PayFac vs. ISO Underwriting: Why One Onboarding Flow Doesn't Fit Both

A PayFac approves a sub-merchant in minutes and owns every dollar of risk on that decision. An ISO refers the same kind of merchant to a processor and never actually touches the underwriting file at all.

Run both of those merchants through the same generic onboarding form, and the cracks show up fast. This is where a PayFac vs ISO underwriting comparison actually matters, and why one onboarding flow rarely fits both.

Two Models, Two Liability Structures

A payment facilitator takes on the underwriting responsibility for every sub-merchant it boards, along with the risk that comes with it. If a sub-merchant turns out to be fraudulent or racks up chargebacks it cannot cover, that liability sits with the PayFac.

An ISO works differently. It refers a merchant to a processor, and the processor conducts its own due diligence and carries the risk. The ISO's role stops at the referral, which is also why an ISO typically has no underwriting process of its own to configure.

Why Underwriting Depth Differs Between the Two

Because a PayFac may be liable for the full risk on a sub-merchant's processing activity, its underwriting has to be thorough even when it happens quickly. Speed and depth are not a tradeoff for a PayFac; both are required at once.

For an ISO-referred merchant, the processor's due diligence is the underwriting step, and it usually takes several days because the processor is completing its own full review before approval. The ISO is not shortcutting anything: it simply is not the party running that review.

Where a Single Onboarding Flow Breaks

A generic onboarding form built for ISO-referred merchants will not ask the questions a PayFac needs answered to own that risk directly. Push PayFac-depth requirements onto every ISO-referred merchant instead, and applicants face friction that was never necessary for that channel.

Timelines diverge just as much. PayFac onboarding can run in minutes or hours once underwriting is built into the flow, while ISO-referred merchants are still looking at several days because a separate processor has to complete its own review before an account goes live.

Configuring Underwriting Rules by Channel

Gratify's Underwriting lets a portfolio set distinct rule sets and application templates by channel, so PayFac-style sub-merchants and ISO-referred merchants are not forced through the same generic path.

A PayFac-configured template can apply the full underwriting depth that liability requires, while an ISO-configured template reflects what actually needs to happen on that side of the business, without either one borrowing rules built for the other.

See how ISO-configurable rules and templates would apply to your own portfolio. Book a demo of Gratify's Underwriting.

Frequently Asked Questions

What is the main difference between a PayFac and an ISO?

A PayFac underwrites and boards sub-merchants directly and carries the risk for those accounts. An ISO refers merchants to a processor, and the processor handles underwriting and carries the associated risk instead.

Why does PayFac underwriting need to be so thorough if it happens quickly?

A PayFac can be liable for the full risk of a sub-merchant's processing activity, so a fast approval still has to be a well-vetted one. Speed comes from automation in the review process, not from skipping steps.

Why does ISO-referred onboarding usually take longer than PayFac onboarding?

An ISO-referred merchant's underwriting is handled by the processor, which typically completes its own full due diligence process before approval. That review can take several days, compared to the minutes or hours a PayFac's automated underwriting can take.

Can one onboarding platform support both PayFac and ISO underwriting models?

Yes, if the platform allows different rule sets and application templates for each channel. Trying to run both models through one generic form usually adds friction for one side or reduces underwriting depth for the other.

Does an ISO need its own underwriting rules at all?

An ISO's role generally ends at the referral, since the processor conducts underwriting and carries the risk. Even so, an ISO-specific application template can still be configured to route information cleanly to the processor without adding PayFac-level requirements that do not apply.