An independent sales organization does not join Visa or Mastercard. It works under a sponsor bank's membership, and both networks require that bank to register the ISO with them before it signs up a single merchant. Visa calls the ISO a Third Party Agent; Mastercard's current rulebook calls it an Independent Sales Organization, one category of Service Provider (the industry still often says MSP). The filing is the bank's, but most of what it commits the bank to lands on the ISO.
Visa's April 2026 rules add one more item. From 24 October 2026, in the US and Canada, a bank registering a Third Party Agent must also give Visa the identifiers and BINs that agent uses. This piece draws on Visa's rules of 18 April 2026 and the Mastercard Rules of 2 June 2026; where a figure comes from an older Visa document, we say so.
Who Has to Be Registered
Visa defines a Third Party Agent as an entity, other than a VisaNet processor, that provides payment-related services to a member or its merchants. Mastercard's ISO category covers merchant solicitation and application processing, plus customer service, merchant training and terminal deployment that do not touch account data.
Both exempt bank affiliates on narrow terms: Visa an agent working only for members that own and control at least 25 percent of it, Mastercard an affiliate the bank owns or controls that works for no other bank.
The harder question is the sub-ISO. Visa's Third Party Agent FAQ for the US, Canada and Latin America, last published in May 2016, said ISO registration is required for any entity that solicits merchants on a member's behalf, discusses pricing, fees or terms, processes applications, drafts contracts or submits them to the bank. A registered ISO may use referral partners and sales representatives, but only if they solicit in the ISO's name; a partner that markets in its own name may only pass leads to a registered ISO.
Mastercard gets there through its subcontracting rule: a Service Provider may not subcontract its Program Service, and may perform it only with its own employees or those of another Service Provider registered for the same bank.
The Bank Registers You, Not the Other Way Round
Under Visa's rules, the member registers the agent through Visa's Program Request Management application and the regional forms, and registration must be complete before the agent performs any contracted services. Registration is per member: an ISO that sells for two acquirers needs two registrations, and an acquirer must separately register any agent that one of its merchants engages.
Under Mastercard's rules, the bank registers the provider through its My Company Manager application and must receive Mastercard's written confirmation before the ISO performs any service or represents itself as authorized to. A Service Provider must be proposed separately for each bank it works for and for each type of Program Service it performs. Mastercard charges the bank an initial registration fee and an annual renewal fee, and a bank that fails the registration requirements can be assessed up to USD 25,000 for each 30-day period of noncompliance.
Visa's current fee schedule is not public. Its 2016 FAQ listed USD 5,000 for registration and for each annual renewal of an ISO or payment facilitator, and said the fine for using an unregistered agent started at USD 10,000 per agent. Treat both as a 2016 baseline, not a current figure.
What the Bank Has to Check First
Before contracting, a senior officer of a Visa member must review the agent's documentation, and the member must determine that the agent is financially responsible, run a background investigation on its principals to confirm no significant derogatory information exists, and inspect the agent's business location before registering it. The inspection covers sales materials, operational controls and data security, and the due-diligence review must be repeated every year.
Mastercard requires the bank to verify that the provider is a bona fide business that protects card data and complies with the law, to monitor it on an ongoing basis, and to screen it against sanctions lists at onboarding and after.
What the Contracts Must Say
Visa requires a written contract, signed by a senior officer of the member, with any agent that solicits merchants or handles cardholder or transaction data. It must let Visa audit the agent at any time and impose risk conditions on it, and require compliance with the Visa Rules, applicable law and PCI DSS.
Mastercard's bank-ISO agreement must end automatically if Mastercard de-registers the ISO, and it also prescribes the merchant agreement the ISO sells. That agreement must be signed by the acquirer,. If the ISO is a party to it, the agreement must say that the ISO is the acquirer's exclusive agent, that the acquirer approves in advance any fee the merchant pays, and that the ISO has no access to the merchant's settlement funds or chargeback reserves. The acquirer, not the ISO, collects the discount rate.
What Stays With the Bank
Both rulebooks keep three things with the sponsor bank. Visa requires the member to control merchant approval and the setting of merchant fees; Mastercard requires the bank to control all aspects of the program. The bank also approves marketing: Both require the bank to approve an agent's solicitation materials before use; Visa's rule names websites and business cards.
