Two FTC Processor Settlements in One Week, and a Knowledge Test to Go With Them. What the Nuvei and Humboldt Orders Tell an Underwriting Team.

In the first half of September 2026 the Federal Trade Commission settled with two payment companies over merchants they boarded. Nuvei agreed to pay $4.85 million over processing for tech support scams; Humboldt Merchant Services, an ISO, agreed to pay $12 million over more than a thousand shell merchants. Both come with court orders that spell out how each must now screen and monitor merchants.

The orders bind only Nuvei and Humboldt. The more useful document for everyone else is a statement that came with the Nuvei case, in which Chairman Andrew Ferguson and Commissioner Mark Meador set out when the FTC thinks a processor becomes liable for a merchant's fraud. Read together, they describe the standard an underwriting team will be measured against if a merchant it boards turns out to be a scam.

The Two Cases

Nuvei. The FTC's complaint, filed in the District of Arizona, names five Nuvei entities, including the former SafeCharge companies. It alleges that Nuvei processed more than $30 million in card charges from 2017 to 2023 for Reimage, an offshore tech support operation also sold as Restoro, and spread Reimage's transactions and chargebacks across several merchant accounts to mask its chargeback rates from the card networks' monitoring programs. In early 2020, the complaint says, Visa warned and fined Nuvei over Reimage's fake Microsoft virus alerts, and Nuvei increased its processing for Reimage afterwards. The Commission voted 2-0 to file, and the court entered the stipulated order on 9 September 2026.

Humboldt. The complaint against 5967 Ventures, LLC, which does business as Humboldt Merchant Services, was filed with a proposed order in the Eastern District of Michigan on 8 September, and the court entered the order on 11 September. The FTC describes Humboldt as a card-network-registered ISO of BMO Harris Bank that also underwrites and manages risk for its merchants. It alleges that Humboldt processed for more than a thousand shell merchants, over $100 million from 2021 to 2023 alone, and that many of those accounts typically ran chargebacks almost ten times the rates Mastercard and Visa treat as excessive.

Neither company admitted the allegations; what follows about their conduct is the FTC's account. Humboldt told Payments Dive the order formalises controls already in place and that the conduct happened under former leadership.

The Knowledge Test

The joint statement, dated 2 September 2026, settles a question the FTC had left open. In more than two decades of cases against processors, it notes, the Commission has never sued without evidence that the processor knowingly helped scammers, but it had never formally said knowledge was required. Now the two commissioners say it is: the FTC must plead and prove that the processor knew, should have known, or consciously avoided knowing that the merchant's transactions were unlawful. It is a statement of how they read the law, not a rule.

The reasoning is that any processor boarding unproven merchants will eventually board a bad one, even with industry-standard controls in place, and strict liability would push processors to turn away legitimate start-ups and small businesses.

The same passage sets the limits of that protection. Knowledge can be inferred from a wide range of evidence, and a merchant's low chargeback rate does not prove the processor did not know. Most important for an underwriting team, the FTC will attribute to a processor knowledge of those facts it would have uncovered had it done the fraud-prevention work the card networks require.

What the Complaints Describe

The alleged red flags would mostly be visible in an application file or a monthly risk report.

• Humboldt's applications. Many listed recently formed LLCs with no sales history, a UPS store mailbox as the business address, and nearly all operations run by third parties. Most came through a few outside sales agents, and the complaint alleges the company's president secretly split residuals with one of them.
• Warnings that went unheeded. Between 2017 and 2019, Mastercard alerted Humboldt that thousands of its accounts appeared to be involved in load balancing and card sharing, and in 2019 a senior Humboldt underwriter warned management about shell accounts with straw signers.
• Moving accounts to lift approvals. At the end of 2020, the complaint says, Humboldt moved these accounts onto a lower-risk BIN used by an affiliate because it expected their approval ratios to rise.
• Nuvei's own policies. According to the complaint, Nuvei's written policies already barred merchants with a history of excessive chargebacks, merchants flagged by a card brand for deceptive practices, and merchants whose beneficial ownership was unclear. The FTC alleges it ignored them when that was profitable.

What the Orders Require

Both orders define higher-risk Covered Clients that get extra screening and monitoring:

• Humboldt: a merchant that processes only e-commerce transactions and either uses a negative option feature, such as a free trial or auto-renewal, has no prior card processing history, or was formed within a year of applying.
• Nuvei: a merchant that uses outbound telemarketing; sells tech support, computer software, business opportunities, business coaching, healthcare-related products, debt relief or anything with a negative option; or has been named in a public FTC, federal or state attorney general fraud or consumer-protection case in the past ten years.

