Acquirer Credit Risk on Delayed-Delivery Merchants: An Operator Reference

An acquirer sits between two people who both believe they hold the same money. The merchant was paid at the time of sale and, in most delayed-delivery businesses, has already spent some of it — on inventory, on suppliers, on the deposit that secures the flight or the venue. The cardholder holds a non-receipt dispute right whose clock can run from the expected delivery date rather than only the payment date, so it can stay open long after the acquirer has settled the transaction to the merchant. The acquirer is contractually obligated to the card-issuing bank regardless of what state the merchant is in when the dispute lands. That structural mismatch — paid merchant, live claim, exposed intermediary — is what "acquirer credit risk" means for a chargeback in a delayed-delivery business, and it's a different question from what a reserve costs a merchant or how a platform funds its own payouts.

Scope note. This piece is about the acquirer's own credit exposure and how US bank supervisory guidance frames it. It draws on the OCC's Comptroller's Handbook on Merchant Processing — examiner guidance for national banks and federal savings associations, not a card-scheme rule or a merchant-facing obligation — and on Visa's Core Rules and Product and Service Rules, which set the dispute rights and a small number of acquirer-facing requirements. What a merchant actually pays for a reserve is covered in the working-capital cost of payments and understanding PSP contracts; payout funding sits in merchant payout treasury operations; onboarding classification is in KYB vs KYC risk frameworks. This article explains the exposure those pieces don't.

Why future delivery creates a credit exposure at all

Card acceptance is not, in the OCC's own words, technically an extension of credit. But the handbook goes on to say the acquiring bank is "relying on the creditworthiness of the merchant" all the same — because a chargeback converts into a real loss for the bank the moment the merchant can't pay it back. The acquirer settles the transaction to the merchant near-immediately; the cardholder's right to dispute it survives independently of that settlement.

For an immediate-delivery transaction — a coffee, a haircut, a retail purchase handed over at the register — the dispute window is short relative to the transaction date, because delivery and payment happen in the same moment. For a delayed-delivery transaction, they don't: a flight booked in January for June travel, a wedding-venue deposit paid a year out, an event ticket for a concert eight months away — the merchant is paid on day one and the thing being paid for doesn't happen until much later. Visa's own dispute framework tracks this distinction directly: rules on Dispute Condition 13.1 (Merchandise/Services Not Received) generally give the issuer up to 120 calendar days to bring a non-receipt dispute — measured either from the transaction processing date or from "the last date that the Cardholder expected to receive the merchandise or services", whichever applies. That expected-delivery anchor is itself capped: per the rule's own footnotes, a non-receipt dispute may not be brought more than 540 calendar days from the transaction processing date, however long delivery was expected to be delayed. For a merchant with a long fulfilment lag, that second measure is the one that matters: the dispute clock effectively doesn't start running until the thing was supposed to arrive.

The OCC's handbook makes the same point from the bank-examiner side: "the risk of charge-back is greater if the merchant sells goods or services for future/delayed delivery, such as airline tickets, health club memberships, or travel clubs. In such circumstances, customer disputes are not triggered until the date of delivery." That sentence is the whole mechanism. The merchant category doesn't create the risk by itself — long fulfilment lag does, and travel, events, subscriptions, and deposit-based businesses are where it concentrates.

How the acquirer's exposure is actually sized

There is no published percentage, day-count, or formula in the OCC's guidance that applies uniformly across merchants — any operator claiming there is one is guessing. What the handbook actually says: "The contingent liability can span several months of the merchant's sales volume because of the cardholder's rights to dispute the charge and the charge-back process" — a statement about scale, not a formula. PaymentBrief's own restatement of that mechanism: exposure is a function of the window during which a chargeback can still land, multiplied by the volume the merchant is expected to process inside that window.

Two things stretch that window for a delayed-delivery merchant, and they stack: the fulfilment lag itself — during which the expected-delivery clock hasn't started — plus the dispute filing window that begins once delivery was expected. A merchant taking payment today for delivery in 90 days is not carrying a 120-day exposure tail; structurally, it's closer to the fulfilment lag plus the dispute window measured from the delivery date, which can run well past six months from the original transaction before the acquirer's exposure on that sale has fully run off — the outer bound is 540 calendar days from the transaction processing date, however late delivery is expected. Bank supervision and scheme rulebook describe the same mechanism from different sides, agreeing on the shape even though neither hands the acquirer a formula.

