Sovereign Nations. Different Laws. One Complicated Payments System.
Sovereign Nations. Different Laws. One Complicated Payments System. On Indigenous Peoples' Day, it's time to examine why tribal gaming, ...
| "High risk should be the conclusion of a risk assessment—not the starting assumption based on an industry label." - Noah Fitzgerald, CPP, CRO Qredible, Inc. |
After 30+ Years in Payments, I Think We Need to Have an Uncomfortable Conversation About “High Risk”
I've spent more than three decades in payments.
During that time, I've watched our industry become extraordinarily sophisticated.
We can authorize transactions globally in seconds.
We can identify fraud patterns using artificial intelligence.
We can authenticate consumers biometrically.
We can tokenize credentials, analyze billions of transactions, and make complex credit decisions almost instantly.
Yet ask a surprisingly simple question—
What makes a merchant “high risk”?
—and the answer can still sound remarkably similar to what it did twenty years ago.
CBD?
High risk.
Vape?
High risk.
Tobacco?
High risk.
Firearms?
High risk.
Travel?
High risk.
Dating?
High risk.
Nutraceuticals?
High risk.
Sometimes that classification is justified.
But increasingly, I believe we are confusing industry classification with actual risk.
And modern commerce is exposing the flaws in that model.
Before calling a business high risk, perhaps we should first define what risk we're talking about.
At a foundational level, I believe merchant risk can be viewed through three major dimensions:
Financial Risk
What is the likelihood that the merchant creates financial loss?
That may include:
Compliance Risk
What regulatory, legal, card-brand, sponsor-bank, or institutional-policy exposure exists?
That may include:
Reputational Risk
What potential exists for the relationship to create reputational harm?
That can include:
These risks can overlap.
But they are not interchangeable.
And that distinction matters.
Consider a real-world scenario we recently encountered.
A smoke shop has been operating for approximately seven years.
It sells vape, tobacco, CBD, and legal hemp products through a physical retail location and online.
Annual processing volume is roughly $500,000.
Its chargeback ratio is below 0.01%.
The business is established.
Its products are legal, although several are regulated.
Yet many mainstream processors will simply decline the merchant.
Why?
“High risk.”
Others will accept it but may impose higher processing costs, reserve requirements, volume limitations, enhanced underwriting, and additional monitoring.
Again, why?
“High risk.”
But let's separate the components.
Is its historical financial risk unusually high?
Its chargeback history would suggest otherwise.
Is it necessarily a major reputational threat?
Not inherently.
Does it have elevated compliance requirements?
Absolutely.
CBD, hemp, tobacco, and vape products can require additional policy controls, documentation, product review, monitoring, and regulatory awareness.
So perhaps the more accurate statement isn't:
“This is a high-risk merchant.”
Perhaps it is:
“This merchant presents elevated product-compliance risk requiring enhanced controls.”
Those statements may sound similar.
Operationally, they are profoundly different.
This is where things become interesting.
Imagine a large event company operating live events across the United States.
It sells:
Tickets.
Merchandise.
Food.
Venue concessions.
Beverages.
Annual payment volume exceeds $1 billion.
Embedded within those concession sales are hemp-infused adult beverages.
Annual sales of those products alone are approximately $20 million.
The payment provider is a mainstream PSP whose policy generally does not support merchants primarily engaged in CBD or hemp commerce.
Yet this merchant isn't categorized as a high-risk hemp merchant.
Why?
Because hemp represents less than 5% of its overall sales.
Think about that for a moment.
Take the two examples.
Merchant A
$500,000 annual volume.
CBD, hemp, tobacco and vape are core products.
Established seven years.
Chargebacks below 0.01%.
Classified as high risk.
Merchant B
More than $1 billion annual volume.
Approximately $20 million in hemp-product sales.
Hemp represents a small percentage of overall volume.
Not classified as a high-risk hemp merchant.
Now ask a very simple question:
Did the regulatory requirements applicable to the hemp product disappear because the company selling it happens to be larger?
Of course not.
If a product requires particular controls, those requirements attach to the relevant product and activity—not to whether the product represents 4%, 40%, or 100% of the merchant's overall revenue.
The percentage may absolutely matter to the institution's overall risk assessment.
But it does not make the underlying product-compliance question disappear.
And that exposes an important flaw in the traditional model.
Imagine two boxes.
One contains nothing but regulated products.
We put a large red sticker on it:
HIGH RISK.
The other contains 1,000 products, 40 of which are the exact same regulated products.
We label the box:
GENERAL RETAIL.
Did the products become less regulated because we put them in a larger box?
No.
But that's effectively what can happen when merchant-level classifications become substitutes for product-level understanding.
We assess the container.
Increasingly, we also need to understand the contents.
The problem becomes even more obvious when regulated products enter mainstream commerce.
