The Next Major Shift in Payment Risk Won’t Be Transaction Intelligence. It Will Be Product Intelligence.

Banks and Processors Still Monitor Transactions, Chargebacks and Merchants. The Next Risk Layer Is Understanding What Their Merchants Are Actually Selling.

For decades, payment risk has largely been managed from the transaction backward.

Banks and processors monitor chargebacks. Fraud ratios. Refunds. transaction patterns. MCCs. MATCH records. financial exposure. complaints. velocity. authorization behavior.

When those indicators move outside acceptable parameters, someone investigates.

That model made sense when commerce was simpler, merchant businesses changed slowly, product catalogs were relatively stable, and most underwriting was performed against businesses that could be
reasonably understood from an application, a website review and a handful of documents.

That isn't modern commerce.

A merchant can launch hundreds of products overnight. A supplement company can introduce a new formulation tomorrow. A peptide merchant can move from research-use-only positioning toward apparent human-use claims without changing its legal entity. A hemp retailer can add products that fall outside policy. A marketplace seller can introduce an entirely new regulated category. A merchant can change manufacturers, ingredients, claims, fulfillment models, websites or sales channels without changing anything that would necessarily trigger conventional KYC or transaction monitoring.

And yet much of the payment industry is still trying to understand this environment using:

KYC + KYB + MCC + Website Review + Transaction Monitoring + Chargebacks.

Those controls remain important.

But there is a massive intelligence layer missing between who the merchant is and what eventually happens in the payment stream.

What is the merchant actually selling?

That may become one of the most important risk questions in payments.

Chargebacks and Fraud Are Often Lagging Indicators

Consider what a chargeback tells you.

Something already happened.

A consumer made a purchase.

A product or service was delivered—or wasn't.

The customer became dissatisfied, confused or believed the transaction was unauthorized.

The merchant may have failed to refund them.

The customer contacted their issuer.

A dispute was initiated.

Only then does the payment ecosystem receive one of its strongest traditional risk signals.

By then, the underlying problem may have existed for weeks or months.

The same is true of many fraud signals.

Payments frequently discovers risk through the financial consequences of risk.

That is fundamentally different from identifying the conditions creating the risk.

A merchant may change:

Products → Claims → Pricing → Fulfillment → Subscriptions → Marketing → Website → Customer Experience

before the downstream consequences become:

Complaints → Refunds → Disputes → Chargebacks → Fraud Alerts → Card-Brand Thresholds → Regulatory Attention

This is why I've increasingly come to view chargebacks as something else:

Chargebacks are often the receipt for risk that already existed.

The opportunity is to identify more of that risk before the receipt arrives.

Regulators Are Already Telling Payments What They Expect

Recent enforcement actions should make every acquiring bank, processor, PayFac and risk executive pay attention.

In September 2026, the FTC announced a $4.85 million settlement with Nuvei over allegations that it opened and maintained payment-processing accounts for merchants it knew or should have known were engaged in deception. The proposed order doesn't simply address transaction processing. It requires screening and monitoring of prospective and existing clients and enhanced screening and investigation under specified circumstances. Federal Trade Commission →

Days later, the FTC announced a $12 million settlement with Humboldt Merchant Services. The Commission alleged that Humboldt processed payments for more than 1,000 shell entities used as fronts or pass-throughs for fraudulent companies. According to the FTC, some merchants generated chargebacks at rates almost ten times what card brands view as excessive. The order also imposes substantial restrictions on Humboldt's future processing activities. Federal Trade Commission →

These aren't Product Intelligence cases specifically.

That's an important distinction.

But they illustrate a broader direction in payment risk:

The question increasingly isn't merely whether you processed the transactions.

It is:

What did you know about the merchant?

What should your controls have discovered?

What warning signs existed?

What did you investigate?

What did you do about it?

And:

Can you prove it?

This isn't entirely new.

More than a decade ago, First Bank of Delaware paid $15 million to resolve actions by FinCEN, the FDIC and DOJ. FinCEN and the FDIC said the bank failed to adequately oversee third-party payment processor relationships and related products and services commensurate with their risks. The government's assessment described failures to adequately investigate red flags and understand the expected activities of processor customers and their merchants. FinCEN.gov →

Different era.

