Home / Buy a Business / Payment Processing

Buy a Payment Processing Business in 2026: Residual Multiple Math, ISO vs ISV vs Payfac

Buying a payment processing business in 2026 lands at 8-18x EBITDA or 10-30x monthly residual income (MRI), the residual multiple is what buyers price on. Attrition rate is the single biggest input into that multiple, followed by portfolio concentration and technology stack. Structures split sharply between ISO (independent sales organization), ISV (independent software vendor), and payfac (payment facilitator), and each carries different acquisition economics and regulatory friction.

Reviewed October 2026 · CT Acquisitions

A merchant services portfolio looks simple on a spreadsheet: merchants process card volume, the processor pays out a share of the margin each month, and the buyer capitalises that residual. In practice the residual sits on top of a stack of contracts and rules, from the sponsor bank agreement to Visa’s acquirer monitoring thresholds, and any one of them can shrink the cash flow after closing. This guide is written for buyers: independent sponsors, search funds, family offices and strategic acquirers looking at ISOs, ISVs with embedded payments, and payment facilitators.

ISO, ISV or payfac: what you are buying

Three business models share the label “payment processing,” and they carry different assets, different risks and different buyers.

The independent sales organisation. An ISO signs up merchants on behalf of a processor and a sponsor bank and earns a share of the margin on every transaction those merchants run. Its main asset is the residual schedule: a monthly report from each processor showing volume, revenue, costs and the ISO’s split by merchant. ISOs must be registered with the card networks such as Visa and Mastercard, and that registration requires an acquiring bank willing to sponsor them, as Priority Commerce explains in its guide to becoming an ISO. Sub-ISOs and agents sell under a registered ISO’s umbrella with no direct contract with the networks or the bank. When you buy an ISO, you are buying its registrations, its processor contracts, its agent agreements and its merchant book, and each of those has its own transfer rules.

The software company with embedded payments. An ISV sells vertical software, for example practice management or point of sale, and earns payments revenue because its customers process through an integrated partner. The merchant relationship tends to be stickier because leaving the processor means leaving the software. The diligence question changes from “how fast do merchants churn” to “who owns the payments economics if the integration partner renegotiates.”

The payment facilitator. A payfac boards sub-merchants under its own master merchant account and often controls funding to them. That control raises its margin and its obligations: underwriting, risk monitoring, reserves, tax reporting on settled funds and, depending on how funds flow, state money transmission questions. A payfac with weak underwriting can carry losses on behalf of its sub-merchants.

Before you build a model, write down which of the three you are buying. Many founder-owned businesses mix them, for example an ISO book with a small payfac programme bolted on, and each part needs its own valuation logic and its own diligence list.

Valuing the residual without borrowing someone else’s multiple

Published multiple ranges for payments businesses vary so widely that they are of little use for a specific portfolio. Disciplined buyers value the residual directly, as a stream of monthly payments that shrinks as merchants leave and grows as surviving merchants process more.

The model needs five inputs, all taken from the target’s own data rather than from industry averages:

• Net residual by merchant. The amount the target keeps after processor costs, interchange pass-through, agent splits and any bank sponsorship fees. Gross residual figures flatter the book.
• Attrition by cohort. Merchants boarded in the same year tend to leave at similar rates, and the oldest cohorts are usually the most stable. Measuring attrition by cohort shows whether recent boarding is weaker than the seller’s long-term average suggests.
• Same-store volume change. Surviving merchants process more or less each year. A restaurant-heavy book may grow with menu prices; a book full of struggling retailers may shrink even with no closures.
• Cost to keep the book. Customer service, risk monitoring, equipment replacement, PCI programme costs and agent support. A portfolio with no service team behind it will churn faster once it changes hands.
• Exposure to repricing. Any processor right to change the buy rate, any bank right to exit categories and any scheduled fee changes that will reduce margin.

Discount the resulting cash flows at a rate that reflects how sure you are about each input. Where the merchant file is incomplete or the processor contract is ambiguous, the honest answer is a lower price or a larger earn-out, not a higher discount rate applied to optimistic numbers.

