Cover Story: Georgia on Their Mind

A new Georgia law allows non-bank payment processors to charter their own merchant-acquiring banks. Will this charter upend the traditional sponsorship model in the U.S.?

By Jim Daly

Already a major center for payments companies, Atlanta’s gravitational pull in the merchant-acquiring industry could strengthen thanks to a new Georgia law.

Enacted with little fanfare this past spring, the law, the first of its kind in the U.S., created a charter that enables non-bank merchant processors to own and run their own specialty merchant-acquiring banks.

With such a charter, a third-party processor or independent sales organization apparently would not need to recruit an outside bank to sponsor it into the Visa Inc. and MasterCard Inc. networks so that it could submit credit and debit card transactions for clearing and settlement.

The force behind the law creating the charter was the big Atlanta-based merchant processor Global Payments Inc., but acquiring executives say the statute could have effects reaching far beyond one company.

Under the new law, specialty banks in Georgia controlled by processors or ISOs both in and out of state could reshape the decades-old model of bank sponsors as the networks’ gatekeepers.

“This law will definitely change the face of merchant acquiring,” Adil Moussa, an Omaha-based consultant who earlier was a merchant-acquiring executive and an acquiring-industry analyst at Aite Group LLC, told Digital Transactions News in April. “It is something that many ISOs have been trying to get.”

Explosive Mix

Georgia’s legislature created the charter just as acquiring is undergoing fundamental changes abroad. In Europe, ISOs can now submit transactions directly into the card networks as part of an effort to make cross-border payments easier for consumers and merchants.

At the very least, many in the U.S. acquiring industry are interested in learning more about Georgia’s specialized charter. An April 25 Digital Transactions News story about its creation generated one of the highest number of hits for any story posted on this publication’s Web site this year. And an official with the Georgia Department of Banking and Finance (DBF), which will administer the law, says: “We have received numerous inquiries about this new type of charter.”

Whether that interest translates into actual issuance of charters, however, won’t be known for some time. The official says the DBF is formulating rules to implement the law, and until then the department won’t comment.

The Georgia law intrigues acquiring executives, but some wonder how big its impact will be.

“The idea is an attractive idea,” says Ken Musante, president of Eureka Payments LLC, a Eureka, Calif.-based ISO. “In think in practice there won’t be any takers. I hope I’m wrong.”

Mary Weaver Bennett, director of industry and government relations for the acquiring-industry trade group the Electronic Transactions Association, echoes Musante’s opinion.

“Really, the law is written so narrowly that it’s going to impact [only] a handful of companies,” she says.

One group that need not apply is retailers. The law specifically prohibits “self-acquiring,” which means no merchant intent on becoming its own acquirer could get a charter.

That provision prevents a potentially explosive mix of retailers and bank charters. In the face of strong opposition from banks and others, Wal-Mart Stores Inc. in 2007 ended its lengthy effort to obtain an industrial bank charter from the state of Utah. Wal-Mart said it wanted the bank merely to reduce its transaction-processing costs, but its opponents feared it would enable the company to offer full-fledged financial services to consumers directly.

The Home Depot Inc. also was thwarted in its effort to get a Utah charter, which the retailer wanted so it could offer financial services to construction contractors.

Risk Control

It’s too early to know if the skeptics about the new Georgia law are right. Global Payments presumably will be first in line to apply for a charter, but the company refused to comment for this story. Several other big Georgia-based merchant processors, including First Data Corp., Total System Services Inc. (TSYS) and WorldPay US Inc., also declined to comment, as did Visa and MasterCard.

As the DBF grinds away on its rulemaking, many in the acquiring industry question the wisdom of tinkering with the industry’s traditional sponsorship model. Under that time-tested structure, Visa and MasterCard require that before transactions flow into their electronic pipes, a bank must sponsor any third-party entity generating that transaction flow. Banks built most of today’s U.S. payment card business, and they owned MasterCard until 2006 and Visa until 2008.

Today, however, only a few banks provide A-to-Z acquiring services themselves. Large non-bank processors such as First Data, Global Payments, TSYS, Heartland Payment Systems Inc., and some big ISOs do most of the industry’s heavy lifting—underwriting of new merchant accounts, transaction authorization and settlement, statement generation, risk management (including fraud monitoring), and chargeback processing.

