Sovereign Nations. Different Laws. One Complicated Payments System.
Sovereign Nations. Different Laws. One Complicated Payments System. On Indigenous Peoples' Day, it's time to examine why tribal gaming, ...
For years, there has been an uncomfortable reality inside payments.
Sometimes the less you look, the less you find.
And if you don't find it, perhaps nobody has to make the difficult decision about what to do with it.
That logic has always been dangerous.
The Federal Trade Commission's recent action involving Humboldt Merchant Services gives the payments industry a particularly important phrase to consider.
According to the FTC's complaint, Humboldt opened and processed payments for merchants it:
"knew, or consciously avoided knowing"
were shell companies being used by undisclosed third parties engaged in fraud.
Read those words again.
Consciously avoided knowing.
The allegation isn't simply that a payment processor missed something.
It's that it allegedly avoided knowing something.
That distinction should command the attention of every processor, ISO, PayFac, acquiring bank and compliance executive in the payments ecosystem.
Because it raises a much bigger question:
When does not knowing become choosing not to know?
Humboldt is the company in the headlines, but the lesson shouldn't be reduced to one processor.
According to the FTC, Humboldt processed payments for more than 1,000 merchants alleged to be shell entities serving as fronts or pass-throughs for fraudulent companies engaged in unauthorized billing scams. The agency alleges the accounts were opened despite red flags, and says the merchants typically generated chargeback rates almost 10 times higher than what card brands view as excessive.
The FTC also alleged that Humboldt attempted to increase transaction approvals by placing these accounts on a lower-risk bank BIN and engaged in practices designed to evade fraud and risk monitoring. Humboldt agreed to pay $12 million for consumer redress and is subject to substantial restrictions under the entered order.
Those are serious allegations.
But the phrase that matters far beyond this particular case is:
"consciously avoided knowing."
Because payments has historically operated with an enormous amount of information asymmetry.
A processor may know what the merchant told it.
It may know the MCC.
It may know the URL submitted during underwriting.
It may know transaction volume.
It may know chargebacks.
It may know what a legacy monitoring platform reports.
But that isn't necessarily the same thing as understanding the merchant's actual business.
And increasingly, that distinction matters.
Humboldt wasn't even the FTC's only major processor action that week.
On September 4, the FTC announced a $4.85 million settlement with Nuvei. The agency alleged Nuvei opened and maintained accounts for merchants it "knew or should have known" were engaged in deception.
The proposed requirements included screening and monitoring existing and prospective clients, enhanced screening for certain merchant categories, and investigation when specified chargeback thresholds are exceeded.
Put the language from these two cases next to each other:
"Knew or should have known."
"Knew, or consciously avoided knowing."
That's worth paying attention to.
This is also not a concept that suddenly appeared in 2026. The FTC has previously pursued payment processors for allegedly ignoring warning signs or helping merchants evade monitoring, including actions involving First Data, Complete Merchant Solutions, Allied Wallet and CardFlex.
The message has been developing for years.
The question for the industry is whether our compliance infrastructure has developed with it.
I've written before about what I call the expiration of plausible deniability.
For a long time, payment organizations could reasonably say:
We didn't know the merchant changed.
We didn't know that product was added.
We didn't know the website made that claim.
We didn't know the merchant was operating differently from its application.
Sometimes those statements are completely legitimate.
No monitoring system provides perfect knowledge.
No processor can observe every merchant action.
And compliance should never be judged against an impossible standard of omniscience.
But there is an enormous difference between:
and:
The second becomes increasingly difficult to defend as technology makes the underlying activity more observable.
This is the part of the conversation I believe payments needs to confront.
Twenty years ago, continuously crawling merchant websites, identifying thousands of products, analyzing claims, extracting information from documents, evaluating licenses, monitoring regulatory
changes and comparing all of it against institutional policy would have been extraordinarily expensive.
In many cases, practically impossible.
That is no longer true.
These technologies have fundamentally changed the economics of knowing your merchant.
