadth creates visibility that no individual merchant has access to through their own data alone. An ISO can apply performance patterns observed in one vertical to another, identify authorization trends or fraud concentrations that a merchant would not detect in isolation, and benchmark a merchant's key metrics against comparable businesses in their peer group. This portfolio-level intelligence is a structural advantage of a well-resourced ISO relationship. A direct acquirer connection or embedded payment provider does not replicate it in the same way.
What is the difference between reactive compliance and proactive compliance in payments?
Reactive compliance responds to enforcement actions, chargeback notices, and scheme communications after a threshold has been breached. Proactive compliance identifies gaps in refund logic, recurring billing models, or customer verification flows before they become enforcement risks. The difference in outcome is significant. Merchants who treat compliance as a continuous operational discipline build more stable acquirer relationships, absorb scheme changes with less disruption, and spend less time and resource managing consequences. Card schemes and acquirers now expect continuous monitoring and evidence of oversight, not point-in-time reviews.
What role does AI play in modern payment risk management and why does human oversight still matter?
AI has accelerated the speed and depth of data analysis available to payment teams. Automated dashboards and AI-driven anomaly detection can surface patterns that would take human analysts significantly longer to identify. The value is not in the AI analysis itself but in how quickly merchants and their ISO partners can act on those insights to prevent issues before they escalate. However, AI tools produce false positives. Merchants without the expertise or infrastructure to identify and challenge incorrect flags can face unfair operational consequences from AI-only monitoring systems. Human oversight of AI-generated signals remains essential, and the right ISO brings that interpretive layer.
What should merchants look for when evaluating an ISO partnership?
Merchants should look beyond acquiring access, which most ISOs can provide, to the operational intelligence and compliance support that defines a strategic partner. Specific capabilities worth evaluating include real-time visibility into payment performance data segmented by market, channel, and customer profile; direct support for card scheme compliance requirements and monitoring programs; the ability to benchmark performance against comparable merchants in the same vertical; and proactive communication around regulatory and scheme changes before they affect the merchant's operations. An ISO that communicates only when a problem has already surfaced is providing reactive support. A strategic partner communicates before the signal becomes an issue.
How should merchants approach ongoing changes in payment regulation and scheme requirements?
Payment regulation and scheme enforcement continue to tighten. Merchants who treat each regulatory update as a one-off adjustment find themselves perpetually catching up. Those who have built continuous compliance monitoring into their daily operations absorb changes with significantly less disruption. The practical approach is to treat scheme rule updates, acquirer communications, and regulatory developments as an ongoing operational input, not a periodic project. An ISO partner with active compliance capability translates complex scheme and regulatory language into the specific operational steps that protect revenue and acquirer relationships.
What is the connection between payment compliance and merchant revenue performance?
Compliance and revenue performance are not in tension. They are operationally connected. Authorization rates, fraud ratios, and chargeback rates directly affect both scheme standing and processing costs. A merchant managing these metrics well pays lower scheme fees, maintains better acquirer relationships with more favorable terms, and experiences fewer processing disruptions. The ISO partnership model that delivers the most value is one that uses compliance insight to drive routing decisions, pricing improvements, and conversion optimization, converting what most merchants treat as a cost center into a measurable commercial advantage.