Embedded payments need a different lens

For a software company with integrated payments, the residual model is only half the work. Read the integration partner agreement as closely as a sponsor bank agreement: who sets pricing to the merchant, who can change the revenue share, how long the agreement runs, and what happens to the payments revenue if the software company is sold. Some partners hold rights to approve a new owner or to renegotiate on a change of control. Also check how many software customers have not yet switched on integrated payments, because that penetration gap is usually the growth case a seller will try to charge you for.

Who is consolidating payments

The largest processors have spent the last two years reorganising around merchant acquiring, and that shapes what they will pay for smaller books.

Two lessons for a lower middle market buyer come out of that table. The first is specialisation: Global Payments sold its card-issuing business to buy more merchant acquiring, and FIS went the other way. Large players are choosing sides, and the merchant side is where your portfolio will eventually sell. The second is founder rollover. In the Nuvei deal the founder retained a large minority stake rather than cashing out entirely, a structure that smaller payments sellers increasingly ask about because it keeps them invested in merchant retention after closing.

What an owner must hold

A payment processing business runs on permissions that belong to other parties. Your diligence should confirm each one and how it behaves when ownership changes.

Sponsor bank and network registration

Ask for the sponsor bank agreement and every processor agreement in full, including amendments. Look for clauses that let the bank or processor terminate, reprice or re-underwrite on a change of control, and for any requirement to obtain consent before a sale. Confirm the target’s registration with each card network is current and in the name of the entity you are buying. If the target is a sub-ISO operating under someone else’s registration, the residual depends on that upstream ISO’s continued good standing, and you should diligence the upstream party as well.

PCI DSS

According to the PCI Security Standards Council, version 4.0 of the data security standard added 64 new requirements, 51 of which were future-dated and became mandatory after 31 March 2025. For a buyer that means two checks. First, the target’s own compliance: its latest report on compliance or self-assessment questionnaire, the assessor’s name and any remediation plans. Second, the merchants’ compliance: many ISOs earn revenue from PCI non-compliance fees, and that revenue can fall if merchants are pushed into compliance or if a processor changes its programme.

Tax reporting on settled funds

Whoever settles funds to merchants has Form 1099-K duties. The IRS confirmed in IR-2025-107 on 23 October 2025 that the One, Big, Beautiful Bill reinstated the $20,000 and 200-transaction threshold for third-party settlement organisations, while payment card transactions remain reportable on the same form. For a payfac target, check who files these forms, whether backup withholding is applied where taxpayer identification numbers are missing, and whether the IRS has sent any penalty notices.

Money transmission

An ISO that never touches merchant funds rarely needs a money transmitter licence. A payfac that receives and pays out funds may, depending on the state and on how the flow of funds is papered. The Money Transmission Modernization Act had been adopted by 31 states as of early 2026, according to Vixio’s reading of the CSBS tracker, but recognition of the agent-of-payee exemption still varies and some states have no explicit exemption. Ask the target for its legal memo on funds flow and licensing, and have your own counsel read it.

Agents and the sales channel

Most ISOs grow through outside agents rather than employees, and the agent agreements decide how much of the book you control. Look at three terms in each one. The first is the residual split and whether it continues after the agent stops selling, often called a vested or lifetime residual. The second is portability: whether the agent can move merchants to a competitor, and whether the merchant agreement or the agent agreement wins if they conflict. The third is the non-solicitation clause and whether it is enforceable in the agent’s state. A book built by a handful of agents with lifetime residuals and portability rights is worth less to a new owner than a book built by employees, even if the monthly residual looks identical. If the seller is also the largest agent, plan for a transition period in which the seller keeps selling under a new agreement with clear residual terms.

Card network monitoring

Visa’s acquirer monitoring programme is the most direct threat to a portfolio’s value because it can make a sponsor bank drop an ISO or force it to exit merchants. Visa’s 2025 fact sheet defines the VAMP ratio as fraud reports (TC40) plus disputes (TC15) divided by settled transactions. An acquirer’s portfolio is classed as Above Standard at 50 basis points and Excessive at 70 basis points. The excessive level for an individual US merchant is 220 basis points once the merchant reaches 1,500 fraud and dispute items in a month, and Solidgate’s programme timeline shows that merchant threshold moving to 1.5% in the US and Europe from 1 April 2026.

