Sovereign Nations. Different Laws. One Complicated Payments System.
Sovereign Nations. Different Laws. One Complicated Payments System. On Indigenous Peoples' Day, it's time to examine why tribal gaming, ...
| ""You cannot fully understand the risk of a merchant without understanding the products behind the merchant." - Noah Fitzgerald, CPP, CRO Qredible, Inc. |
Introduction
For decades, merchant underwriting has started with the business.
Who owns it?
What does it do?
Where does it operate?
What is its Merchant Category Code?
How long has it been operating?
What does its processing history look like?
Those questions remain important.
But commerce has changed dramatically.
Today, a single merchant may sell hundreds, thousands, or even tens of thousands of individual products across websites, marketplaces, retail locations, wholesale channels, and social commerce.
And increasingly, the greatest compliance risk isn't necessarily the merchant.
It's what the merchant sells.
That creates an important question for banks, payment providers, marketplaces, and risk organizations:
How well do you actually understand the products inside your merchant portfolio?
For many organizations, the answer is uncomfortable.
They know their merchants.
But they don't necessarily know their merchants' products.
That distinction is becoming increasingly important.
The payments industry has historically classified merchants primarily at the business level.
A merchant receives an MCC.
The business is assigned an industry.
Underwriting establishes a risk classification.
Policies determine whether that type of merchant is acceptable.
This model made sense when businesses were relatively easy to categorize.
A restaurant sold food.
A clothing store sold clothing.
A hardware store sold tools.
But today's merchant ecosystem is far more complicated.
Consider a modern health and wellness retailer.
The same merchant might sell:
What exactly is that merchant?
The answer depends less on the name above the door and increasingly on the products sitting on the shelves.
Imagine a merchant selling 2,000 products.
1,999 are completely supportable.
One isn't.
That single product could potentially create:
Yet traditional merchant-level classification may never identify it.
The merchant hasn't changed.
The MCC hasn't changed.
The legal entity hasn't changed.
The ownership hasn't changed.
The product catalog changed.
And with it, the risk profile of the business.
There is another side to this conversation that receives far less attention.
Product-level intelligence isn't simply about finding more risk.
It can help organizations identify where risk doesn't exist.
Suppose a merchant operates in an industry traditionally considered elevated risk.
A business-level policy may result in:
Decline the merchant.
Without product-level intelligence, organizations can be forced to make broad decisions about entire businesses based on category assumptions.
That can lead to unnecessary declines, lost revenue, poor merchant experiences, and missed opportunities.
Better intelligence should not simply help organizations identify what they cannot support.
It should help them confidently understand what they can.
Merchant Category Codes serve an important role within the payments ecosystem.
But an MCC tells us broadly what kind of business a merchant operates.
It does not tell us everything the merchant sells.
A single merchant category can contain thousands of completely different products with dramatically different:
MCC-level intelligence is useful.
But in increasingly complex regulated industries, it is no longer sufficient by itself.
We need to move deeper.
From:
Merchant Category
to
Business Model
to
Product Category
to
Individual Product
That is where a much richer understanding of merchant risk begins.
Even knowing the product name isn't necessarily enough.
Consider something as seemingly simple as a hemp-derived product.
Understanding its supportability may require knowing:
The same principle applies across other regulated industries.
A supplement isn't simply a supplement.
A vape isn't simply a vape.
A pharmaceutical product isn't simply a pharmaceutical product.
A firearm-related merchant isn't simply a firearm-related merchant.
Risk increasingly exists in the details.
A business may operate under the same legal entity for twenty years.
Its product catalog could change every week.
That creates another fundamental challenge for traditional underwriting.
A merchant can be correctly underwritten today and materially different tomorrow without changing anything in its corporate profile.
The business remains the same.
Its products don't.
This is one reason point-in-time underwriting is becoming increasingly inadequate for dynamic and regulated commerce.
Organizations don't simply need to know:
What did this merchant sell when we approved them?
They increasingly need to know:
What is this merchant selling now?
This becomes especially important as regulators respond to rapidly evolving product categories.
Consider industries such as:
Regulatory requirements can differ based on the exact product, formulation, ingredient, claim, jurisdiction, or distribution method.
A rule change may not affect an entire merchant category.
It may affect a subset of products inside that category.
This creates a very different compliance challenge.
If legislation changes tomorrow, the question is no longer simply:
"Which hemp merchants do we have?"