Different commerce.

Different enforcement matters.

But the underlying control question has survived:

How much should a financial institution reasonably know about the commerce it enables?

Card Brands Are Asking the Same Fundamental Question

Regulators aren't the only source of exposure.

Acquirers operate inside card-brand risk frameworks.

Visa's published Acceptance Risk Standards, for example, say acquirers must have the ability to proactively monitor and act on changes in merchant credit risk and recommend enhanced due diligence for higher-risk segments. Visa's Merchant Screening Service also describes acquirer participation as mandated by Visa Rules, subject to applicable law, and explicitly positions merchant screening as protection against fraud, illegal transactions, brand damage and non-compliance assessments. Visa →

Card-brand programs continue becoming more sophisticated because the networks face the same fundamental challenge as acquiring banks:

The network doesn't simply need to know that a transaction occurred. It increasingly needs intelligence about the commerce behind that transaction.

That is where today's infrastructure begins reaching its limits.

The Missing Layer Is Product Intelligence

Most banks and processors already possess enormous quantities of merchant information.

The problem isn't necessarily more data.

The problem is understanding what the data means.

Consider a merchant approved as:

• MCC 5499 — Miscellaneous Food Stores

What does that actually tell you?

The merchant could sell protein powder.

Or herbal supplements.

Or CBD gummies.

Or functional mushrooms.

Or kratom.

Or products containing concentrated 7-OH.

Or nootropics.

Or products marketed with disease claims.

Or an entirely new compound that wasn't in the catalog when underwriting occurred.

The merchant hasn't necessarily changed.

The risk inside the merchant has.

That's why the traditional hierarchy:

Portfolio → Merchant → MCC

is increasingly insufficient.

The next generation looks more like:

Portfolio → Merchant → Website → Product → Ingredient / Compound → Claim → Evidence → Regulation → Institutional Policy → Risk Status

That is Product Intelligence™.

What Proper Product Intelligence Actually Looks Like

Product Intelligence isn't periodically looking at a merchant's website.

It isn't storing screenshots.

It isn't asking an analyst to Google the merchant once a year.

And it isn't uploading a COA into a merchant file and calling the merchant compliant.

Proper Product Intelligence begins by creating a continuously maintained digital understanding of the merchant's commerce.

At onboarding, technology should identify the merchant's websites, product catalog, product categories, individual products, relevant ingredients or compounds, marketing claims, required licenses, product documentation, COAs or testing where applicable, and other evidence relevant to the institution's policies.

That information must then be structured.

A bank shouldn't simply possess 1,000 PDFs.

It should know what those PDFs say.

A processor shouldn't simply know that a merchant sells supplements.

It should know which supplements, containing what, making which claims, supported by what evidence, under which regulatory and institutional requirements.

Then policy becomes machine-readable.

Instead of:

• "We don't support noncompliant hemp products."

the institution can determine:

Which merchants sell hemp?

Which products are affected?

Which products have current COAs?

Which products exceed policy thresholds?

Which products contain restricted compounds?

Which documentation has expired?

Which merchants added new products after approval?

Suddenly compliance stops being a research project.

It becomes an intelligence query.

Then Comes the Most Important Part: Continuous Monitoring

Product Intelligence at underwriting is valuable.

Product Intelligence after underwriting is transformative.

Because the merchant you approved isn't necessarily the merchant you're processing for today.

The system needs to detect meaningful changes continuously:

New product. New ingredient. New claim. New website. New category. New brand. Expired COA. Changed formulation. New license requirement. Changed regulation. Changed bank policy. Changed card-brand requirement.

But here's the critical point:

Monitoring shouldn't mean generating more alerts.

Risk teams already have enough alerts.

The system should determine whether the change matters.

That requires connecting the change to regulatory requirements and the institution's own policies.

Only meaningful exceptions should reach humans.