And that creates an uncomfortable question:
The answer will depend on the circumstances, applicable law, network rules and an institution's obligations.
But every compliance executive should be asking the question.
One of the most dangerous statements an organization can make today may be:
"We monitor our merchants."
Okay.
How?
These aren't the same capabilities.
Merchant monitoring is not binary.
Having a monitoring vendor does not automatically mean you have an effective monitoring program.
Payments has accumulated enormous amounts of compliance infrastructure.
KYC provider.
Check.
KYB provider.
Check.
OFAC screening.
Check.
MATCH check.
Check.
Website monitoring.
Check.
Transaction monitoring.
Check.
Annual review.
Check.
The problem is that checking all the boxes doesn't necessarily mean the institution understands the merchant.
That becomes particularly apparent in complex and regulated commerce.
Consider a perfectly legitimate merchant approved six months ago.
Today it adds a new product that violates sponsor-bank policy.
Its legal entity didn't change.
Its beneficial owners didn't change.
Its bank account didn't change.
Its MCC didn't change.
Its chargeback rate didn't change.
Its transactions may look exactly the same.
Every traditional indicator might remain green.
But the merchant is now outside policy.
Does your monitoring system know?
More importantly:
Was it designed to know?
Not:
"Did something happen that we didn't know about?"
Something eventually will.
The more important question is:
"Did we have reasonable controls designed to find out?"
That changes the compliance conversation.
Because the goal isn't perfect knowledge.
It's demonstrable diligence.
An institution should be able to explain:
What it monitors.
Why it monitors it.
How frequently.
What constitutes an exception.
What happens when an exception occurs.
Who investigates it.
How remediation happens.
How the decision is documented.
How the institution knows the problem stayed fixed.
That's a control environment.
This is where legacy underwriting creates another problem.
The industry still relies heavily on point-in-time merchant files.
But commerce doesn't stop changing because underwriting ended.
A merchant can change:
The merchant file increasingly represents:
Who the merchant was when we approved them.
Not necessarily:
Who the merchant is today.
That distinction is becoming increasingly consequential.
This becomes even more important in CBD, hemp, peptides, vape, kratom, nutraceuticals, mushrooms and other regulated-product categories.
A processor can approve a merchant with 100 compliant products.
Tomorrow the merchant adds Product 101.
That product contains a prohibited ingredient.
Or lacks required testing.
Or makes an impermissible claim.
Or violates state law.
Or falls outside sponsor-bank policy.
The processor didn't approve Product 101.
But it's now processing transactions that may include Product 101.
Traditional merchant monitoring frequently struggles with this because the unit being monitored is still primarily:
The merchant.
Modern regulated commerce increasingly requires understanding:
The merchant AND the products inside the merchant.
This is the fundamental shift.
If technology can continuously discover a merchant's products...
Detect website changes...
Identify newly added products...
Read and structure COAs...
Evaluate marketing claims...
Track licenses...
Identify adverse information...
Apply bank policy...
Detect anomalies...
And escalate exceptions...
then the economics of diligence change.
That does not mean every institution must deploy every available technology.
It does mean the industry should reconsider what constitutes a reasonable modern control environment.
Because eventually:
"Our systems weren't capable of seeing it"
may lead to another question:
"Why weren't they?"
This is exactly the problem we have been trying to address with Merchant Intelligence™ and Q-Trust™.
Traditional monitoring asks:
Did something happen?
Merchant Intelligence asks:
What does what happened mean?
That requires connecting multiple forms of intelligence:
Merchant → Business → Website → Product → Evidence → Regulation → Institutional Policy → Change → Risk
The objective isn't surveillance for surveillance's sake.
It's knowing enough about the commerce you enable to make responsible decisions.
Technology discovers.
Technology structures.
Technology evaluates.
Technology monitors.
Technology preserves evidence.
Humans establish policy, investigate meaningful exceptions and make accountable decisions.
That's what a modern compliance operating model should look like.