Outright bans

Humboldt may not process for straw companies; for merchants on Mastercard's MATCH list for fraud-related reasons, including excessive chargebacks, laundering and identity theft; or for anyone previously named in a public FTC, federal or state attorney general consumer-protection case. It also may not board a Covered Client whose only address is a UPS or FedEx store, another mailbox or mail-forwarding service, a PO box, a registered agent's office or a virtual office. Nuvei is banned from processing for tech support sold by telemarketing or pop-up warnings, and from processing for merchants it knows or has reason to know are on MATCH for similar reasons.

Screening before boarding

For a prospective Covered Client, the orders between them require the company to collect and then verify:

• What the business sells and how, with its websites and representative marketing (sales scripts at Nuvei, affiliate campaigns at Humboldt).
• Owners and control persons, and every trade name and DBA they have used. Humboldt's threshold is 25 percent ownership; Nuvei's is a majority stake.
• Every physical address, and under the Humboldt order every mailbox, PO box, registered-agent or virtual-office address as well.
• Prior acquirers and processors (12 months at Humboldt, two years at Nuvei, with merchant IDs where available), six months of processing statements, and past chargeback rates.
• Whether the merchant or its principals have been in a card network monitoring program, terminated for excessive chargebacks (or, at Humboldt, fraud), or named in a law enforcement case.

Verification means reviewing the merchant's websites and internet search results and, under the Humboldt order, online complaints. Humboldt must also hold a documented phone or video call with a principal whenever the merchant has no processing history or is less than a year old.

Monitoring after boarding

• Review Covered Clients' websites from an IP address not associated with the processor, and save copies. Nuvei must do this monthly and make test calls at least quarterly.
• Calculate chargeback rates at least monthly per processing account and in aggregate per merchant, which is where load balancing shows up.
• Investigate when a merchant exceeds 1 percent in two of the past six months with more than 50 chargebacks in a month (Humboldt) or more than 75 (Nuvei). Nuvei's chargeback trigger covers every client, not only Covered Clients, and it adds an ACH trigger: a total return rate above 2.5 percent with more than 40 returns.
• Close the merchant within 60 days of starting that investigation unless a written report shows its practices are not deceptive or unfair. Nuvei's report must meet a clear and convincing evidence standard.
• Close any merchant it knows or should know is evading monitoring programs; Humboldt has five business days.

The named evasion tactics include spreading volume across accounts or descriptors, shell or straw applicants, split transactions and sham sales. Humboldt must also watch for accounts that process for under three months or in alternating months, and for incorrect MCCs. The Nuvei order adds one many risk teams will recognise: using chargeback-prevention services to lower a merchant's rate without working out why the disputes are happening.

Sales agents

The Humboldt order also covers the sales channel. Humboldt may not take referrals from an agent, or any 25 percent owner or controller of one, who is on MATCH, on the OFAC SDN list, or convicted of fraud or a financial crime in the past ten years. It must review each agent's referred Covered Clients monthly, terminate within five business days any agent who knew or should have known it was sending false information or shell merchants, and investigate whenever an agent's book exceeds a 0.75 percent monthly chargeback rate or more than 25 percent of its closures in a month are for fraud reasons. In that investigation the agent must name, in writing, every sub-agent who referred the merchants in question, or Humboldt stops accepting its referrals.

What a Merchant-Services Team Should Take From It

• Aggregate chargebacks per merchant across every MID and descriptor, and link accounts that share owners, addresses, websites or bank accounts.
• Flag the Humboldt profile at intake: a new entity with no history, a mailbox or registered-agent address, outsourced operations, and card-not-present sales with a trial or auto-renewal.
• Report risk by referring agent: chargeback rate, fraud closures and sub-agents. Most of Humboldt's shell accounts came through a handful of agents.
• When a merchant crosses a threshold and you keep it, write down why. Both orders make that written report the condition for keeping it open.
• Record why any merchant is moved to a different BIN or MCC. The Humboldt complaint cites a BIN move made to lift approval ratios as part of its case.

The One-Line Version

The FTC now says a processor is liable only if it knew, should have known or looked away, and it measures should have known against the diligence the card networks already require, so an underwriting file that shows the work was done is the best protection available.