That changes the role of the compliance analyst from:

Find everything. Read everything. Interpret everything.

to:

Investigate the exceptions that require human judgment.

That is where automation becomes economically transformative.

From Monitoring to Resolution

Identifying an exception isn't the end of compliance.

It's the beginning of the workflow.

A modern system should move automatically from:

DETECT → EVALUATE → NOTIFY → REMEDIATE → VERIFY → RESOLVE → MONITOR

If a merchant has 1,500 products and three require remediation, the institution shouldn't necessarily need to treat the entire merchant as noncompliant.

Tell the merchant exactly which three products created the issue.

Show what requirement applies.

Request the necessary evidence.

Give the merchant a structured way to respond.

Verify the correction.

Preserve the evidence.

Close the exception.

Continue monitoring.

That's a fundamentally different operating model from spreadsheets, email, shared drives, screenshots and annual reviews.

And Every Decision Creates an Audit Trail

Now imagine a regulator, sponsor bank, auditor or card brand asks:

• Why did you continue processing this merchant?

The institution shouldn't need three weeks to reconstruct the answer.

The answer should already exist:

What was known → What changed → What was detected → What requirement applied → What evidence existed → What was communicated → What the merchant did → What was verified → Who made the decision → Why the decision was made

That's not merely monitoring.

That's defensible intelligence.

And I believe it will become increasingly important as regulators and card brands ask not simply whether institutions have policies, but whether their controls actually operate.

Product Intelligence Changes the Economics of Risk

This is where the conversation becomes much more interesting.

Because Product Intelligence isn't only defensive.

It's offensive.

Banks and processors frequently classify entire industries as "high risk" because understanding the underlying commerce is expensive.

CBD.

Hemp.

Nutraceuticals.

Kratom.

Peptides.

Vape.

Tobacco.

Alcohol.

Firearms.

Telehealth.

Pharmaceutical-related commerce.

Emerging regulated products.

The problem isn't always that every merchant in these industries represents unacceptable risk.

Sometimes the problem is that the institution cannot efficiently determine which risk is acceptable.

And those are very different problems.

Without sufficient intelligence, the rational response can become:

DON'T BANK IT. DON'T PROCESS IT.

But what if the institution could identify every product?

Evaluate the products against its policies?

Validate supporting evidence?

Continuously monitor changes?

Automatically surface exceptions?

Require remediation?

Preserve the entire compliance history?

The conversation changes from:

• "Do we want hemp merchants?"

to:

• "Which hemp merchants and which products satisfy our requirements?"

From:

• "Peptides are too risky."

to:

• "Which merchants, products, claims and business models fall within our risk appetite?"

From:

• "We don't support nutraceuticals."

to:

• "Which products actually create unacceptable regulatory, reputational or financial exposure?"

That is Risk Precision™.

Better Intelligence Doesn't Necessarily Mean Taking More Risk

This distinction is critical.

Product Intelligence doesn't require a bank to expand its risk appetite.

It gives the bank the ability to apply its existing appetite more precisely.

A bank can still prohibit an industry.

A processor can still prohibit a compound.

A sponsor can still establish strict product requirements.

A card brand can still establish standards.

But now those policies can potentially be enforced at the level where the risk actually exists.

The product.

That means better intelligence can produce both:

more confident NOs

and

more defensible YESes.

The second part may ultimately be where the greatest economic opportunity exists.

Compliance Can Become a Growth Engine

There are hundreds of thousands of legitimate businesses operating in industries that financial institutions frequently avoid because they're difficult and expensive to understand.

Those merchants still need banking.

They still need payment acceptance.

They still need commerce infrastructure.

And they're often willing to pay more for partners capable of responsibly supporting them.

Historically, supporting those industries meant hiring more analysts.

More underwriting.

More manual monitoring.

More document review.

More compliance personnel.

More operational overhead.

Technology changes that equation.

If 70%, 80% or eventually 90% of the research, product discovery, evidence validation, monitoring and policy evaluation can be automated, regulated commerce begins to look very different economically.

Compliance stops being solely the cost of supporting the merchant.

It becomes infrastructure that makes supporting the merchant possible.