Because one fraudulent transaction can produce both a fraud report and a dispute, the combined ratio climbs faster than the old chargeback-only metrics many sellers still quote. In diligence, ask the target for merchant-level fraud and dispute counts by month, not portfolio averages, and identify every merchant that has been in a monitoring programme in the last two years. A small number of high-risk merchants can generate most of the problem, and also most of the residual, which is why a seller may resist removing them before a sale.

The FTC’s 2026 processor cases

Two settlements announced within a week in September 2026 set out, in plain terms, the conduct the Federal Trade Commission treats as a processor’s responsibility.

• Nuvei, 4 September 2026. The FTC alleged that Nuvei opened accounts for merchants that other processors or acquiring banks had terminated for excessive chargebacks or fraud, and that it processed more than $30 million for the Reimage tech support scheme between 2017 and 2023. The proposed order requires $4.85 million for consumer redress, screening and monitoring of clients, enhanced review of clients whose chargebacks exceed set limits, and a ban on load balancing and other tactics that evade bank or network monitoring.
• Humboldt Merchant Services, 8 September 2026. The FTC alleged that Humboldt processed for more than 1,000 shell merchants fronting for undisclosed operators, that those merchants ran chargeback rates almost ten times what card brands treat as excessive, and that accounts were moved onto a lower-risk bank BIN. The proposed order requires $12 million for redress and permanently bans processing for high-risk merchants, straw companies and merchants on the Mastercard MATCH list.

For an acquirer the practical consequence is that merchant underwriting files are now a liability item, not just an operations item. Ask for the target’s underwriting policy, a sample of approval files for merchants in telemarketing, subscription billing, tech support and nutraceuticals, its process for checking the MATCH list, and any instance where merchants were split across multiple accounts or descriptors. Representations and warranties should cover past screening practices, with an indemnity or escrow sized to the high-risk share of the residual.

Residual diligence step by step

1. Reconcile residual reports to bank deposits. Match each processor’s monthly residual statements to the money that reached the target’s bank account for at least two years. Differences often point to reserves, clawbacks or splits the seller forgot to mention.
2. Build attrition from raw merchant data. Request a merchant-level file with boarding date, closure date, monthly volume and revenue. Calculate attrition by revenue as well as by count, and separate merchants that closed from merchants that moved to another processor. Headline figures that leave out inactive or seasonal merchants overstate retention.
3. Confirm portfolio ownership and vesting. Some processor contracts give the ISO full ownership of its merchants; others give the processor rights to the book if the ISO breaches or sells. Agent contracts may grant agents a share of residuals for life or the right to move their merchants. Read every one.
4. Map revenue by source. Split the residual into transaction margin, monthly and annual fees, PCI fees, equipment leasing and any software subscription. Fee lines are more exposed to regulatory and processor policy changes than transaction margin.
5. Test pricing practices. Review how merchants were priced at boarding and how prices changed afterwards. Unannounced increases or unclear surcharging and cash discount programmes create attrition and complaint risk after closing.
6. Measure concentration. Check the share of residual coming from the top merchants, the top agents, a single processor and a single vertical. A book that depends on one processor contract has a single point of failure.
7. Read the complaints file. Ask for Better Business Bureau complaints, state attorney general inquiries and any civil suits. Complaint themes often predict the merchant categories that will churn first.

Red flags that should pause a payments deal

• The seller will not share merchant-level data. Portfolio summaries without merchant files make attrition and concentration impossible to test.
• Residual statements do not match bank deposits. Unexplained gaps usually mean reserves, offsets or clawbacks that will continue after closing.
• Merchants that appear under several names or descriptors. Splitting one business across accounts is the load balancing behaviour the FTC banned in the Nuvei order.
• A recent jump in boarding of high-risk categories. Fast residual growth from telemarketing, subscription or tech support merchants raises both chargeback and enforcement exposure.
• Processor notices. Letters about monitoring programme breaches, reserve increases or category exits are early signs that a sponsor bank is losing patience.
• Agents with portability rights. If key agents can take their merchants to another ISO on a change of ownership, a large share of the book may walk on day one.
• Unpaid or disputed tax reporting. Missing Form 1099-K filings or unexplained IRS notices point to settlement controls that a buyer inherits in an equity deal.