What the OCC does specify is the underwriting response, not a number. In the initial review of a merchant application, examiners expect a bank to "reject a merchant with a history of substantial charge-back volumes, weak financial condition, or failure to operate a valid business" — a rejection standard, not merely a pricing adjustment, for chargeback history specifically. Ongoing exception-monitoring is expected to track parameters including large average ticket size, large daily or weekly sales volume, and high chargeback activity, reported as variances from the parameters set at account setup — a risk-based judgment made merchant by merchant, not a single figure.

The tools: reserves, holdbacks, and what each actually does

The handbook names holdback or reserve accounts specifically — not as a general-purpose risk tool, but as the tool for this exposure: "Many banks use holdback or reserve accounts to mitigate credit risk on higher-risk merchants." More pointedly: "Holdback reserves are also used to limit a bank's credit risk when the merchant's product or service involves future/delayed delivery." A rolling reserve is the mechanic most operators will recognise from their own PSP contracts — terminology and typical percentages are in the glossary entry — but the OCC names two funding methods without preferring either: fund it "by setting aside a lump sum or by withholding a portion of each day's proceeds until a specific balance has been reached."

Three other mitigants sit alongside the individual-merchant reserve. A general reserve account, funded at the portfolio level, is described as "similar to the allowance for loan and lease losses (ALLL)" in concept but explicitly not commingled with it — an "other liability" account sized to the whole portfolio's contingent chargeback exposure, protecting the bank against the aggregate tail across every future-delivery merchant it acquires, not just the riskiest one. Chargeback insurance is comprehensive coverage some banks purchase against uncollectible chargebacks, subject to strict guidelines to collect. And delayed settlement is a related but narrower tool: the OCC names it, alongside establishing reserves, as an additional risk-mitigation technique for merchants — Internet merchants specifically — where underwriting finds heightened fraud and charge-back risk, and separately expects merchant agreements to let the acquirer delay settlement of funds until questionable transactions are resolved. That is a fraud-and-charge-back control tied to transactions under review, not a general buffering tool for the delayed-delivery exposure this article is otherwise about.

None of these is a scheme requirement in the general case — the OCC frames them as sound bank practice, not a card-network mandate. Visa's rulebook operates on a different track: it sets the dispute rights that create the exposure, and separately requires every US-Region acquirer to implement a board-approved "underwriting, monitoring, and control policy" for its merchants, VisaNet processors, and third-party agents — one being prudential supervision, the other the network protecting its own settlement guarantee. Visa does go further in one specific case, imposing something closer to a direct reserve obligation on the acquirer: airlines. An acquirer signing an airline merchant for ticket sales must "Meet Visa capitalization and reserve requirements" and get Visa's approval of a risk business plan before submitting that airline's transactions. Airline ticketing is about as pure an example of future-delivery risk as exists in card acceptance, and it's the one merchant category in the public rules where the scheme itself puts a capitalization and reserve gate in front of onboarding.

Underwriting and monitoring signals specific to this exposure

The signals an acquirer's underwriting is expected to pick up on for a future-delivery merchant overlap with general merchant risk, but the delayed-delivery dimension adds its own layer. A verified understanding of the merchant's actual fulfilment lag — not just its stated category — matters more here than for an immediate-delivery business, because that lag is what stretches the exposure window. The OCC's guidance also lists financial-condition checks (credit bureau reports on the principals, financial statements or credit reports on the business, trade and bank reference verification) as standard underwriting inputs, and a merchant selling on future delivery is, structurally, asking the acquirer to trust that financial condition for longer before a given sale's risk has run off.

On an ongoing basis, examiners expect the financial condition of high-volume and high-risk merchants to be "regularly monitored," with frequency and threshold left to the bank's own policy. The trigger the handbook draws out specifically: "If credit information shows that the merchant's financial condition is deteriorating, the bank may want to reduce its risk exposure. For instance, when dealing with a financially unstable merchant, the bank may require a holdback reserve or security deposit." That's the mechanism by which a merchant's reserve terms can tighten mid-relationship — a credit-quality signal producing a defensive response, not a scheduled routine renewal.