This Is Why We Built Qredible Around the Merchant Lifecycle

At Qredible, we didn't start with the assumption that banks needed another monitoring tool.

They already have plenty of tools.

The problem was that merchant intelligence remained fragmented across onboarding systems, underwriting notes, websites, documents, spreadsheets, monitoring vendors, transaction systems, chargeback platforms, emails and people's heads.

And virtually none of it created a persistent product-level intelligence layer.

So we built the Merchant Intelligence Operating System™ around six functions:

KNOW → EVALUATE → RESOLVE → MONITOR → PROVE → ENABLE

KNOW the merchant and what it actually sells.

EVALUATE products, evidence and activity against regulation and institutional policy.

RESOLVE exceptions through structured workflows.

MONITOR what changes after approval.

PROVE what was known, what happened and why decisions were made.

ENABLE commerce the institution can responsibly support.

Product Intelligence sits at the center because it connects the merchant's identity to the actual commerce creating the risk.

Why I Believe Product Intelligence Will Become Standard Within Five Years

I'm intentionally framing this as a prediction, not as a current regulatory requirement.

Today, there is no universal U.S. rule requiring every acquiring bank or payment processor to deploy SKU-level Product Intelligence.

But look at the direction of travel.

Regulators are scrutinizing what processors knew or should have known about merchants.

Card brands are expanding merchant-risk and monitoring frameworks.

Commerce platforms are being drawn into questions about products sold through their infrastructure.

Regulated product categories are proliferating.

Merchants can alter their catalogs faster than humans can re-underwrite them.

AI is making product discovery, classification, document extraction and change detection dramatically more scalable.

And the gap between merchant-level identity and product-level reality is becoming increasingly difficult to ignore.

That leads me to a conclusion:

KYP—Know Your Product—will become the natural extension of KYC, KYB and KYM.

Not because someone will necessarily issue a regulation called "KYP."

Because the economics and risk environment will eventually make operating without product visibility increasingly difficult to defend.

The progression is logical:

KYC → Who is behind the account?

KYB → Is the business legitimate?

KYM → What merchant are we enabling?

KYP → What commerce are we actually enabling?

And once the technology exists to answer the last question at scale, expectations can change quickly.

Five Years From Now, the Question May Seem Obvious

Imagine explaining today's operating model to a risk executive in 2031:

• "We knew the merchant's owners."
• "We knew their MCC."
• "We screened them against databases."
• "We monitored their transactions."
• "We watched their chargebacks."

And the executive asks:

• "Did you know what they were selling?"

And the answer is:

• "Not really."

I suspect that answer will sound increasingly strange.

Because the product is where an enormous amount of modern commerce risk originates.

The product can determine legality.

The product can determine regulatory requirements.

The product can create reputational exposure.

The product can violate sponsor-bank policy.

The product can generate customer complaints.

The product can drive refunds.

The product can ultimately contribute to chargebacks.

And the product can change tomorrow.

The Future of Merchant Risk Is Product-Level

Banks and processors can wait until chargebacks, fraud, card-brand programs, regulators or sponsor banks tell them something went wrong.

Or they can build infrastructure capable of seeing more of the risk before it becomes a transaction problem.

That is the shift from reactive risk management to continuous Merchant Intelligence.

And I believe that within the next five years, asking "What does this merchant sell?" won't be considered enhanced due diligence.

It will increasingly be considered one of the most basic questions in merchant risk.

Know the customer.

Know the business.

Know the merchant.

Know the product.

Because ultimately, you cannot intelligently manage the risk of commerce you don't understand.

About Qredible

Qredible is redefining merchant underwriting through Merchant Risk Intelligence (MRI)—a product-first approach that continuously analyzes what businesses sell, how they market those products, and the evidence required to support compliant payment acceptance. By moving beyond static industry classifications, Qredible helps banks, payment processors, ISOs, and sponsor banks make faster, more informed, and more defensible underwriting decisions while reducing manual effort and strengthening ongoing portfolio oversight. Learn more about Qredible's product-first automated compliance management platform for regulated industries →