Processor Risk Review? How to Respond Without Losing Your Account
Got a merchant account risk review email? See what the risk team is checking and how to reply so a routine review doesn't turn into a hold.
Photo: Pixabay
On this page 8 sections
- Why Established Accounts Still Get a Merchant Account Risk Review
- What Usually Triggers the Processor Risk Team Email
- What the Risk Team Is Actually Checking
- When a Payment Processor Is Requesting Documents: What to Send
- How to Respond to a Merchant Account Under Review
- Mistakes That Turn a Review Into a Hold or Reserve
- How to Make the Next Periodic Review Boring
- When to Escalate or Line up a Backup Processor
Key takeaways
- A review usually means your processing no longer matches the profile you were approved on. Your reply should explain the gap and prove the sales are real.
- Send what was asked, labeled to match each transaction, with a short note on what changed. Extra material and arguments slow the file down.
- Ask to raise your approved volume and ticket limits before a big sale. Afterward, you are explaining a spike instead of scheduling it.
- Line up a backup processor openly and disclose your history. Routing sales through another account to dodge a review can end in termination for cause.
A merchant account risk review usually means one of two things. Either your processor's risk team has noticed that your recent processing looks different from the profile you were approved on, or your account has come up for a scheduled check. In both cases the team wants evidence that the sales are real and that the business is still the one it underwrote. If you reply quickly and send exactly what was asked, with a short explanation of what changed, you give the review its best chance of closing without changes to your account. Reviews tend to become holds or reserves when merchants ignore the email or send documents that contradict their own processing history.
Why Established Accounts Still Get a Merchant Account Risk Review
When you were approved, underwriting recorded a snapshot of your business. It covers what you sell and how you sell it, plus the numbers you put on the application. Expected monthly volume and average ticket matter most, along with the largest single sale you expected and how much of your volume would be card-not-present. That snapshot becomes the baseline, and monitoring software compares each batch against it.
The acquiring bank (the bank that sponsors your merchant account) answers to the card networks for every merchant it signs. If one of those merchants leaves behind chargebacks it can't pay, the bank absorbs the loss. Banks also carry their own anti-money-laundering obligations. Neither responsibility ends after onboarding, so the bank, or the processor acting for it, keeps watching for as long as your account is open.
A merchant account periodic review can happen with no trigger at all. It's a scheduled refresh of your file, often after an account has grown or reached an anniversary.
Seniority doesn't exempt you. An account with years of clean history still gets flagged when this month looks nothing like the past few years. What seniority does give you is an easy case to make, provided you make it.
What Usually Triggers the Processor Risk Team Email
Most flags come from a gap between the baseline and what's happening now.
- Volume jumps. A month well above your approved monthly volume draws attention, especially when it arrives suddenly.
- Ticket size shifts. One sale far above your stated maximum can trip a flag. So can an average ticket that drifts up over several weeks.
- A new way of taking cards. Picture a retail store that suddenly keys in a third of its sales, or a restaurant that starts running large phone payments through a virtual terminal.
- Refund or chargeback spikes. Refunds that outpace sales stand out, especially refunds to cards that never made a purchase. A chargeback ratio climbing toward network monitoring levels gets attention too; our guide to chargeback ratio limits that put your account at risk covers those thresholds.
- Website or product changes. New product categories or a new domain can prompt a look. Removing your refund policy, or letting the site drift away from the business on file, does the same.
- Account detail changes. Switching your deposit account or changing ownership will often start a review on its own.
Each industry trips these flags its own way. Restaurants book their first big catering deposit over the phone. Retail shops take a large corporate gift order in early December, keyed from a purchasing manager's card. When a Shopify store launches a new product line, sales can triple in two weeks. Consulting and bookkeeping firms collect annual retainers in January. Every one of these is legitimate, and every one looks to software like a pattern that also shows up in fraud.
What the Risk Team Is Actually Checking
An analyst reviewing your file is answering a short list of questions:
- Are these sales real? Did actual customers buy actual goods or services?
- Is this still the business we approved? Selling something your merchant category code doesn't cover is a serious problem, even if the new product is perfectly legal.
- Can you deliver? For prepaid or future-delivery sales, the bank carries the risk until the customer receives the goods. A catering deposit for an event three months out is exposure the bank holds the whole time.
- Is the money going where it should? Deposits should land in a business account in the name of the merchant on file. See business bank account requirements for payment processing.
- Will chargebacks follow? If the sales are disputed later and you can't cover them, the bank pays.
A good reply answers those questions before the analyst has to ask twice.
Worked Example: How a Retainer Week Looks From the Risk Desk
This case is illustrative, and every assumption is stated. A bookkeeping firm runs about eight invoices in a normal week. Its approved monthly volume equals roughly four normal weeks. Its approved maximum ticket is four times its average invoice, which works out to half a normal week. Nearly all of its sales are keyed.
In the first week of January, the firm runs its normal invoices plus three annual retainers. The largest retainer is worth about 1.8 normal weeks, and the other two are worth about 0.8 weeks each. Added together, the week comes to about 4.4 normal weeks of volume. That's more than the firm's entire approved month, landing in five days. The largest retainer is more than three times the approved maximum ticket (1.8 divided by 0.5 is 3.6), and every sale is card-not-present.
Stolen cards keyed into a virtual terminal produce exactly this profile. So the firm's reply has to prove the retainers came from returning clients who agreed to pay. Signed engagement letters do most of that work. Invoices whose client names match the cardholders help, and last year's invoices for the same clients show the pattern is annual. Add the signed card authorization forms and the analyst has nothing left to guess about.
