Merchant Account (MID): What It Is & How It Works

What Is a Merchant Account?

A merchant account is a specialised type of bank account that lets a business accept card payments — debit cards, credit cards, and prepaid cards. When a customer pays with a card, the money doesn't go directly into the business's regular bank account. Instead, it's held temporarily in the merchant account while the transaction is processed, verified, and settled. Once settlement is complete, the funds are transferred to the business's main bank account.

Every business that accepts card payments has a merchant account, whether they know it or not. If you use a payment service provider like Stripe or Square, they provide a pooled merchant account on your behalf. If you have a direct relationship with an acquiring bank, you have your own dedicated merchant account. The distinction matters for control, fees, settlement timing, and how your business is perceived by the card networks.

The term itself is a bit of a hangover from the days when a merchant account was a literal, separate bank account with its own statements. Today the "account" is largely a notional construct managed by your acquirer's systems — but the legal, regulatory, and commercial implications of having one (or sharing one) are very real.

How Merchant Accounts Work

The Payment Flow

When a customer makes a card payment, the transaction follows this path:

• The customer presents their card (in-store, online, or over the phone)
• The payment terminal or gateway sends the transaction details to the acquiring bank, which holds the merchant account
• The acquirer routes the transaction through the card network (Visa, Mastercard, Amex, Discover) to the customer's issuing bank
• The issuing bank checks the account, applies any fraud or 3-D Secure checks, and sends an approval or decline response back through the chain
• If approved, the merchant sees a confirmed payment. The actual funds settle into the merchant account, typically within 1-3 business days
• From the merchant account, funds are transferred to the business's regular bank account, minus processing fees

Authorisation vs Capture vs Settlement

These three terms get used interchangeably and they shouldn't be. Authorisation is the real-time check — the issuer confirms the card is valid and the funds are available, and ringfences the amount. Capture is the merchant saying "yes, take that authorised amount." For card-present payments these usually happen together. For card-not-present, especially MOTO and e-commerce, you can authorise now and capture later (when you ship the goods, for example). Settlement is the actual movement of money from issuer to acquirer to merchant account. It's a separate, batched process that happens overnight.

The gap matters because an authorisation isn't a guarantee of payment — only a settled transaction is. If your business takes an authorisation, ships goods, then fails to capture before the auth expires (usually 7-30 days depending on the card and merchant category), you've shipped for free.

The Settlement Process

Settlement is the process of moving money from the customer's bank to the merchant's account. It happens in batches — typically once per day. The merchant's payment system sends all approved transactions from the day as a batch to the acquirer, which processes them through the card networks. After interchange fees, scheme fees, and the acquirer's margin are deducted, the remaining amount is deposited into the merchant account.

From the merchant account, a separate sweep transfers the net amount into your regular business bank account. Some acquirers do this daily, some do it on a T+1 or T+2 basis, and some hold a rolling reserve (a percentage of revenue) to cover potential chargebacks. If you're a new business or in a higher-risk category, expect rolling reserves of 5-10% held for 6 months as standard.

Dedicated vs Aggregated Merchant Accounts

Dedicated Merchant Account

A dedicated merchant account is held in the business's own name with an acquiring bank. The business goes through an underwriting process where the bank assesses the risk of the business, its industry, transaction volumes, average transaction value, and chargeback history. Once approved, the business has its own account with negotiated processing rates and its own merchant identification number (MID).

Benefits include lower processing fees (particularly at volume), more control over settlement timing, a direct relationship with the acquirer, and far more stability — an acquirer won't terminate a dedicated merchant relationship without notice and a clear reason. The downside is a longer setup process (typically 2-6 weeks), ongoing compliance requirements, and minimum monthly fees that can sting if your volumes are low.

Aggregated (Pooled) Merchant Account

Payment service providers like Stripe, Square, and PayPal operate under their own master merchant account and let businesses process payments through it. The business doesn't go through traditional underwriting — they can often start accepting payments within minutes by signing up online.

The trade-off is less control. Processing fees are typically higher and non-negotiable (you take the standard published rate). Funds may be held for longer periods. And because you're sharing an account with thousands of other businesses, your account can be frozen or terminated if the provider's risk algorithms flag your activity — sometimes with little explanation or recourse.

For most small businesses doing under £100k a year in card volume, aggregated accounts are the pragmatic choice. The fee premium is real but small in absolute terms, and the time saved on setup, compliance, and account management is worth it. Above £250k-£500k annual card volume, the maths usually tips in favour of a dedicated account.

