A third-party payment processor acts as an intermediary that routes payments on behalf of merchants, while a merchant account provider gives businesses a dedicated account for processing payments. The AML difference matters because intermediary models often create more opacity around merchant activity, which makes customer due diligence, sanctions screening, and monitoring more important for managing financial crime risk.
How the AML risk shifts between an intermediary and a direct merchant relationship
The AML difference is not just structural, it changes how much transparency the bank or payment firm has into the underlying merchant activity. A third-party processor can aggregate many merchants behind one relationship, which raises the importance of looking through the intermediary to understand who is actually transacting, what goods or services are being sold, and whether any flow is inconsistent with the stated business model.
That is why intermediary models usually demand stronger onboarding controls, richer customer due diligence, and tighter monitoring for unusual volume, geography, or merchant mix. Where the processor is masking the end merchant, the AML question becomes whether the firm can still identify beneficial activity and screen it effectively under its own risk-based program. FATF Recommendations
Why a merchant account provider is easier to supervise, but not automatically low risk
A merchant account provider normally opens a dedicated processing relationship for a business, so the institution has a more direct line of sight to the merchant’s identity, expected activity, and payment patterns. That does not remove AML obligations, but it usually makes screening and transaction monitoring less dependent on inference and more grounded in a known counterparty profile.
In practice, a direct merchant relationship still needs risk-based controls for beneficial ownership, industry type, chargeback behavior, refund patterns, and sanctions exposure. The difference is that suspicious activity is less likely to be hidden behind a pooled intermediary structure, so exceptions are easier to attribute and investigate. FinCEN
Which AML controls matter most in each model
The main control question is whether the institution can reliably identify the end merchant and monitor activity at the level where financial crime risk actually arises. For third-party processors, that often means enhanced due diligence on the processor itself plus contractual and technical requirements that preserve visibility into sub-merchants, transaction metadata, and dispute activity.
For merchant account providers, the priority is usually stronger merchant onboarding, continuous transaction review, and escalation when the business profile changes. If a merchant account starts behaving like a high-risk aggregator, the model should be reclassified rather than treated as a routine commercial account. EBA AML/CFT Guidance
Risk and Threat Considerations
Intermediary payment models create concentration risk because a single processor can provide exposure to many downstream merchants at once. That increases the chance that opaque customer composition, commingled flows, or poor sub-merchant governance will delay detection of sanctions breaches, mule activity, or laundering through apparently legitimate payment traffic.
Failure mechanism: The processor’s pooled or nested structure can separate the institution from the true merchant, weakening customer due diligence, sanctions screening, and suspicious activity detection at the point where risk originates.
Impact: That opacity can let high-risk merchants hide inside ordinary transaction flows, increasing regulatory exposure, remediation cost, and the chance that a financial crime pattern is discovered only after losses or enforcement action.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-8 — Identification and Authentication (Non-Organizational Users) | Third-party and merchant onboarding depends on verifying external counterparties. |
| AU-6 — Audit Review, Analysis, and Reporting | AML monitoring relies on reviewing transaction activity for suspicious patterns. | |
| AC-6 — Least Privilege | Processors should not have more access to merchant data or payment functions than needed. | |
| Recommendation — Apply IA-8 to strengthen identity proofing and authentication for external merchants and intermediaries. Use AU-6 to review payment activity and escalate anomalous merchant behavior. Apply AC-6 to limit processor access to the minimum required payment functions and data. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | The question is about risk differences between payment models. |
| ID.RA-01 — Asset Vulnerabilities Are Identified and Documented | AML review must identify exposure created by opaque merchant structures. | |
| Recommendation — Set risk appetite and due diligence depth based on whether the model is intermediary or direct. Document merchant-structure vulnerabilities that reduce transparency and increase AML exposure. | ||
Practitioner Guidance
What to prioritise: Classify the relationship by who is the true merchant of record, who controls onboarding, and who can change the activity profile without immediate review. If the intermediary can add or swap merchants, treat the arrangement as higher AML risk than a standard direct merchant account.
What to verify: Confirm that onboarding collects enough information to identify the underlying merchant, their beneficial owners, expected geography, products, and channel mix. In reviews, test whether monitoring is happening at the processor level only, or whether it actually reaches the merchant activity that creates the AML exposure.
Practitioner takeaway: The key AML distinction is visibility, not terminology, if you cannot reliably see the end merchant and their activity, you need stronger due diligence and monitoring than a direct merchant relationship would normally require.
Related resources from NHI Mgmt Group
- What is the difference between an internal service account and one used by a third-party cloud service?
- What is the difference between an internal API and a third-party API from a security governance perspective?
- What is the difference between first-party and third-party JavaScript on payment pages?
- What is the difference between direct merchant accounts and third-party processors for chargeback handling?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
