Payment risk management for EU low-risk merchants.
BazPay treats payment risk as one portfolio discipline. Underwriting, live monitoring, reserve settings, scheme-programme oversight and compliance all report through the same team and the same dashboard. You know your position at any point, not once a quarter.
Built for e-commerce sellers, subscription software firms and professional-services businesses inside the European Union. The mandate is written, the categories are named, and the numbers on the statement match the numbers your risk manager sees.
Why merchants choose BazPay for payment risk management
Four things stay true across the low-risk EU book. They are the reasons product, finance and compliance teams stay with us after boarding is done.
-
Underwriting done once, defended continuously
Merchant risk is assessed at boarding and re-tested on live behaviour. Category, ticket size, refund pattern and dispute reasons all feed the portfolio view — not a one-off form.
-
Chargeback thresholds tracked to the source
Visa VDMP and Mastercard ECM ratios are computed per MID in real time. You see the same number the scheme sees, and you see it before a monitoring letter arrives.
-
Exposure controls proportional to your book
Reserve requirements, delayed-settlement holds and per-charge ceilings scale to the risk you actually run, not to a boilerplate template applied to every merchant.
-
Compliance posture inside the stack
PSD2 SCA, PCI DSS Level 1 and GDPR are engineered into the platform. Sanctions screening runs at boarding and on ongoing counterparty checks.
The four domains of payment risk we cover
Underwriting, transaction, operational and regulatory risk are treated as one surface. A signal that lives on one card is likely to matter for the others, so the same team watches every domain.
-
Underwriting
Underwriting risk management
KYC/KYB on the entity, ownership and business model. A written low-risk mandate defines what the acquirer will and will not board — no category creep in the middle of a live book.
- KYC / KYB
- Ownership
- Business model
- MCC assignment
-
Transaction
Transaction and credit risk
Chargeback ratios, refund rates and authorisation quality are measured per MID and per SKU family. Trends surface before they cross a scheme threshold.
- Chargebacks
- Refund %
- Auth quality
-
Operational
Operational and settlement risk
Settlement cycles, payout corridors and reconciliation feeds are monitored for delays and mismatches. Nothing settles into a black box.
- Settlement
- Payouts
- Reconciliation
-
Regulatory
Regulatory and compliance risk
PSD2 SCA rulings, sanctions lists and GDPR obligations are part of the same review cycle as commercial performance. One team owns the posture end to end.
- PSD2
- Sanctions
- GDPR
Transactional scoring lives in anti-fraud controls. Acquiring contract and MID structure sit on merchant acquiring.
The risk lifecycle, board to review
Six stages carry a merchant from a first application to a mature, monitored book. Each stage change is documented and each stage emits a signed webhook where relevant.
-
Assess
Merchant KYC/KYB, ownership and business model reviewed against the written low-risk mandate before boarding is offered.
-
Board
Named MID opened with the schemes. Category codes, expected volume and ticket size set the baseline for monitoring.
-
Baseline
First 30–60 days of live traffic establish baselines for approvals, refunds, disputes and chargeback ratios.
-
Monitor
Portfolio and per-MID metrics run continuously. Threshold breaches surface in the dashboard and via signed webhook.
-
Review
Standing risk reviews on cadence, ad-hoc reviews on triggered events. Findings feed reserve and ceiling adjustments.
-
Remediate
Corrective actions are documented, scoped and dated. Nothing is left to informal follow-up.
Direct-acquirer risk model vs reseller pass-through
A reseller PSP passes underwriting and risk decisions through a chain. Ownership is unclear, ratios come late, and reserve policy is a portfolio template. A direct-acquirer model — one team, one contract — collapses that chain.
| Dimension | BazPay (direct acquirer) | Reseller PSP (pass-through) |
|---|---|---|
| Underwriting party | Direct with BazPay onboarding | Passed through reseller PSP |
| Chargeback attribution | Named MID per merchant | Diluted across a shared pool |
| Ratio computation | Real-time, source data | Monthly, reseller-reported |
| Reserve setting | Per merchant, transparent | Portfolio template |
| Category coverage | Written low-risk mandate | Vague, changes over time |
| Compliance ownership | One team, one contract | Split across reseller and downstream |
Fee structure and reserve treatment on the pricing page.
Features engineered into the risk platform
Every capability below ships on the standard integration. Risk teams see the same numbers acquirers see, at the same moment they see them.
-
Real-time chargeback ratio
The Visa VDMP and Mastercard ECM computation runs on live data, per MID. You see the number moving as it moves.
-
Refund and auth-rate feeds
Approval and refund rates are streamed per hour into real-time analytics. Cohort drift is visible before a monthly report would catch it.
-
Reserve engine
Rolling reserves and delayed-settlement holds are configured at MID level, expressed in EUR, and shown on every payout statement.
-
Per-charge ceilings
Amount, velocity and MCC-scoped ceilings enforce the underwriting envelope on live traffic. Enforcement is inline, not overnight.
-
Sanctions screening
Counterparty screening at boarding and on ongoing checks against consolidated EU and UN sanctions lists.
-
Signed risk webhooks
Threshold breaches, ratio triggers and case openings fire as HMAC-signed events keyed to the same charge and MID objects.
-
Interchange++ statements
Every fee line — interchange, scheme, acquirer — appears on settlement, so finance and risk see the same numbers.