All of these companies need bank sponsors, as do the thousands of small and mid-sized ISOs that rely on them for processing. Sponsor banks enable their ISOs and processors to use their bank identification numbers (BINs) to gain access to the networks.

Those who question giving non-bank entities direct access to the bank card networks are especially concerned about increasing the risk in card transactions. Even under the existing model, which requires sponsor banks to oversee the ISOs they sign, some “rent-a-BIN” acquiring banks seeking easy fee income have sustained big losses, or even failed, by sponsoring risky ISOs and letting them run amok, only to be overwhelmed by chargebacks involving those ISOs’ merchants.

In one prominent example, the National State Bank of Metropolis (Ill.) failed in December 2000 after signing high-risk ISOs. In a joint press release, the federal Office of the Comptroller of the Currency (OCC), regulator of national banks, and the Federal Deposit Insurance Corp. said the bank was “critically undercapitalized.”

“Inadequate control of the credit and transaction risks associated with its merchant-processing activities involving the settlement of credit card sales transactions for merchants and inadequate supervision by the board of directors resulted in a high volume of losses,” the regulators said.

In a small number of more recent bank failures, losses in merchant portfolios contributed to the collapses while not actually causing them. Yet bankers often fret about the threat merchant portfolios can present, a threat that could increase if there is no disinterested bank guarding the networks’ doors.

“Maybe non-banks are looking to have a bank license so they have more flexibility … but the requirements we have are for risk-control purposes,” says Debra Rossi, executive vice president at Wells Fargo & Co. In addition to being the nation’s fourth-largest bank holding company by assets, San Francisco-based Wells is a leading acquiring-industry actor through its sponsorship programs with First Data and PayPal Inc.

Cost Control

There’s a bit of déjà vu in Georgia’s new charter. In the 1980s and early ‘90s, the so-called non-bank bank and limited-purpose credit card bank came onto the scene. Various companies began using specialty credit card banks as their card-issuing subsidiaries, locating them in states that permitted high interest rates that could be “exported” nationwide, even to states with strict usury laws.

Although criticized by consumer groups, the credit card banks helped fuel the cobranded card boom of the 1990s and made administration of multistate portfolios easier for banks.

Long-time payments-industry attorney Anita Boomstein, a partner at Hughes Hubbard & Reed LLP in New York, sees a parallel between those limited-purpose card banks and the acquiring banks created by Georgia’s new charter.

“This is just the flip side to what they did on the issuing side,” she says.

One of the arguments for acquirers owning their own bank centers on cost. Charter your own bank, and you don’t have to pay an outside bank to sponsor you.

Exactly how much a non-bank processor might save by owning an acquiring bank is unclear, however. Sponsorship expenses are closely held matters of individual contract between bank and processor, though industry experts say they can go as low as 0.5 basis points per transaction.

Still, sponsorship costs can turn into a big item on the expense ledger for a large processor that submits many millions or even billions of transactions into the card networks.

“This could create an acquirer with costs that are below the regular baseline costs,” says Adam Atlas, head attorney at Montreal-based Adam Atlas Attorney at Law, which does most of its business with U.S.-based ISOs. “There’s a potential for a tremendously competitive acquirer to emerge.”

‘Far More Control’

Other arguments for chartering an acquiring bank involve the related matters of efficiency and control. What’s not to like about being in charge of the entire operation?

“This allows the processor to be the processor and acquirer together,” says Boomstein. “It’s a much more efficient process, I think.”

A processor that owns its bank sponsor can set all policies and not have to conform to those dictated by an outside bank.

“You have far more control,” says acquiring industry consultant Caroline “Carrie” Hometh, managing director at Newburyport, Mass.-based RocketPay LLC.

Owning a bank also frees the processor from having to find an outside sponsor, which can be a bit harder than finding a shirt that fits. Acquiring executives say many American banks have left the sponsorship business, often because of the risk.

Although some regional and small banks still remain, the sponsorship business is now dominated by a handful of institutions that besides Wells includes JPMorgan Chase and Co., HSBC, U.S. Bancorp, Harris Bank,  First National Bank of Omaha, Merrick Bank, Columbus Bank & Trust, and some others.