The brands are the third. In the US, a Visa agent must not use any Visa-owned mark on its marketing materials, business cards or letterhead, and where solicitation materials do carry Visa's marks, they must name the member next to the marks and may identify the agent only as the member's representative. Mastercard is less strict: a Service Provider may use the marks in connection with its service if the bank instructs it in writing, and on stationery only next to a statement naming it as an authorized representative of the bank.
Card Data Is a Separate Registration
A pure ISO, in Mastercard's definition, does not touch account data, and the ISO category is not on Mastercard's list of providers that must demonstrate PCI DSS compliance before registration completes. An ISO that also hosts merchant websites or payment applications, or stores card data, falls into another category, such as Data Storage Entity, which needs its own registration and PCI validation. Visa gets there through the contract's PCI DSS clause.
Changes, Requests and Terminations
Visa gives the member five business days, from the change or from learning of it, to report a change in an agent's principals or business relationship, including a change of ownership or the end of the contract. An agent asked for merchant information by the member, Visa or a regulator has seven business days to provide it. After ending a relationship, the member keeps the due-diligence file and the reason for at least two years. Visa may permanently bar an agent and its principals for good cause, such as fraud, and its rules name ISOs among the terminated agents an acquirer must add to the Visa Merchant Screening Service when the listing criteria are met.
Mastercard requires prompt notice when a Service Provider changes its name or control or seeks bankruptcy protection. A termination, and the reason for it, must be reported through My Company Manager within one week. The ISO itself must tell Mastercard in writing within 24 hours of learning that a bank it works for has failed to settle. Mastercard may audit providers at the bank's cost and bar a provider's owners and employees. Every transaction from a merchant the ISO serves must carry the ISO's identifier in the ISO field.
What Changes on 24 October
From 24 October 2026, in the US and Canada, a Visa member registering a Third Party Agent must disclose the Numeric IDs associated with it. Visa defines Numeric IDs as identifiers it assigns other than BINs and Acquiring Identifiers, such as processor control records, station IDs and token requestor IDs. The member must also disclose the issuing identifiers, Acquiring Identifiers, BINs and account ranges the agent uses to provide its services, including for merchant-facing programs. It must keep that information accurate and complete, and review it every year, after any change and whenever Visa asks.
An ISO that only sells may hold no Visa-assigned identifiers of its own, but the rule also reaches the BINs and Acquiring Identifiers an agent uses for merchant-facing programs. Expect the sponsor bank to ask the ISO to confirm which ones apply. The same April edition deleted a US rule that required an acquirer below the capital Visa requires of acquirers that contract with payment facilitators to pass a Visa Acceptance Risk Standards operational review before registering its first merchant-soliciting agent.
What to Put in Place
- Get written confirmation from each sponsor bank that you are registered with both networks for each type of service you perform.
- List every sub-ISO and referral partner. Any that quote pricing, handle applications or sell under their own brand need their own registration; the rest may only refer leads or sell in your name.
- Check your merchant agreement against Mastercard's required terms: signed by the acquirer, exclusive agency, acquirer approval of fees, no ISO access to merchant funds.
- Send every new piece of marketing, including the website and business cards, to the bank for approval. Remove Visa marks from your own materials in the US.
- Report a change of ownership, principals or DBA to the bank at once; Visa gives the bank only five business days to report it.
- Before 24 October, give the bank an accurate list of the Visa identifiers and BINs your merchants and services use, and a named owner for keeping it current.
- If you host, store or transmit card data, confirm you are registered in that category too and that your PCI validation is current.
Registration is one line in a sponsor agreement, but it is how the networks see an ISO, and the bank answers for everything the ISO does under it.
Tags
About the author
Kyle Hall
Founder
Kyle Hall is a fintech entrepreneur, software engineer, and marketing strategist with over a decade of experience in high-risk payment processing and SaaS development. He is the CEO of PayKings, a leader in high-risk merchant services, and the founder of PulseCRM, a purpose-built CRM platform for the payments industry. Kyle specializes in building custom payment processing systems and growth strategies that empower merchant services providers to scale and succeed in the digital marketplace.