Sovereign Nations. Different Laws. One Complicated Payments System.
Sovereign Nations. Different Laws. One Complicated Payments System. On Indigenous Peoples' Day, it's time to examine why tribal gaming, ...
For more than forty years, merchant underwriting has relied on a simple assumption:
| If you know what type of business someone operates, you know the risks associated with that merchant. |
That assumption was once reasonable.
Today, it's becoming one of the biggest blind spots in payments.
The reality is that businesses no longer fit neatly into a single industry classification. Modern merchants sell across categories, diversify revenue streams, and introduce new products faster than banks, processors, and regulators can update their policies.
Yet most underwriting decisions still begin—and often end—with a four-digit Merchant Category Code (MCC).
The result?
Banks and payment processors are making risk decisions based on what a merchant says they are, instead of what they actually sell.
It's time to rethink underwriting.
Merchant Category Codes were created to classify businesses for payment processing—not to identify compliance risk.
An MCC tells us the primary business type.
It does not tell us:
In today's commerce environment, those questions matter far more than the merchant's industry classification.
Consider these real-world examples:
Restaurant
MCC: Restaurant
Traditional underwriting assumes the merchant serves food.
But today many restaurants also sell:
To the payment processor, this merchant appears to be a restaurant.
In reality, they may also require enhanced due diligence, product verification, age restrictions, marketing review, and ongoing monitoring.
The MCC never reveals this.
Medical Practice
MCC: Physician or Medical Services
The underwriting file appears extremely low risk.
But during a website review, the practice is found selling:
Now the merchant has become both a healthcare provider and an online retailer selling regulated products.
The MCC still identifies only a medical practice.
Beauty Supply Store
MCC: Cosmetic or Beauty Supply
Seems straightforward.
Until product analysis identifies:
Each product introduces additional regulatory considerations.
The industry classification never changes.
The risk profile does.
Wellness Clinic
MCC: Medical Services or Health Practitioner
The merchant begins offering:
This is no longer simply a healthcare provider.
It's a complex, regulated commerce operation.
Yet underwriting continues treating it as a traditional clinic.
Smoke Shop
MCC: Tobacco Store
This category alone tells us almost nothing.
Today's smoke shops may sell:
Each product category carries different regulatory expectations.
Some may be permitted.
Others may violate processor policy.
The MCC treats them all the same.
Liquor Store
MCC: Package Liquor Store
But many now carry:
Again, the merchant's actual product catalog has evolved while the MCC remains unchanged.
These aren't isolated examples.
They're becoming the norm.
Businesses continually expand product offerings because consumers demand convenience.
One merchant can simultaneously operate:
Industry classification simply cannot keep pace.
When underwriting relies primarily on MCC codes, organizations expose themselves to significant operational and compliance risk.
Misclassified merchants
Higher-risk products remain undiscovered.
Incorrect policy application
Merchants bypass required enhanced due diligence.
Missed regulatory obligations
Required documentation may never be collected.
Increased audit findings
Banks struggle to demonstrate why merchants were approved.
Portfolio contamination
High-risk products quietly enter low-risk portfolios.
Expensive remediation
Issues surface months later during monitoring, audits, or chargeback investigations—when remediation is far more costly than identifying them during onboarding.
It's Product-First.
Imagine a different underwriting workflow.
Instead of asking:
| "What industry is this merchant in?" |
Ask:
| "What products and services does this business actually sell?" |
That simple shift changes everything.
Now underwriting can identify:
Only after understanding the products should underwriting determine the merchant's true risk profile.
Merchant risk doesn't stop after onboarding.
Businesses add products every day.
They launch new marketing campaigns.
They expand into new states.
They begin selling products that weren't present during underwriting.
Traditional annual reviews cannot keep up.
Continuous product monitoring becomes essential.
The organizations that can automatically identify meaningful changes—and surface only the new findings—will dramatically reduce manual review while improving oversight.
The payments industry doesn't need another AI assistant that automates document collection or summarizes underwriting notes.
It needs a fundamentally better source of intelligence.
The future of underwriting will be built on:
Industry codes will still have value for reporting, interchange, and operational categorization.
But they should no longer serve as the foundation for underwriting decisions.
That era is coming to an end.
For decades, the industry has asked merchants one question:
"What kind of business are you?"
The better question is:
"What exactly do you sell—and how are you selling it?"
That answer provides far more insight into risk than any four-digit MCC ever could.
The financial institutions that embrace product-first underwriting will onboard merchants faster, reduce compliance costs, improve audit readiness, and gain a far more accurate understanding of portfolio risk.
Those that continue relying primarily on MCC codes may find themselves making tomorrow's risk decisions with yesterday's assumptions.
Qredible is redefining merchant underwriting through Merchant Risk Intelligence (MRI)—a product-first approach that continuously analyzes what businesses sell, how they market those products, and the evidence required to support compliant payment acceptance. By moving beyond static industry classifications, Qredible helps banks, payment processors, ISOs, and sponsor banks make faster, more informed, and more defensible underwriting decisions while reducing manual effort and strengthening ongoing portfolio oversight. Learn more about Qredible's product-first automated compliance management platform for regulated industries →