Hybrid Models

The boundary between dedicated and aggregated has blurred. Stripe will graduate higher-volume customers to a hybrid arrangement where they still process through Stripe's infrastructure but get their own MID and partially negotiated rates. Some PSPs offer "facilitated" merchant accounts where the PSP handles underwriting and onboarding but the merchant ends up with their own account at an underlying acquirer. If you're in this range, ask the question — it's rarely advertised.

Getting a Merchant Account

The application process for a dedicated merchant account involves:

• Business documentation — company registration, directors' details, proof of address, bank statements, and often beneficial ownership disclosure (UK PSC register data)
• Processing history — previous transaction volumes, average transaction values, refund rates, and chargeback rates if available. New businesses without history face stricter terms
• Industry assessment — some industries are considered higher risk (travel, gambling, adult content, subscription services, CBD, debt collection, ticket resale) and face stricter scrutiny, higher fees, rolling reserves, or outright refusal
• Compliance requirements — the acquirer will want to know how you handle card data, whether you're PCI DSS compliant, and what security measures you have in place
• Website review — for e-commerce, the acquirer reviews your website for clear terms, privacy policy, refund policy, contact details, and SSL
• Personal guarantee — most UK acquirers require directors to personally guarantee the merchant account for the first 12-24 months, particularly for SMEs

Underwriting can take anywhere from 48 hours (a clean retail business with strong history) to 6+ weeks (a higher-risk industry or new business). Build that into your launch timeline.

Merchant Account Fees

Several fee types apply to merchant accounts:

• Interchange fees — paid to the card issuer on every transaction. Rates vary by card type, transaction method (in-person vs card-not-present), and merchant category. UK consumer debit cards are capped at 0.2%, consumer credit at 0.3%; commercial cards and international cards run much higher
• Scheme fees — paid to the card network (Visa, Mastercard, Amex). Typically small per-transaction but include fixed monthly assessments that add up
• Acquirer margin — the acquiring bank's markup, which is the negotiable element of the fee structure
• Monthly or annual fees — some acquirers charge a fixed fee for maintaining the account, often £15-50/month
• Authorisation fees — a small per-auth fee (often £0.01-£0.05) on top of percentage-based charges
• Chargeback fees — a per-incident fee charged when a customer disputes a transaction, typically £15-25, regardless of who wins the dispute
• PCI non-compliance fees — some acquirers charge a monthly fee (£10-30) if the merchant hasn't validated PCI DSS compliance
• Cross-border and FX fees — extra basis points on international transactions plus conversion fees if you settle in a different currency

Pricing Models

UK acquirers use three main pricing models. Blended rates give you a single percentage across all card types — simple to budget for but expensive on debit-heavy mixes. Interchange-plus passes through the actual interchange + scheme fees and adds the acquirer's margin on top — more transparent and usually cheaper at volume, but harder to predict. Tiered pricing splits transactions into "qualified", "mid-qualified", and "non-qualified" buckets at different rates — generally the worst model for merchants because the qualification rules favour the acquirer.

If you're being offered tiered pricing in 2026, push back and ask for interchange-plus instead. It's the industry default now.

Merchant Accounts and Phone Payments

Businesses that accept payments over the phone need a merchant account that supports card-not-present (CNP) transactions, specifically MOTO (mail order / telephone order). Not all merchant accounts are configured for MOTO — some are set up only for e-commerce or in-store use. The processing rates for MOTO transactions are typically higher than for in-person payments because card-not-present transactions carry a higher fraud risk and don't qualify for the same interchange tiers.

When setting up a merchant account for telephone payments, businesses should also confirm their acquirer supports the payment methods they plan to use. DTMF masking, IVR payments, and payment links may each have specific requirements or integrations that the acquirer needs to enable. Some acquirers also draw a distinction between agent-assisted phone payments (where a human is on the line) and fully automated IVR — fee schedules sometimes vary between the two.

One commonly missed point: a card-not-present merchant account doesn't automatically include MOTO authority. You can have an e-commerce-only MID that will decline phone-keyed transactions. If you're moving from web checkout to taking payment over the phone, check with your acquirer first.

PCI DSS and Your Merchant Account

Acquiring banks require merchants to validate PCI DSS compliance as a condition of maintaining their merchant account. The level of validation depends on the merchant's transaction volume — Level 1 merchants (over 6 million card transactions a year) need an annual audit by a QSA, while smaller merchants complete a self-assessment questionnaire (SAQ). Failure to validate compliance can result in non-compliance fees, increased monitoring, or, in extreme cases, termination of the merchant account.

PCI DSS v4.0.1 is the current standard (the March 2025 transition deadline has passed). The biggest practical change from v3.2.1 is that future-dated best-practice requirements have become mandatory, including stricter authentication for cardholder data environments and new e-commerce script-monitoring rules under Requirements 6.4.3 and 11.6.1.