Suppose a restaurant begins selling hemp-derived beverages.
Is it now a high-risk hemp merchant?
Probably not under many traditional classification models.
It's still a restaurant.
What about:
A bar?
A golf course?
A hotel?
A liquor store?
A convenience store?
A grocery store?
A music venue?
A stadium?
A major national retailer?
What happens when each begins selling regulated hemp-derived beverages?
The MCC may remain unchanged.
The business description may remain unchanged.
The underwriting classification may remain unchanged.
But a regulated product has entered the commerce environment.
This is exactly where category-based risk models begin to struggle.
Twenty years ago, businesses were considerably easier to classify.
A tobacco shop sold tobacco.
A liquor store sold alcohol.
A pharmacy sold pharmaceuticals.
A restaurant sold food.
A health store sold vitamins.
Today's merchant may sell:
Supplements.
CBD.
Functional mushrooms.
Nootropics.
Hemp beverages.
Cosmetics.
Subscriptions.
Telehealth services.
Digital products.
All through the same website.
And tomorrow it can add another category in minutes.
Commerce has become multi-category, omnichannel, dynamic, and product-driven.
Yet much of merchant risk management remains:
Business → MCC → Industry → Risk Category.
That hierarchy is increasingly insufficient.
There is a practical reason this happened.
Precision is expensive.
If a financial institution cannot efficiently determine which products a merchant sells, which rules apply, whether the appropriate evidence exists, and whether those products remain compliant, it has to manage the uncertainty somehow.
The easiest solution is often:
Restrict the category.
That isn't necessarily irrational.
If an institution lacks the infrastructure or expertise to manage a particular risk, avoiding that risk may be entirely appropriate.
But we should call it what it is.
Sometimes “high risk” doesn't mean:
“This merchant presents objectively extreme risk.”
Sometimes it means:
“This merchant requires a level of understanding and oversight our current operating model isn't designed to provide economically.”
That is a very different statement.
And it creates a very different opportunity.
Return to our $500,000 smoke-shop merchant.
One reason it can face higher pricing is straightforward.
The processor may need:
More underwriting.
More product review.
More documentation.
More monitoring.
More compliance personnel.
More sponsor-bank oversight.
Those activities cost money.
So the merchant pays more.
But that raises an interesting question:
Is the merchant financially riskier—or simply more expensive to understand and manage?
Those are not necessarily the same thing.
If technology materially reduces the cost of product-level compliance management, shouldn't that eventually affect the economics of supporting the merchant?
I believe it should.
This is where Product Intelligence™ becomes much more than a compliance concept.
Imagine that instead of manually reviewing a regulated merchant, the institution maintains structured intelligence about:
Now the cost of understanding the merchant can begin to fall.
Monitoring becomes more precise.
Auditing becomes faster.
Regulatory changes become easier to assess.
Remediation becomes more targeted.
That can change the economics.
And when the economics change, our traditional assumptions about “high risk” may change with them.
Instead of one label—
HIGH RISK
—I believe the industry should increasingly think in terms of a multidimensional risk profile.
A merchant might look like this:
Financial Risk: Low
Compliance Risk: Elevated
Reputational Risk: Moderate
Another might be:
Financial Risk: High
Compliance Risk: Low
Reputational Risk: Low
Another:
Financial Risk: Low
Compliance Risk: Low
Reputational Risk: High
These are three very different merchants.
Calling all three “high risk” destroys useful information.
More importantly, each requires completely different controls.
This is the natural next step.
If the problem is financial risk, use financial controls.
That might include:
If the problem is compliance risk, use compliance controls.
That might include:
If the problem is reputational risk, apply controls appropriate to reputation.
That may involve:
The control should address the actual risk.
Not simply punish the merchant for belonging to a category.
Our previous article argued that payment companies need to audit their regulated merchant portfolios and build product-level intelligence.
This is why.
If regulated products are increasingly sold inside mainstream businesses, then identifying risk by MCC or merchant category alone will miss exposure.
The future hierarchy needs to look more like:
Portfolio
↓
Merchant
↓
Channel
↓
Product
↓
Ingredient / Compound / Attribute
↓
Evidence
↓
Regulation
↓
Policy
↓
Risk
Now risk is the output of intelligence.
Not an assumption made at the beginning.
That distinction is fundamental.
Let's return to the billion-dollar events company.
Does the fact that hemp products represent less than 5% of sales matter?
Absolutely.
It may materially affect the institution's overall financial exposure, business characterization, underwriting treatment, and risk assessment.
But should it make product-level compliance disappear?
No.
Those are two different questions.
Merchant concentration is a risk variable.
Product compliance is a compliance obligation.
We shouldn't confuse them.
A small percentage of a very large merchant can also represent enormous absolute commerce.
In this example, that “small” category represents approximately $20 million annually.