-
Audit trail
Every rule change, reserve adjustment and MCC re-assignment is logged with the operator, timestamp and reason.
Read the risk state from the API and webhook
Risk state — current chargeback ratio, current refund rate, active reserve balance, open remediation cases — is available on the account object and on signed webhooks. Wire it into your ledger, your data warehouse or your risk dashboard.
GET /v1/account/risk
{
"mid": "mid_5F9k",
"chargeback_ratio": {
"visa": 0.0023,
"mastercard": 0.0018,
"window_days": 30
},
"refund_rate": 0.041,
"reserve": { "balance_eur": 42500, "policy": "rolling_5pct_180d" },
"cases_open": 0
}
Threshold-breach events fire as signed webhooks — risk.ratio_warning,
risk.reserve_adjusted, risk.case_opened. The full event
catalogue lives in the API reference.
Where the risk framework earns its keep
The default monitoring set already reflects these four merchant profiles. Thresholds and reserve policies are calibrated at boarding and re-tested against live behaviour.
-
E-commerce sellers
Multi-country storefronts where refund and dispute mix varies by market. Category-level monitoring flags a country outlier before scheme ratios move.
-
Subscription software
Renewal-heavy books with high transaction counts and low tickets. Dunning-aware monitoring separates a genuine card-update flow from a chargeback-generating pattern.
-
Professional services
Higher-ticket B2B invoicing with concentrated counterparty exposure. Reserve and ceiling policies are set to the specific counterparty risk, not a portfolio average.
-
Digital publishers
Membership renewals with recurring authentication needs. Account-takeover heuristics feed the risk view alongside the transactional signals.
Out of scope for BazPay: adult, gambling, CBD, nutraceutical, forex, CFD, crypto-exchange, debt-collection and MLM. BazPay is not a marketplace of third-party PSPs.
Security and compliance signals
The risk platform sits inside a PCI DSS Level 1 environment reviewed annually. PSD2 SCA runs on every card charge. Sanctions screening runs at boarding and on ongoing checks against consolidated EU and UN lists. GDPR obligations belong to the same team.
- PCI DSS Level 1
- Annual assessment on the acquiring and gateway environment
- PSD2 SCA
- 3-D Secure 2.2 with exemption engine on every card charge
- GDPR
- EU data residency; DPA available on request
- Sanctions screening
- EU and UN consolidated lists; ongoing counterparty checks
- Scheme risk programmes
- Visa VDMP and Mastercard ECM monitoring at MID level
- Underwriting policy
- Written low-risk mandate; boarded categories defined and disclosed
Questions merchants ask on the risk conversation
What does payment risk management cover, and how does BazPay approach it?
Payment risk management is the discipline of identifying, measuring and mitigating loss from payment activity — including transaction, credit, operational, regulatory and reputational risk. BazPay treats it as a single portfolio function: underwriting, live monitoring, reserves, compliance and remediation all report through the same team and the same dashboard, not through separate silos.
How is underwriting risk management different from ongoing risk management payments oversight?
Underwriting is a point-in-time decision to accept a merchant based on documented information. Ongoing oversight measures the merchant's live behaviour against that decision. BazPay re-tests the underwriting position continuously — chargeback ratio, refund rate and category mix are compared with the assumptions made at boarding, and reserves or ceilings adjust when the profile changes.
Which chargeback thresholds does BazPay monitor?
Visa's Dispute Monitoring Programme (VDMP) and Mastercard's Excessive Chargeback Merchant (ECM) programme are computed live per MID. You see the same ratio the scheme will see, so remediation can begin before a monitoring letter is sent. Programme rules are consulted directly at the schemes; BazPay does not publish threshold numbers here.
Do you require a reserve or rolling reserve?
Reserves are set per merchant based on the underwriting outcome and the live risk profile. Where a reserve is required, it is expressed in EUR, appears explicitly on every payout statement and is re-tested on the standing review cadence. Merchants with clean history and predictable books typically operate without a rolling reserve.
How does payment processing risk management interact with the fraud engine?
Two related but distinct layers. The fraud engine covered on the anti-fraud controls page scores each order in real time and drives the allow/step-up/review/block verdict. Risk management sits above that, watching the portfolio for pattern shifts, adjusting reserves and ceilings, and owning the scheme-programme relationship. They share signals; they answer different questions.
What happens if a merchant crosses a scheme threshold?
A defined remediation workflow starts. It begins with a joint review of the driving categories, moves to targeted controls — enforced 3-D Secure 2 above a ticket, category-level trust lists or short-term reserve — and includes scheme correspondence handling. Progress is tracked in the dashboard with named owners on each action.
Which merchant categories are in scope for BazPay?
EU low-risk merchants only: e-commerce sellers, subscription software firms, professional-services businesses and digital publishers. BazPay does not board adult, gambling, CBD, nutraceutical, forex, CFD, crypto-exchange, debt-collection or MLM merchants, and it is not a marketplace of third-party PSPs.
How is online payment risk management reported to my finance team?
Ratios, refund rates and reserve balances land in the same dashboard as approvals and settlement data. Signed webhooks fire on threshold events for ingestion into your ledger or data warehouse, and every payout statement includes a per-MID risk summary alongside the interchange++ line items.
Start the risk-and-boarding conversation
Share your business model, expected volumes and category mix. We will confirm boarding fit, likely reserve treatment and any category-specific controls — usually within one working day. See also hosted checkout products, card and APM processing and open banking.