What to ask a seller in the first meeting

1. Which processors and sponsor banks do you work with, and what share of residual comes from each?
2. Do you own your merchant portfolio outright under each processor agreement, and does any agreement require consent for a sale?
3. How many agents do you have, and what happens to their residual share if the business is sold?
4. Which merchant categories make up the largest part of your residual, and have any merchants been placed in a card network monitoring programme?
5. Who settles funds to merchants, and who files the tax forms for those payments?
6. When did you last complete a PCI assessment, and with which assessor?
7. Would you consider part of the price as an earn-out or a rollover stake?

The answers tell you within one conversation whether the business is a portfolio you can value with confidence or a set of contracts that need a lawyer before a model.

Financing and SBA eligibility

Many first-time buyers plan to use an SBA 7(a) loan, which runs up to $5 million under the standard programme. SOP 50 10 8, effective 1 June 2025, lists financial businesses primarily engaged in lending, investing or money services among ineligible businesses, with limited exceptions, and makes the SBA lender responsible for judging eligibility, according to Starfield & Smith’s summary of the SOP. An ISO that earns commissions for selling processing services may look different to a lender than a payfac that receives and disburses merchant funds. Put the funds-flow diagram in front of your lender before signing a letter of intent, and expect lenders to want a long residual history, a portfolio ownership opinion and evidence of processor consent.

Outside the SBA, residual portfolios are often financed with a mix of seller notes, earn-outs and specialist lenders who advance against the residual stream. Whatever the source, the lender will run the same attrition and ownership tests set out above, so doing that work first improves both your offer and your financing terms.

Deal structure

Payments deals are rarely all cash at closing. The structures sellers accept most often tie part of the price to what the portfolio produces after the sale.

• Residual-based earn-out or holdback. A portion of the price is paid over twelve to twenty-four months if the residual stays above an agreed floor. It aligns the seller with retention during the period when merchants are most likely to leave.
• Asset purchase of the portfolio. Buying the residual rights rather than the company can avoid historic liabilities, but it needs processor consent and sometimes re-papering of merchants, which itself causes churn.
• Equity purchase with rollover. Buying the company keeps registrations and contracts in place, and a founder rollover, as in the Nuvei take-private, keeps the seller invested. It brings historic screening and tax liabilities with it, so indemnities matter.
• Special indemnities. Given the FTC cases above, expect to negotiate a separate indemnity for pre-closing underwriting and screening practices, often backed by an escrow.

The first year after closing

Most value lost in payments acquisitions disappears in the first year, and most of it is self-inflicted. Changing merchant statements, moving merchants to a new processor, or cutting agent compensation all prompt merchants to shop their processing. Buyers who keep the merchant experience unchanged for the first year, honour agent agreements, and introduce new products only once service is stable tend to keep the residual they paid for.

The market tailwind is still there. The Federal Reserve’s 2025 Triennial Payments Study, released on 1 July 2026, counted 236.6 billion noncash payments in 2024, with cards making up 79% of them by number. Debit card payments reached 120.6 billion, but their 4.1% annual growth from 2021 to 2024 was the slowest three-year rate since 2000, while credit card payments grew faster than debit. Portfolios weighted toward merchants with rising credit card acceptance benefit from that shift, and the mix is worth checking during diligence.

How CT works with payments buyers

CT Acquisitions advises founder-owned businesses on selling, buying and planning an exit. When you are the buyer, we start with a one-page thesis: which model you want (ISO, ISV or payfac), the merchant verticals you will accept, the size range, how you will finance it and whether you plan to keep the existing processor. We then introduce you only to opportunities that match it, share material under NDA, and help both sides get the processor and sponsor bank conversations started early so that consents do not hold up closing.

We are selective about introductions because payments founders worry that a failed sale process will leak to their agents and merchants. That discretion works in your favour: you see fewer, better matched businesses, often before they reach a broad market. No fee to you on buy-side introductions; sell-side mandates are paid on success at closing.

If you are actively looking to buy a payment processing business, book a 30-minute conversation and walk us through your thesis. We will tell you plainly whether what we are seeing fits it.