Advance-payment and deposit structures — the transaction type underlying most delayed-delivery businesses — carry their own scheme-level disclosure obligation on top of underwriting. Visa defines "Advance Payment" as "A Transaction for the partial or full cost of goods or services that will be provided to the Cardholder at a later time." It requires the merchant taking one to obtain the cardholder's express informed consent to an agreement disclosing the total purchase price and the cancellation and refund policy, including the date any cancellation privileges expire without forfeiting the advance payment. That doesn't reduce the acquirer's credit exposure directly, but it narrows the disputes that can legitimately be filed against a properly disclosed transaction.

What happens when the merchant fails

This is the scenario the entire framework exists to absorb, and the OCC's handbook is unambiguous about it. Chargebacks become a credit exposure to the acquirer, in the handbook's framing, "when either the merchant or ISO/MSP declares bankruptcy or is otherwise financially unable to pay" — the chargebacks that continue arriving afterward are the acquiring bank's own loss, not a receivable it can pursue from a defunct counterparty. The contingent liability, in the handbook's own framing, "can span several months of the merchant's sales volume" because of the cardholder's ongoing right to dispute, and the scale can be severe: "Charge-back losses can deplete earnings and capital in a matter of days, causing a bank to fail." For a delayed-delivery merchant specifically, this is the tail risk the reserve was built to cover — the merchant collapses after taking payment for services it never delivers, and every one of those transactions is still inside its dispute window when the collapse happens, with no merchant left to absorb the chargebacks that follow. Visa's own waiting periods tilt further against the failed merchant here: the 15- and 30-day waits that would otherwise delay when an issuer can even bring a non-receipt dispute do not apply if the merchant is insolvent or bankrupt, so disputes on a failed merchant's outstanding transactions can arrive sooner, not later, than they would against a merchant still trading.

In practice, this is why it makes most sense for a reserve or holdback on a delayed-delivery merchant to be structured to outlive the merchant relationship rather than close the moment processing stops — that tail-off point is PaymentBrief's own reading of the mechanism above, not something the OCC's guidance states explicitly. A merchant that exits its acquirer still has open transactions sitting inside their dispute window on the day it leaves, and a reserve that closed out immediately wouldn't be there when a dispute on one of them arrives after the merchant is gone — a sharper version of the mechanic covered from the merchant's own cash-flow side in the working-capital cost of payments: the tail-off point isn't primarily about working-capital cost to the merchant, it's about having funds available for a dispute nobody expected to still be live.

What a merchant should expect, and the distinction worth keeping straight

None of the above is a merchant-facing rule. The OCC guidance is written for examiners assessing a bank; Visa's dispute-timing and airline-specific requirements bind the scheme and the acquirer, not the merchant directly. But the mechanism reaches the merchant through its acquirer or PSP contract, and understanding why it's there changes what's worth negotiating. A merchant with a genuine, long fulfilment lag should expect its acquirer to treat that lag as a distinct underwriting input — not evidence of bad faith, but a structural feature the acquirer's own risk framework requires it to account for. The reserve rate and hold period offered are commercial terms; what's worth pushing on is whether they're actually tied to the merchant's real fulfilment lag and dispute history, or set generically for its whole category. A merchant with a consistently short, well-disclosed lag and a clean dispute record has a real argument that its exposure window is shorter than a same-category peer's — easier to make once the mechanism is on the table. The reserve mechanics themselves are in merchant payout treasury operations and understanding PSP contracts.

Three different bodies of rules touch this exposure, and conflating them is the most common mistake in how operators talk about it. The OCC's Comptroller's Handbook is US bank supervisory guidance — what examiners expect a national bank's or federal savings association's risk management to look like. It is not binding on merchants. Visa's Core Rules and Product and Service Rules are scheme rules — binding on Visa members and, through their contracts, on merchants and acquirers — and are where the dispute rights and time limits that create this exposure live, along with the few direct acquirer-facing requirements such as the airline capitalization rule. The reserve percentage, hold period, and release terms a merchant actually signs are commercial contract terms, set by the acquirer or PSP within whatever supervisory and scheme framework applies to it — dictated wholesale by neither of the other two. Reading a reserve clause as a scheme mandate, or OCC guidance as if it set a merchant's actual reserve rate, gets the mechanism right and the source wrong.