Third Party Agents
The Third Party Agent Registration Program is a Visa-mandated program established to ensure that Visa members are in compliance with Visa Rules and policies regarding their use of Third Party Agents (TPAs). Visa members are required to perform due diligence reviews to ensure that they understand the TPA's business model, financial conditions, background and Payment Card Industry Data Security Standard (PCI DSS) compliance status. Agent registration is required for all entities providing solicitation activities, managed services and/or storing, processing or transmitting Visa account numbers for Visa members (or on behalf of their merchants).
A TPA can perform any or all of the functions described below. Note that any agent performing more than one agent type must be registered for as each type by the issuer / acquirer they are operating on behalf of.
Independent Sales Organizations (ISO)
ISO Merchant (ISO – M) –conducts merchant solicitation, sales, customer service, merchant transaction solicitation or merchant training activities; acts on behalf of a client for merchant solicitation, sales, deployment or service of POS terminals or equipment.
ISO Cardholder (ISO – C) –conducts cardholder solicitation, card application processing services and/or customer service activities.
ISO ATM (ISO – ATM) –acts on behalf of clients to sell, deploy and/or service qualified ATMs.
ISO Prepaid (ISO – PP) –solicits other entities (i.e., merchant, corporate clients, government entities, other businesses etc.) to sell, activate or load prepaid cards on behalf of an issuer. Prepaid card sales and/or activation is a primary function of their business.
High Risk ISO (HR – ISO) is an ISO that enters into a contract with an acquirer to provide merchant solicitation, sales, customer service, merchant transaction solicitation and/or customer training to "high–brand risk merchants."
Encryption Support Organizations (ESO)
Performs cryptographic key management services to support clients' ATM programs or to deploy Point of Sale PIN Entry Devices (POS PEDs) or PIN pads. ATM and PIN Pad manufacturers that manage various cryptographic key management responsibilities for clients are also considered ESOs.
An ESO maintains a business relationship with a client that includes:
- loading or injecting encryption keys into ATMS, terminals or PIN Pads
- loading software into a terminal or ATM which will accept Visa branded cards
- merchant help desk support, including re-programming of terminal software.
Entities using vendor supplied Remote Key Distribution techniques must ensure that such vendors are registered with Visa as ESOs.
Third-Party Servicers (TPS)
Stores, processes, or transmits Visa account numbers on behalf of clients. The TPS has a contract with issuing and/or acquiring clients. TPSs are not directly connected to VisaNet. The TPS provides specific services directly to issuing and/or acquiring clients including:
- transaction or back-office related functions
- payment transaction processing (such as authorization messages, clearing messages, batch transmissions and data capture)
- chargeback/exception item processing
- fraud control
- cardholder accounting
- statement processing
- remittance processing
- data warehousing/capture
- customer service
- risk reporting/service, and/or loyalty programs
- hosting facilities
- data storage
Merchant Servicers (MS)
Stores, processes, or transmits Visa account numbers on behalf of the client's merchants. MS agents usually contract with the merchant directly, not with the merchant's acquirer. MS agents close the transaction loop between the merchant and the client’s processor. MS agents provide specific merchant payment services including but not limited to:
- online shopping carts
- payment gateways
- hosting facilities
- web hosting
- data storage
- authorization and/or clearing and settlement messages
MS agents can self-identify to Visa through the new Merchant Servicer Self-Identification Program (MSSIP) by clicking here.
The MSSIP allows a Merchant Servicer agent to provide Visa with the necessary information to identify its acquiring bank relationships and facilitate the agent's registration by those acquiring banks. Each bank can then conduct the required Third Party Agent (TPA) registration, via the existing client registration process, to ensure compliance with the Visa Rules and associated government regulatory requirements. Once the Merchant Servicer is registered by a Visa client, completes MSSIP participation and validates PCI DSS compliance they are listed on the Global Registry of Service Providers*.
Acquirers are still required to register MS agents via VMM to be in compliance with the Visa Rules. Merchants must ensure they use MS agents that are registered by their acquirer. Merchants must report their service providers to their acquirer for registration and direct the MS to MSSIP.
*Listing on the registry not applicable to merchant servicers validating PCI DSS compliance through Self-Assessment Questionnaire-D (SAQ-D).
Corporate Franchise Servicers (CFS)
The CFS is a corporate entity or franchisor that provides, manages, operates or controls a centralized or hosted network environment used by franchisees that can affect the franchisee's cardholder data environment if accessed by unauthorized parties irrespective of whether Visa cardholder data is being stored, transmitted or processed through it. In some cases CFS entities also provide card payment processing services to franchisees through these network environments. Although it may or may not host or provide card payment services, more importantly, the insecurity of the shared network can affect an independent location or franchisee and that of its own cardholder data environment if accessed by unauthorized parties. Typically, managed services are provided to the franchisees such as property management systems, inventory control systems, menu distribution systems, etc. CFSs are not directly connected to VisaNet. CFS agents provide, manage or control an environment/connectivity to franchisees that may or may not host or provide payment card payment services (payment applications, inventory management systems, etc.).
Payment Facilitators (PF)
A Payment Facilitator is a third party agent. PF is the only third party that can 1) sign a merchant agreement on behalf of an acquirer, and 2) receive settlement funds from an acquirer on behalf of a sponsored merchant.
- Contracts with an acquirer to provide Visa payment services to sponsored merchants.
- Solicit sponsored merchant for Visa acceptance.
- Contracts with sponsored merchants to enable Visa payment acceptance.
- Monitors compliance of sponsored merchant activity in accordance with the Visa Rules.
- Receives settlement of transaction proceeds from the acquirer on behalf of the sponsored merchant.
- Must be located within the acquirer’s jurisdiction.
- Cannot be listed on the Terminated Merchant File (TMF), or similar files.
- Cannot act as a sponsor for another Payment Facilitator.
- Excluded merchant types (but may be signed under direct acquiring agreements): Internet pharmacies, Internet pharmacy referral sites, and outbound telemarketers.
- PFs are not directly connected to VisaNet
High Risk Internet Payment Facilitators (HRIPF)
Contracts with acquirers to provide payment services to high–risk merchants, high–brand risk merchant, high–risk sponsored merchants or high–brand risk sponsored merchants.
A High Risk Internet Payment Facilitator (HRIPF) is an entity that enters into a contract with an acquirer to provide payment services to high–risk merchants, high–brand risk merchant, high–risk sponsored merchants or high–brand risk sponsored merchants and signs one or more merchants belonging to high–brand risk merchant category codes, as defined in the Visa Rules.
Distribution Channel Vendors (DCV)
Packaging, storing and shipping of non-personalized Visa products (e.g. warehouses, wholesalers, logistics companies). For more information please contact email@example.com.
Instant Card Personalization Issuance Agent (ICPIA)
Performs instant card personalization and issuance for the issuer, generally a retailer or kiosk location.
**ICPIA employer or government managed programs are excluded from the agent registration requirement – however must comply with remaining requirements listed in the VIOR Agents section.
For more information please contact firstname.lastname@example.org.
Dynamic Currency Conversion (DCC)
Providing currency conversion services to sponsored merchants at checkout.
For more information please contact DCCcompliance@visa.com.