When a Payment Processor Is Requesting Documents: What to Send
The request is usually specific. Send what it names, in the format it asks for.
| Request | What it proves | What to send | What to avoid |
|---|---|---|---|
| Invoices for specific transactions | The sale happened and matches the charge | Invoices showing the date, customer name and an amount that matches the transaction | Invoices created after the request with no history behind them |
| Recent business bank statements | Revenue and deposits are consistent | Full statements as downloaded from your bank | Cropped pages or edited spreadsheets |
| Proof of delivery or shipping tracking | Customers received what they paid for | Carrier tracking numbers matched to order numbers | Tracking for unrelated orders |
| Supplier invoices | You have real inventory to fulfill sales | Recent paid invoices from your wholesalers | Quotes or price lists |
| Contracts or authorization forms | Large or keyed sales were authorized | Signed contracts or card authorization forms | Unsigned drafts |
| Processing statements from another provider | Your history elsewhere | Recent complete statements | Partial statements |
| Business license and owner ID | Who you are | Current documents matching the legal name on file | Expired documents or a different legal name |
| Website screenshots | What you sell now | Current captures of product pages and your refund policy | Captures from before a change |
When the processor is asking for invoices on a list of transactions, name each file with the transaction date and amount. An analyst who can match ten files to ten charges in two minutes closes the file faster.
How to Respond to a Merchant Account Under Review
Verify the email first. Fake "account review" emails are a common phishing tactic. Don't click the email's links. Log in to your merchant portal directly, or call the support number printed on your merchant statement, and confirm the request is real.
Acknowledge it the same day. Many requests give a short window. A one-line reply confirming you received it and saying when you'll send the documents shows you're engaged. If you need more time, ask before the deadline passes.
Keep it short and factual. Explain what changed in plain sentences and attach the documents. Leave out frustration and lectures about how long you've been a customer. The analyst didn't set the rules and can't waive them.
A reply can be this simple:
Hi, thanks for reaching out about the transactions from the first week of January. These are annual retainer payments from three existing bookkeeping clients: [client names]. For each client, I've attached the signed engagement letter and card authorization form. You'll also find this year's invoice, labeled by date and amount, next to last year's invoice for the same retainer. We collect retainers each January, so you'll see a similar pattern next year. Please let me know if you need anything else.
The template works because it names the customers and explains why the pattern happened. It also says the pattern will recur, which tells the analyst what to expect next year. If you expect your new level to continue, say so and ask to update your approved volume and ticket limits in the same message.
Mistakes That Turn a Review Into a Hold or Reserve
Merchant agreements typically let the processor pause funding or hold a reserve (a portion of your deposits kept back to cover future chargebacks). Most also allow it to close the account. Read those sections of your agreement now, before you need them. These behaviors are the ones most likely to push a review toward those outcomes:
- Silence. An unanswered request often turns into a funding hold, because the bank has no other way to limit its exposure.
- Documents that don't match. Invoice amounts that differ from the charges raise doubt, as do customer names that don't match the cardholders. Bank deposits that don't line up with your processing do the same.
- Fabricated paperwork. Creating invoices or tracking after the fact is fraud, and analysts check details like carrier tracking numbers.
- Splitting large sales. Breaking one sale into several smaller charges to stay under your ticket limit can violate card network rules, and the pattern is easy to spot.
- Moving volume elsewhere mid-review. Shifting sales to another account to avoid scrutiny looks like evasion. A termination for cause can also put your business on an industry database of terminated merchants, which other acquirers check when you apply for a new account. Our explainer on how merchants land on industry termination lists covers what that means.
- Undisclosed business changes. A review that uncovers a product line nobody was told about raises bigger questions than the original flag.
How to Make the Next Periodic Review Boring
The cheapest review is the one that never fires. Tell your processor before you change what you sell or how you sell it, and before any change in ownership or deposit account. Our guide on when to tell your payment processor about business changes lists what to report. Before a known spike like the holiday rush or retainer month, ask for a temporary or permanent limit increase in writing.
Keep your website consistent with your application. A visible refund policy matters here; see the refund policy requirements payment processors expect. Product descriptions should reflect what you actually ship. Use a billing descriptor customers recognize so you aren't fielding avoidable disputes.
Finally, keep a running folder of invoices and signed authorizations for large or keyed sales, with supplier receipts alongside. When the next request arrives, answering it takes an hour instead of a weekend.
When to Escalate or Line up a Backup Processor
Escalate when a review stalls past its stated timeline or when funding is paused with no clear reason. Ask your account representative for the specific concern and who makes the decision. Your ISO or sales rep can often push a file forward with the bank's risk team. Get it in writing: what would release a hold or end a reserve, and on what schedule.
A second processing account is a reasonable safeguard for any business whose cash flow depends on card sales. Set it up honestly. Disclose past holds and reserves on the application, and use the account as a backup rather than a way to hide volume from the first processor. If you're weighing a direct merchant account against an aggregator, our comparison of merchant accounts vs. payment aggregators explains how each handles risk.
If this review has you questioning your setup, MannyPay supports low-risk e-commerce merchants as well as in-person sellers through its retail payment solutions. You can request a free processing quote, and a MannyPay specialist will respond within one business day.
Whichever processor you use, the most useful step this week is the same. Pull the approved volume and ticket limits from your application, compare them with what you actually process today, and ask your provider to update them before the gap triggers the next email.
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