A recent regulatory filing from Global Payments says the company has five main financial-institution sponsors in the U.S., Canada, United Kingdom, Spain, Malta, the Asia-Pacific region, and Russia, but it doesn’t identify the U.S. sponsor or sponsors.

Atlanta attorney Pete Robinson, a partner with Troutman Sanders LLP, led the crafting of the legislation creating the Georgia acquiring-bank charter at Global’s request, but he would not discuss his client’s specific business plans or motivations. He does refer to the earlier limited-purpose credit card banks.

“The idea came [that] if you can have a charter oriented toward issuers, why couldn’t you have a charter oriented toward acquirers, and that’s how we developed the law,” Robinson says, adding that he consulted with other Georgia processors in formulating the bill. “It’s really an updated version of the banking law.”

Subtle Distinction

What’s in it for Georgia and any other state that follows its lead could be new jobs, fees to the state government specifically related to their charters and regulatory functions, and payroll and other tax revenue. Georgia requires the parent company to have 250 acquiring-related jobs in the state.

On the issuing side, Delaware and South Dakota added thousands of jobs by becoming havens for credit card banks. But whether that will play out again on the acquiring side is far from clear.

While a specialty acquirer bank might sound like a good idea to some, other acquiring executives wonder if processor-owned banks will control risk as well as traditional sponsor banks do. And some say only a few processors are big enough to benefit from the Georgia law and have the stomach to become regulated entities.

Well Fargo’s Rossi notes that under the existing model, the bank sponsoring a third-party processor or ISO looks at its sponsored entities a bit differently than the way an acquiring bank or ISO assesses the risk of individual merchants in its portfolio. It’s a subtle distinction, but it adds up to an important role for the sponsor bank in providing another layer of defense against fraud and chargebacks.

“My sponsorship is separate from my acquiring business,” Rossi says. “Contracts are different, risks are different, chargebacks are different.”

Processors that want to run banks will have to step into that role, according to Rossi. She also wonders if non-banks really do want to become regulated entities, which they will if they own a bank, even one chartered by a state. It’s easy to denounce meddling regulators, but Rossi says they perform an important job in keeping payments players on the straight and narrow.

“From my vantage point, I welcome the OCC to make sure we have all the controls in place,” she says. “The OCC is my validation … it’s a good thing that you have some sort of an audit function.”

Adds Eureka Payments’ Musante: “Moving the [payment] business from a large bank that’s too big to fail and has the implicit guarantee from the federal government to a small bank increases the risk.”

Musante also points out that if an ISO fails to resolve an issue with one of its merchants, the sponsor bank “could be drawn into it.”

‘Opportunity Cost’

The bank card networks, meanwhile, have issued no public pronouncements about Georgia’s processor-controlled charter for acquiring banks. Several sources say they’re likely to accept transactions from such entities once they get an official charter and might even be exposed to antitrust lawsuits if they didn’t. But at this point, network acceptance of the banks isn’t guaranteed.

“Just because you become a bank doesn’t mean Visa will play along with you,” says attorney Atlas.

A plausible scenario is that Georgia acquiring banks will be accepted into the system, but only after the networks give them a very thorough going-over, just as they did more than a decade ago when PayPal came onto the scene and riled things up by aggregating transactions.

Currently, processors must meet their sponsor bank’s requirements for reserves to cover potential chargebacks, risk management, and other functions. Sponsors might vary in their involvement with their ISOs, but network rules for sponsors are supposed to set floors for the management of risk and related matters involving the third parities they engage.

One important issue will be capital, which is money banks set aside to cover potential losses. The Georgia law sets a minimum of $3 million in capital for the acquiring banks, but the state’s DBF well as Visa and MasterCard could demand much higher amounts.

The actual amount of capital the networks require existing acquirers to maintain depends on transaction volume, the types of merchants in their portfolios, and other factors.

Visa, for example, generally requires $100 million, though it will permit an acquiring bank to have lower capital with restrictions on the types of merchant accounts, Musante says. Visa typically allows an acquirer to process two times its capital per week, he says, which means a bank with $100 million in capital could support about $10 billion in annual charge volume.

