Managing Merchant Credit Risk: Strategies for Payment Companies

Merchant credit risk is the financial exposure payment companies face when a merchant collects payment but can't deliver what customers paid for. When that merchant closes, files for bankruptcy, or simply disappears, the acquirer, ISO, or payfac—not the merchant—absorbs the chargebacks and refunds.

This guide covers how to assess merchant credit risk during underwriting, the warning signs of deterioration, and practical strategies to mitigate exposure across your portfolio.

What is merchant credit risk

Merchant credit risk is the financial exposure a payment company takes on when a merchant collects payment but fails to deliver the promised goods or services. When that happens, customers file chargebacks, and the acquirer, ISO, or payfac—not the merchant—ends up covering the loss.

The core issue is timing. Customers pay now, but merchants deliver later. That gap creates exposure. A gym sells annual memberships in January, then closes in March. A travel agency collects deposits for summer trips, then files for bankruptcy in May. In both cases, the payment company is left holding the bag for refunds the merchant can't process.

This differs from consumer credit risk, where a lender evaluates whether someone can repay a loan. With merchant credit risk, the payment company isn't lending money directly. Instead, it's exposed to loss if the merchant can't fulfill what customers already paid for.

How merchant credit risk differs from fraud and transaction risk

Payment companies face several types of risk, and they often get lumped together. But fraud risk, transaction risk, and credit risk require different detection methods and different responses.

Fraud risk involves intentional deception. Someone impersonates a legitimate business, creates a fake identity, or processes transactions for products they never plan to ship. Credit risk, by contrast, often involves real businesses that simply run out of money. The merchant wasn't trying to steal—they just couldn't survive.

Transaction risk focuses on anomalies at the payment level: unusual velocity, mismatched billing addresses, or suspicious card behavior. Credit risk looks at the merchant's viability over time, not individual payment patterns.

A merchant can pass every fraud check and process perfectly clean transactions while still representing significant credit risk. The two problems are related but distinct.

Sources of merchant credit exposure in payments

Credit exposure originates in the gap between when a transaction is authorized and when the merchant actually delivers. The longer that gap, the greater the exposure.

• Delayed delivery models: Merchants who collect payment weeks or months before shipping create extended liability windows. Custom furniture, event tickets, and travel bookings all fall into this category.
• Subscription and recurring billing: Annual prepaid plans extend liability across twelve months. If the merchant fails in month three, nine months of service remain unfulfilled.
• Refund and chargeback liability: When merchants can't process refunds themselves, the acquirer or payfac absorbs the cost.
• Reserve shortfalls: Sometimes the reserves held against a merchant don't cover the actual exposure, leaving payment companies with unrecoverable losses.

Types of merchant credit risk

Merchant default risk

Default risk is the most direct form of credit risk: the possibility that a merchant stops operating or can't meet its financial obligations.

Example: A travel agency collects $500,000 in deposits for summer vacation packages, then files for bankruptcy in spring. The payment facilitator faces chargebacks for every unfulfilled booking, and the merchant has no funds to cover them.

Concentration risk

Concentration risk emerges when a portfolio depends too heavily on one merchant, one industry, or one geography. A single failure can create outsized losses relative to the overall portfolio.

Example: A payfac generates 40% of its processing volume from one large merchant. If that merchant defaults, the payfac's entire quarterly margin could disappear.

Industry and country risk

Certain industries carry inherent credit risk because of how their business models work. Travel, events, and advance-payment services consistently appear in high-risk categories due to extended fulfillment timelines. Geographic factors matter too—regulatory environments and economic conditions vary by country.

Chargeback and refund liability

When merchants can't cover chargebacks or refunds, the liability flows upstream to the payment company. This is where credit risk becomes a realized loss rather than a theoretical exposure.With Mastercard estimating 286 million chargebacks globally for 2026, this is where credit risk becomes a realized loss rather than a theoretical exposure.

How to assess merchant credit risk during underwriting

Underwriting is the first opportunity to evaluate credit exposure. The goal isn't to reject every risky merchant—it's to price and structure the relationship appropriately based on the actual risk involved.

Financial health and capacity

Capacity measures whether a business generates enough revenue to cover its commitments. Bank statements, processing history, and cash flow indicators all help paint this picture.

Look for consistent cash flow, adequate working capital, and a processing history that matches what the merchant claims about their business. A merchant saying they process $50,000 monthly but showing bank deposits of $5,000 raises questions.

Business model and revenue stability

Delivery timelines and refund policies directly affect credit exposure. A merchant selling digital downloads has a very different risk profile than one selling custom furniture with 12-week lead times.

Business models with long fulfillment windows or high advance-payment ratios create extended exposure. That doesn't mean declining those merchants—it means structuring the relationship with appropriate controls.

Industry and MCC risk

Merchant Category Codes (MCCs) provide a baseline risk categorization. Travel agencies (MCC 4722), event ticketing (7922), and membership clubs (7997) carry structural credit exposure because of how their business models work. — travel and hospitality alone records the highest average chargeback value at $120.

MCC alone doesn't determine whether to approve a merchant, but it does inform reserve requirements and monitoring intensity.