There's another piece of this that doesn't receive enough attention.
A good compliance system shouldn't simply find problems.
It should create evidence that the organization was actively trying to find them.
Imagine a regulator asking:
What did you know about this merchant?
A modern organization should be able to demonstrate:
When the merchant was evaluated.
What was discovered.
What products existed.
What evidence was reviewed.
Which rules were applied.
What alerts occurred.
Who investigated them.
What changed.
What remediation occurred.
What decision was made.
And what happened afterward.
That's fundamentally different from producing a merchant application and a collection of PDFs.
Compliance shouldn't simply produce decisions.
It should produce defensible evidence of diligence.
Quite the opposite.
One reaction to enforcement is simply:
Stop processing anything complicated.
That isn't necessarily the answer.
Complex commerce isn't inherently fraudulent commerce.
A CBD merchant isn't automatically a bad actor.
A peptide merchant isn't automatically a bad actor.
A nutraceutical company isn't automatically a bad actor.
A telehealth company isn't automatically a bad actor.
High-risk doesn't mean illegal.
The solution shouldn't be to eliminate legitimate emerging commerce because our compliance infrastructure can't understand it.
The solution should be to build infrastructure capable of distinguishing:
Legitimate from deceptive.
Compliant from noncompliant.
Known risk from unknown risk.
Manageable risk from unacceptable risk.
That's Risk Precision™.
Payment processing is built on trust.
Consumers trust merchants.
Merchants trust processors.
Processors trust banks.
Banks trust their partners.
Card brands trust their acquiring ecosystem.
Regulators expect all of them to operate responsibly.
That trust breaks when organizations knowingly enable bad actors.
But it can also break when organizations intentionally design systems that don't look deeply enough to discover them.
The future of payments needs to be built around something different:
Trust through transparency.
Not perfect knowledge.
Not zero risk.
Not endless manual compliance.
Reasonable intelligence.
Continuous visibility.
Documented controls.
Accountable decisions.
Humboldt is an unfortunate example.
But dismissing this as "a Humboldt problem" would miss the larger lesson.
The FTC didn't merely talk about what Humboldt allegedly knew.
It specifically alleged that Humboldt "consciously avoided knowing."
Four days earlier, the agency used another formulation in its Nuvei case:
"knew or should have known."
Those aren't phrases the payments industry should ignore.
Because the next generation of compliance won't simply be judged by whether an institution can say:
"We didn't know."
The harder questions will increasingly be:
What did you do to know?
What systems did you have in place to find out?
What did you do when the systems told you something was wrong?
Those are much better questions.
And payment organizations should start preparing to answer them now.
For too long, parts of payments have treated compliance visibility as something of a paradox:
The more we know, the more we may have to act.
That creates a dangerous incentive not to look too closely.
The Humboldt action provides a powerful reminder that this logic can fail.
Ignorance and diligence are not the same thing.
Missing something despite reasonable controls is not the same thing as designing an environment where you are unlikely to discover it.
The technology now exists to understand merchants more deeply than at any previous point in the history of payments.
We should use it.
Not because every merchant is bad.
Not because every risk can be eliminated.
And not because technology replaces human judgment.
But because the foundation of responsible commerce is knowing what you're enabling and acting when something falls outside the rules.
Plausible deniability is not a compliance strategy.
And increasingly, choosing not to know may be the very thing organizations are ultimately forced to explain.
→ Read the FTC's Humboldt Merchant Services announcement
→ Read the FTC's Humboldt complaint
Qredible is redefining merchant underwriting through Merchant Risk Intelligence (MRI)—a product-first approach that continuously analyzes what businesses sell, how they market those products, and the evidence required to support compliant payment acceptance. By moving beyond static industry classifications, Qredible helps banks, payment processors, ISOs, and sponsor banks make faster, more informed, and more defensible underwriting decisions while reducing manual effort and strengthening ongoing portfolio oversight. Learn more about Qredible's product-first automated compliance management platform for regulated industries →