It may be:
"Which merchants sell products containing this specific ingredient, cannabinoid, formulation, concentration, or claim?"
That question cannot reliably be answered from a merchant application.
It requires Product Intelligence™.
Imagine a new regulation takes effect affecting a specific category of products.
A traditional response might require teams to:
Now imagine being able to search across the portfolio and identify potentially affected products and the merchants selling them.
The operational model changes.
Instead of asking every merchant:
"Are you affected?"
the organization can begin with:
"Here are the merchants and products that require review."
That's the difference between reacting to regulation and possessing the intelligence to respond to it.
For decades, the fundamental unit of merchant risk has been the merchant.
I believe that model is beginning to evolve.
The future will increasingly require organizations to understand risk across multiple levels:
Portfolio
↓
Merchant
↓
Business Model
↓
Product Category
↓
Individual Product
↓
Evidence
Each layer provides additional context.
And the deeper organizations can understand their portfolios, the more precisely they can manage risk.
This isn't simply a compliance issue.
It's a revenue issue.
Broad risk policies can force organizations into binary decisions:
Support the merchant.
or
Don't support the merchant.
Product-level intelligence creates the possibility for much greater precision.
Instead of asking:
"Do we support this industry?"
organizations can begin asking:
"Which products within this business can we confidently support?"
That distinction can potentially enable:
Better intelligence doesn't necessarily mean taking more risk.
It means understanding risk precisely enough to make better decisions.
Product Intelligence™ also extends beyond financial institutions.
Consumers increasingly want to know:
Financial institutions are asking many of the same questions.
So are regulators.
So are marketplaces.
This creates an important convergence.
The same product intelligence that supports compliance can also support transparency.
And transparency creates trust.
One of the earliest lessons we learned building Qredible was that merchant-level compliance could only take us so far.
If we wanted to understand regulated commerce, we needed to understand the products themselves.
That realization influenced much of what we've built.
Our approach connects merchant intelligence with product-level information such as:
The objective isn't simply to create larger databases.
It's to establish relationships between:
Business → Product → Evidence → Regulation → Policy
That context is what transforms product data into Product Intelligence™.
And it is one of the reasons we believe Merchant Intelligence™ must extend beyond the merchant itself.
Financial services has spent decades advancing identity.
KYC — Know Your Customer.
Payments expanded that thinking.
KYM — Know Your Merchant.
I believe regulated commerce requires the next layer.
KYP — Know Your Product.
Because knowing who is selling something is only half the equation.
You also need to understand what they're selling.
The three concepts are not competitors.
They are layers:
Together, they create a far more complete picture of commerce.
Imagine two acquiring organizations evaluating the same regulated merchant.
Both know:
But one organization also understands:
Which organization can make the more informed decision?
Which can respond faster when regulations change?
Which can more confidently support good merchants?
Which can better explain its decisions to a sponsor bank?
The competitive advantage isn't necessarily greater risk tolerance.
It's greater risk precision.
The payments industry has spent decades becoming extraordinarily good at understanding transactions.
We became better at understanding identities.
We became better at understanding businesses.
The next frontier is understanding products.
Because increasingly, products determine:
Merchant-level intelligence will remain essential.
But in the most complex areas of commerce, it will increasingly be incomplete without product-level intelligence.
Ask yourself:
Perhaps most importantly:
If the risk exists at the product level, why are we still managing it only at the merchant level?
Businesses matter.
Ownership matters.
Transactions matter.
Merchant behavior matters.
But increasingly, the answer to whether a merchant can be confidently supported may come down to something much more fundamental:
What are they actually selling?
The next generation of merchant risk management won't abandon business-level underwriting.
It will go deeper.
From businesses.
To products.
From categories.
To specifics.
From assumptions.
To evidence.
Because the future of regulated commerce isn't about labeling entire businesses as risky.
It's about having the intelligence to understand risk precisely.
And increasingly, that intelligence starts with the product.
Qredible is redefining merchant underwriting through Merchant Risk Intelligence (MRI)—a product-first approach that continuously analyzes what businesses sell, how they market those products, and the evidence required to support compliant payment acceptance. By moving beyond static industry classifications, Qredible helps banks, payment processors, ISOs, and sponsor banks make faster, more informed, and more defensible underwriting decisions while reducing manual effort and strengthening ongoing portfolio oversight. Learn more about Qredible's product-first automated compliance management platform for regulated industries →