Using a PCI DSS-compliant payment provider to handle card data can dramatically reduce the scope of the merchant's compliance obligations. If your environment never touches a real PAN, you're often eligible for SAQ A (the shortest questionnaire — around 22 questions) instead of SAQ D (around 329 questions). That's a meaningful saving in compliance cost, ongoing scope, and breach risk.

Regulatory Context (UK, EU, US)

In the UK, merchant accounts sit under FCA oversight (your acquirer is an authorised Electronic Money Institution or Bank), with card-scheme rules layered on top from Visa and Mastercard. The UK Interchange Fee Regulation (a retained EU instrument) caps domestic consumer-card interchange. Post-Brexit, cross-border UK-EU interchange on consumer cards has crept up — Visa and Mastercard both raised it to 1.15% (debit) and 1.5% (credit) for CNP, which is why your acquirer's rates jumped if you sell to EU customers.

In the EU, merchant accounts operate under PSD2 (with PSD3 in legislative progress), including Strong Customer Authentication for most e-commerce transactions and a maintained interchange cap. MOTO transactions are explicitly out of SCA scope, which is one of the reasons agent-assisted phone payments remain valuable for cards that fail 3-D Secure on the web.

In the US, the picture is fragmented. There's no equivalent interchange cap on credit (the Durbin Amendment caps regulated debit only, around $0.21 + 0.05%), and merchant accounts are issued by member acquirers under Visa/Mastercard rules with state-level money-transmitter overlays. This is why US card processing is structurally more expensive than UK/EU equivalents.

Edge Cases and Failure Modes

Account Freezes and Terminations

Aggregated merchant accounts (Stripe, Square, PayPal) can be frozen with limited warning if risk models detect an anomaly — a sudden spike in volume, a chargeback above threshold, or simply a change in business model the algorithm doesn't like. Funds can be held for 90-180 days while reserves clear. Dedicated accounts can also be terminated, but normally with 30 days notice and a chance to remediate.

The practical defence is dual-acquiring: having two active merchant accounts so a freeze on one doesn't kill your cash flow. This is standard practice for businesses doing meaningful volume.

The MATCH List

If your merchant account is terminated for cause (excessive chargebacks, fraud, money laundering concerns), the acquirer can list your business and directors on Mastercard's MATCH file (Member Alert to Control High-risk merchants). Listed entities are extremely difficult to re-board with any acquirer for 5 years. Treat your chargeback ratio like a credit score.

Currency and Settlement Surprises

If you accept payments in multiple currencies but settle in only one, every conversion clips you for an FX spread. If you operate cross-border, ask your acquirer about local settlement accounts in your major currencies. This is one of the most under-discussed cost optimisations in payments.

Chargeback Ratios

Visa and Mastercard both run chargeback monitoring programmes. Cross 0.9% of transactions or 100 chargebacks a month and you're on early warning. Cross 1.5% or 200/month and you're in the formal monitoring programme, which means fines starting at $25,000 and escalating sharply. This is the single fastest way to lose a merchant account.

Comparing Merchant Account Options Without Naming Names

When evaluating providers, ignore the headline rate. Look at:

• Effective rate — total fees divided by total volume over a representative month
• Settlement speed — daily, T+1, T+2, or weekly? How much working capital is tied up?
• Reserve policy — rolling, fixed, or none? What triggers a reserve increase?
• Chargeback support — does the provider help you fight chargebacks or just pass them through?
• Phone payment support — MOTO enabled? Integration with secure phone payment tooling?
• Integration depth — APIs, webhooks, reconciliation feeds for your accounting system
• Termination terms — notice periods, off-boarding cooperation, data export

Three of these — settlement speed, reserve policy, and termination terms — often matter more than the rate itself.

Best Practice Guidance

If you're setting up or reviewing a merchant account, a few things to lock in:

• Run an effective-rate calculation against your last 3 months of statements before signing — the difference between quoted and actual rates is often 30-60 basis points
• Insist on interchange-plus pricing if you're over £100k/year in card volume
• Maintain dual-acquiring once you're past £500k/year — the downside protection is worth the small overhead
• Track your chargeback ratio weekly, not monthly, so you can act before crossing a scheme threshold
• Validate PCI DSS compliance every year without fail. Letting it lapse triggers the £10-30/month non-compliance fee plus higher reputational and legal risk if you do get breached
• For phone payments specifically, use a DTMF masking platform so cardholder data never enters your environment, your call recordings, or your agents' screens. This is the cheapest possible route to PCI scope reduction

Internal Resources

Related Paytia content that goes deeper on linked topics: PCI DSS, MOTO payment, payment gateway, acquiring bank, DTMF masking, and secure phone payment platform.