That isn't immaterial commerce.
It is simply hidden inside a much larger merchant.
This is perhaps the most counterintuitive implication.
A processor probably knows that its dedicated CBD merchants require additional oversight.
They're flagged.
They're categorized.
They're monitored.
Everyone knows where they are.
But what about the:
Restaurants?
Bars?
Golf courses?
Hotels?
Event companies?
Convenience stores?
General retailers?
Online marketplaces?
They may sell the same regulated products without carrying the category label that triggers enhanced controls.
So which portfolio is actually easier to manage?
The merchant you know requires additional attention?
Or the merchant whose product exposure you cannot see?
Unknown risk is often harder to manage than known risk.
There was a time when organizations could reasonably argue that identifying every individual product across a large merchant portfolio was operationally unrealistic.
Technology has changed that conversation.
Web crawling.
Artificial intelligence.
Large language models.
Machine learning.
Document intelligence.
Product databases.
Automated classification.
Continuous monitoring.
Modern technology increasingly makes product-level visibility achievable at a scale that wasn't economically practical years ago.
That changes expectations.
Banks, card brands, regulators, auditors, and sponsor institutions will increasingly ask not simply:
“Did you classify the merchant?”
but:
“What did you know about what the merchant was actually selling?”
And perhaps more importantly:
“What could you reasonably have known?”
The gap between those questions is shrinking.
Ask better questions.
What specifically creates the risk?
Is it financial?
Compliance?
Reputational?
Which product creates it?
Which merchant activity creates it?
How significant is the exposure?
What evidence exists?
What control mitigates it?
Can the risk be managed economically?
Does the merchant fit our institution's risk appetite after those controls are applied?
Now we're no longer categorizing.
We're underwriting.
There is a commercial implication here that shouldn't be ignored.
Broad category restrictions undoubtedly protect institutions from risks they don't want or cannot manage.
But they can also eliminate perfectly viable merchants.
If intelligence allows an organization to distinguish:
Good merchant / manageable product risk
from
Bad merchant / unacceptable product risk
then risk management stops being solely defensive.
It becomes an enabler of selective growth.
Processors may be able to:
That doesn't mean accepting more risk.
It means making more money from the risk you're actually willing to accept because you understand it better.
If we were designing merchant acceptance from scratch today, I don't believe we would create a single bucket called “high risk.”
We would create an intelligence model.
We would evaluate:
Who is the merchant?
What do they sell?
How do they sell it?
Where do they sell it?
What financial exposure exists?
What compliance obligations apply?
What reputational exposure exists?
What evidence supports the business?
What controls mitigate the identified risks?
Does the remaining risk fit our appetite?
Then we would make a decision.
That's risk management.
Everything else is categorization.
I've watched the payments industry reinvent itself repeatedly.
And one lesson has remained consistent:
Legacy concepts survive long after the assumptions behind them have changed.
“High risk” is one of those concepts.
The term isn't useless.
Some merchants absolutely present substantially greater risk than others.
But using it as a broad industry label is increasingly inadequate for modern commerce.
The future requires us to move from:
Industry Risk
to
Merchant Risk
to
Product Risk
to
Specific Risk Factors
to
Appropriate Controls
to
Residual Risk
That is a much more sophisticated model.
It is also much closer to how commerce actually operates.
And one question deserves serious consideration:
The payments industry does not need to eliminate the concept of high risk.
It needs to stop treating high risk as a category.
Risk should be measured.
Risk should be explained.
Risk should be decomposed.
Risk should be controlled.
And risk should ultimately be understood.
A seven-year-old merchant with virtually no chargebacks does not suddenly become financially dangerous because it sells a regulated product.
A billion-dollar company does not suddenly eliminate product-compliance obligations because regulated products represent a small percentage of its revenue.
The product doesn't know the merchant's MCC.
The regulation doesn't care how we categorized the business.
And increasingly, neither will the institutions responsible for overseeing the commerce.
Modern risk management requires us to understand what creates the risk, where it exists, how significant it is, and whether it can be controlled.
That requires something the legacy “high-risk” model was never designed to provide:
Precision.
And precision requires intelligence.
The future isn't High Risk vs. Low Risk.
It's Known Risk vs. Unknown Risk.
And in the next generation of commerce, the institutions with the greatest advantage will be the ones that know the difference.
Qredible is redefining merchant underwriting through Merchant Risk Intelligence (MRI)—a product-first approach that continuously analyzes what businesses sell, how they market those products, and the evidence required to support compliant payment acceptance. By moving beyond static industry classifications, Qredible helps banks, payment processors, ISOs, and sponsor banks make faster, more informed, and more defensible underwriting decisions while reducing manual effort and strengthening ongoing portfolio oversight. Learn more about Qredible's product-first automated compliance management platform for regulated industries →