Chargeback and processing history

Historical chargeback ratios, dispute patterns, and prior processor relationships reveal a lot about credit risk. Elevated chargebacks often precede credit events, serving as an early warning signal.

A merchant with a clean chargeback history at their previous processor represents different risk than one who was terminated for excessive disputes—even if their current application looks identical.

Ownership and character verification

Verifying principals and checking for prior business failures, litigation, or regulatory actions is part of standard KYB (Know Your Business) due diligence. This step is particularly relevant for credit risk assessment.

A principal with two prior business bankruptcies represents different risk than a first-time entrepreneur, even if the current business appears healthy on paper.

Warning signs of merchant credit deterioration

Credit risk is dynamic. A merchant who looked solid at onboarding can deteriorate over time, which is why ongoing monitoring matters as much as initial underwriting.

Sudden volume or ticket size changes

Rapid increases in processing volume or unusual transaction patterns can signal distress. Some merchants engage in what's called "terminal behavior"—processing as much volume as possible before closing.

A 300% volume spike in a merchant that's been stable for two years warrants investigation, even if the transactions themselves look normal.

Rising chargeback and refund rates

Increasing disputes often indicate fulfillment problems or customer dissatisfaction. These patterns frequently precede default.

Watch for trends, not just threshold breaches. A merchant whose chargeback rate climbs from 0.3% to 0.7% over three months is showing deterioration even if they haven't hit a violation threshold yet.

Business closures and litigation filings

External signals like bankruptcy filings, lawsuits, or business registration changes often become public before a merchant stops processing. These signals are available but require aggregation to be actionableAccording to the Administrative Office of the U.S. Courts, business filings rose 16.9% year-over-year through mid-2026 — these signals are available but require aggregation to be actionable.

Negative reviews and website changes

Sentiment shifts, website downtime, or removal of contact information can indicate operational distress. A merchant who suddenly removes their phone number and address from their website may be preparing to close.

Strategies to mitigate merchant credit risk

1. Set dynamic reserves and exposure limits

Reserves are the primary protection against credit losses. Reserve requirements vary based on risk profile, delivery timelines, and processing volume—and they can be adjusted as risk signals change.

A merchant with 60-day fulfillment windows warrants higher reserves than one with same-day delivery, even if their chargeback rates are identical.

2. Apply delayed settlement for high-risk merchants

Holding funds until fulfillment milestones are met reduces exposure. This approach is particularly effective for merchants with long delivery timelines or limited operating history.

3. Monitor the portfolio continuously

Point-in-time underwriting captures risk at a single moment. Ongoing monitoring surfaces deterioration before losses occur.

Platforms like Coris aggregate external signals, processing data, and website monitoring to provide continuous visibility into merchant health without requiring manual research for every account.

4. Automate alert triage and case resolution

Manual review doesn't scale. Automated workflows can route alerts to analysts based on severity, or resolve routine cases without human intervention.

The goal is focusing analyst time on complex cases while ensuring nothing falls through the cracks.

5. Reassess risk on a recurring cadence

Periodic re-underwriting based on risk tier keeps assessments current. High-risk merchants might warrant monthly review, while lower-risk accounts can be reassessed annually.

Operationalizing merchant credit risk management at scale

Risk policies only matter if they become repeatable workflows. The challenge for growing payment companies is moving from spreadsheets and manual research to automated infrastructure.

• Centralized merchant intelligence: Aggregate external signals, processing data, and internal metadata in one view rather than scattered across systems
• Configurable workflows: Build rules and routing logic that match your risk policies without custom development
• AI-driven automation: Deploy agents to handle routine research and decisioning while analysts focus on complex cases
• Audit trails: Maintain documentation for every decision to support compliance and dispute resolution

Tip: Start by automating your highest-volume, lowest-complexity decisions. This frees analyst capacity for the cases that actually require judgment.

Build a modern merchant credit risk program with Coris

Coris provides the infrastructure to operationalize merchant credit risk management. Merchant Intelligence centralizes external signals and risk scoring for underwriting and ongoing monitoring. The Risk Platform turns policies into automated workflows. And AI Agents handle routine research and decisioning, so teams scale without scaling headcount.

See how Coris helps payment companies manage merchant credit risk →

Frequently asked questions about merchant credit risk

What is the difference between merchant risk and merchant credit risk?

Merchant risk is a broad category covering fraud, compliance, and credit exposure. Merchant credit risk specifically refers to the financial liability when merchants cannot fulfill obligations after payment is collected.

Which MCC codes are considered high credit risk?

Industries with delayed fulfillment or advance payments carry higher credit risk. Common examples include travel agencies (4722), event ticketing (7922), membership services (7997), and furniture or appliance retailers with extended delivery timelines.

How much should a payment company hold in merchant reserves?

Reserve amounts depend on merchant risk profile, average transaction value, and delivery timelines. Higher-risk merchants with longer fulfillment windows typically require larger reserves—often calculated as a percentage of monthly volume.

How often should merchant credit risk be reassessed?

Risk can be monitored continuously through automated systems. Formal re-underwriting typically occurs monthly or quarterly for high-risk merchants, and annually for lower-risk accounts.