MasterCard is less formulaic in its capital requirements, according to Musante, but he says the network restricts acquirers with less than $25 million in capital to booking only very low-risk merchants, mainly conventional retailers that generate face-to-face transactions.

All that raises one more question: would the processor get a better financial return by doing something else with its money rather than putting it aside as bank capital?

“Unless you’re doing something with that money, it becomes very expensive to have it sit there because of the opportunity cost,” says Musante.

A Bit of Intrigue

What’s clear is that a processor that wants to own a bank is likely to be devoting much more attention to matters such as capital and regulation than it would if it used an outside sponsor. Add it all up, and only a few processors and ISOs, probably big ones, may find that the freedom they get by owning their own bank outweighs the new expenses and hassles.

“In having a bank, there are new costs of compliance,” says attorney Boomstein. “I think a lot of non-bank companies are reluctant to become regulated companies. There’s got to be enough of a cost savings to overcome that hurdle.”

Nonetheless, Georgia has injected a bit of intrigue into an industry where the basic structure was laid out about 40 years ago.

“It’s a very interesting law for people that are thinking outside the box,” says Atlas.

Highlights of Georgia’s Acquiring-Bank Law

HB 898, the Georgia Merchant Acquirer Limited Purpose Bank Act signed into law March 28 by Gov. Nathan Deal, allows non-bank payment processors to charter banks specifically for merchant acquiring. Among its major provisions, the law:

Defines an “eligible organization” for a charter as a company with an office in Georgia and employing at least 250 state residents “directly or indirectly engaged in merchant-acquiring or settlement activities;”

Requires the bank itself to have at least 50 employees in Georgia within a year of receiving its charter. If the bank contracts with an eligible organization for provision of processing services, it still must maintain “a continued and substantive presence” in Georgia;

Sets a minimum capital level of $3 million;

Limits a chartered bank to performing only merchant-acquiring activities; such a bank may not offer consumer products such as checking accounts;

Specifies that an acquiring bank may accept deposits only from its majority owner and at only one location, and bans the bank from collecting deposits from the general public or accepting brokered deposits;

Allows acquiring banks to apply for insurance from the Federal Deposit Insurance Corp.;

Bans “self-acquiring,” which means retailers or other merchants may not get a charter;

Designates the Georgia Department of Banking and Finance (DBF) as the body empowered to charter and supervise acquiring banks;

Authorizes the DBF to set fees for chartering, examinations and related functions;

Gives the DBF authority to order an acquiring bank to cease unauthorized activities, fine the bank or its parent company up to $10,000 per day for violations of applicable Georgia laws, or order the parent company to divest the bank.

Source: Georgia General Assembly

Go East, ISO

The euro may be tottering, but Europe still presents some unique opportunities for non-bank payment processors. In an effort to create a single market for payments, processors need not link up with a sponsor bank in the European Union single-payments zone in order to submit transactions into the bank card networks.

That radical departure from 40 years of tradition is a result of the European Commission’s Directive on Payment Services, or PSD, that took effect in late 2009. As of January 2012, at least 75 so-called payment service providers have received licenses as principal members under the new regulations, according to Caroline “Carrie” Hometh, managing director at consulting firm RocketPay LLC, Newburyport, Mass.

The licenses spare holders from contracting with a sponsor bank to get debit and credit card transactions into the networks, according to Hometh, whose firm has advised a number of firms about the new rules.

The PSD, however, doesn’t enable just any independent sales organization to start processing transactions. Each EU country designates a Financial Services Authority to issue licenses and audit holders. Processors must be able to settle in multiple currencies and competently handle a number of bank-like activities, including risk control.

With a license, a payment service provider can route transactions across national borders yet still get domestic interchange rates, which tend to be lower than cross-border interchange rates. “Your reduction in interchange is considerable,” Hometh says.

Another advantage of the PSD is that it is bringing a new category of players into the payment system, according to Hometh. Banks still dominate acquiring in Europe in a way they don’t in the U.S., where thousands of ISOs have helped foster a highly competitive market. In addition, required settlement times have come down from 72 hours to the end of the next day.

A number of U.S.-based non-bank payment processors are planning on opening European offices because of the PSD licenses.

“They are applying as we speak,” Hometh says. “They want to start expanding, they want to put feet on the street in other parts of the world.”