Frequently asked questions about buying a payment processing business

What EBITDA multiple should I pay when buying a payment processing business in 2026?

For commodity ISO portfolios with 12% to 15% attrition, expect 6x to 9x EBITDA. For diversified ISOs with stable attrition and good vertical mix, 9x to 12x. For ISV or payfac businesses with proprietary software and sub-8% attrition, 12x to 18x. Healthcare and B2B specialty payfacs with embedded billing can reach 18x to 20x+. The single biggest multiplier is annual attrition, where each one-point reduction adds roughly 0.5 to 1.0 turns of EBITDA.

How is the residual portfolio multiple calculated when buying a payment processing business?

The dominant ISO convention is multiple of monthly residual income (MRI). Commodity portfolios trade at 10x to 14x MRI. Stable, well-serviced portfolios trade at 15x to 22x MRI. Vertical-specialty ISVs trade at 23x to 30x+ MRI. Multiply monthly residuals by the appropriate MRI factor to get residual-book valuation. Buyers reconcile this against an EBITDA multiple for the consolidated business.

What attrition rate is acceptable when buying a payment processing portfolio?

Sub-8% annual merchant attrition is platform-grade and opens premium pricing. 8% to 12% is acceptable and trades at standard multiples. 12% to 18% triggers significant multiple compression. Above 18%, most institutional buyers will not engage. ETA member benchmark studies suggest median ISO attrition runs 12% to 15% annually, so a portfolio at 8% is genuinely above market.

How do I evaluate an ISV or payfac business compared to a traditional ISO when buying a payment processing business?

ISV and payfac businesses are more valuable because software lock-in reduces attrition (often to 4% to 7% annually) and combined SaaS + payments yield is higher than pure interchange-plus pricing. Use a sum-of-the-parts valuation: SaaS revenue at 5x to 8x ARR, payments revenue at 10x to 14x EBITDA. The combined valuation almost always exceeds a blended single-multiple frame.

Who are the major buyers when selling a payment processing business?

Public strategics: Fiserv (NYSE: FI), Global Payments (NYSE: GPN), FIS (NYSE: FIS), Shift4 (NYSE: FOUR). Sponsor-backed consolidators: Stax Payments (Greater Sum Ventures), Payroc (Sumeru), Priority Technology Holdings (NASDAQ: PRTH), North American Bancard, Worldpay (GTCR 55% / FIS 45% since July 2023). ISV strategics: Toast (NYSE: TOST), Mindbody. International payfacs: Stripe (private), Adyen (Euronext: ADYEN). The right buyer depends on size, model, and vertical.

How long does buying a payment processing business take to close?

For sponsor-backed and search-fund buyers, 90 to 150 days from LOI to close. For public strategic buyers, 6 to 12 months is more common due to broader legal, regulatory, and integration diligence. Payment processing diligence is more technical than most verticals because of residual schedule reconstruction and merchant cohort attrition analysis, so plan accordingly.

Should I use an SBA loan for buying a payment processing business?

SBA 7(a) works for independent buyers up to $5M in purchase price. The challenge is that most SBA lenders do not have category expertise and may underwrite residual cash flow conservatively. A subset of ETA-focused SBA-preferred lenders specialize in payment processing acquisitions and will deliver better terms. For deals above $5M, a combination of commercial bank acquisition lending and seller financing is more common.

What is the biggest risk when buying a payment processing business?

Hidden attrition. Sellers commonly report attrition figures that exclude low-volume merchant pruning, seasonal accounts, and recently boarded merchants that did not activate. The real attrition rate is often 200 to 400 basis points worse than reported. The second-biggest risk is processor and BIN sponsor concentration; a single processor exit or residual cut can decimate cash flow if there is no contractual protection or migration plan.

Related resources for buyers

• Payment processing valuations and multiples (seller perspective): useful context on what sellers are being told
• Payment processing business valuation guide: detailed residual-multiple math and attrition modeling
• Buying a SaaS business: adjacent category with similar recurring-revenue dynamics
• Buy a business: all verticals: the full buy-side hub across home services, healthcare, and B2B
• How to sell a service business: seller-side playbook (useful context for buyer conversations)