Visa Third Party Agent Registration: Who Has to Register, and What Changes in October 2026

Most people building payments assume Third Party Agent registration is an ISO thing — something that concerns salespeople who sign merchants, and not a software company. Visa's own definition does not read that way.

An entity, not defined as a VisaNet Processor or Visa Scheme Processor, that provides payment-related services, directly or indirectly, to a Member and/or its Merchants or Sponsored Merchants or their agents.

Read the two phrases that do the work: payment-related services, and indirectly. The definition does not turn on whether you touch card data, whether you hold funds, or whether you have a contract with the bank. A vendor serving a merchant, two steps removed from any Member, is inside the wording.

This matters because registration is a precondition to processing anything at all, and it is not a process you control.

The obligation is your sponsor's, not yours

The rule places it on the Member:

A Member must register a Third Party Agent with Visa.

Through Visa's Program Request Management application and the appropriate regional forms. And the timing is unambiguous:

Registration must be completed before the performance of any contracted services or Transaction activity.

You cannot register yourself. Your go-live therefore depends on a workflow inside your sponsor bank, on forms you do not file, at a pace you cannot expedite. Operators building to a launch date routinely discover this late, because the integration work looks finished while the registration has not started.

It is also per acquirer. A separate registration is required by each acquirer that either uses its acquiring identifier for your traffic, or on whose behalf — or on whose merchants' behalf — you provide contracted services. In the LAC region it goes further: registration is per acquirer, per country, per agent. Adding a second sponsor is a second registration, not an amendment to the first.

What your sponsor must do before you can start

The due diligence sits on the Member, but every item of it lands on you as a request. Before contracting, a senior officer of the Member must review all documentation, and the Member must determine that you are financially responsible and adhere to sound business practices, comply with the registration programme, and conduct a background investigation of your principals to confirm no significant derogatory information exists.

Then, before registering you, the Member must perform an on-site inspection of your business location — to verify inventory where relevant, review your solicitation or sales materials, inspect operational controls, and check security standards around unauthorised access to Visa transaction information.

Two lines in this section are worth reading as an agent rather than as a bank.

Approval of a Third Party Agent must not be based solely on any purported limitation of the Member's financial liability in any agreement with the Third Party Agent.

You cannot indemnify your way to approval. And:

Registration of a Third Party Agent does not represent confirmation by Visa of the Third Party Agent's compliance with any specific requirement.

Registration is not accreditation. It is a record that a Member has told Visa you exist and has attested to its own due diligence. Presenting it to customers as a Visa approval misdescribes it.

The exemption, and the five categories it does not reach

There is one exemption, and it is narrow:

A Third Party Agent is exempt from the registration requirements if it only provides services on behalf of its affiliates (including parents and subsidiaries) that are Members that own and control at least 25% of the Third Party Agent.

So an in-house processing entity inside a banking group can sit outside the regime. Two conditions bind it: only affiliate services, and the affiliates must be Members owning and controlling at least 25%.

Then the carve-out from the carve-out, which is the part to check yourself against:

This exemption does not apply to Business Payment Service Providers, Consumer Bill Payment Service Providers, Marketplaces, Payment Facilitators, and Digital Wallet Operators that operate Staged Digital Wallets.

If you are a marketplace, a payment facilitator, or a staged wallet operator, bank ownership does not exempt you. A bank-owned marketplace registers like anyone else.

What changes on 24 October 2026

A disclosure expansion, in the US and Canada regions only.

From that date, as part of the registration process, Members must disclose to Visa the numeric IDs associated with the agent — and beyond that, the issuing identifiers, acquiring identifiers, all BINs, and any applicable account ranges the agent uses to perform contracted services or transaction activity on the Member's behalf, including in connection with end-consumer or merchant-facing programmes.

The Member is then responsible for both:

• maintaining accurate, complete and current information for each agent
• reviewing and updating that information annually, after any change, or on Visa's request

For an agent, the work is not the disclosure itself — it is the inventory behind it. Your sponsor will ask for a complete, current list of every identifier, BIN and account range you operate under, across every programme. Many agents have never assembled that in one place, and organisations that have grown by acquisition often cannot produce it quickly.

Start that inventory now rather than when the request arrives, and give it an owner, because the annual refresh makes it a standing obligation rather than a one-off.

Ongoing obligations people forget

Five business days. The Member must notify Visa of any change in your principals or business relationship — including a change of ownership or termination of contract — within five business days of the change or of learning about it. That is a short clock for a corporate event, and it means your sponsor needs to hear about ownership changes from you promptly.

Annual due-diligence review. A Member with a registered agent must perform an annual review confirming ongoing compliance with regional due diligence standards. Expect a yearly evidence request, not a one-time onboarding pack.

A contract, in two layers. These are separate rules and conflating them is a real trap.

The base requirement is unconditional:

A Third Party Agent must have a direct written contract with a Member to perform services on behalf of the Member.

No qualifier. No data-handling test, no solicitation test, no region scope. If you meet the definition of an agent, you need a direct written contract with a Member — full stop.

A second, narrower rule governs what that contract must contain. Where an agent performs cardholder or merchant solicitation, or stores, processes or transmits cardholder or transaction data, the contract must carry defined content — including language permitting Visa to conduct financial and procedural audits and general reviews at any time, a notice of termination clause, a requirement to comply with the Visa Rules and with PCI DSS, and execution by a senior officer of the Member.

So the population that needs a contract is everyone caught by the definition. The population whose contract must carry those specific clauses is narrower. Do not read the narrower trigger as an exemption from the base requirement.

Prohibition and where liability lands

Visa may permanently prohibit an agent and its principals from providing services with respect to Visa products for good cause — fraudulent activity, activity causing the Member to repeatedly violate the Visa Rules, operating in an unsound or unsafe manner, or other activity that could cause undue economic hardship or damage to the goodwill of the Visa system where the agent fails to take corrective action.

The reach to principals matters: it follows people, not just the company.

Liability, meanwhile, does not sit with you in the first instance. Where a Member fails to meet its responsibilities regarding agents, Visa assigns liability in a four-tier order of precedence: first the Member from whose performance or nonperformance — including by its agents — the loss arose; then the Member, if any, that sponsored it; then BIN licensees or acquiring-identifier licensees of the identifiers used in the transactions; then other BIN or acquiring-identifier users, in an order Visa determines.

The two tiers that matter to an agent are the first two, because that is where a sponsor's exposure sits and therefore where your contractual indemnities get negotiated. But the chain does not stop there, and it never starts with you: your commercial exposure is whatever your contract with the sponsor says it is, while the scheme's own ordering runs through Members and identifier licensees.

If you are a payment facilitator

The acquirer-side rules are stricter and the sequencing is explicit. An acquirer contracting with a payment facilitator must be in good standing in all Visa risk-management programmes and financially sound as determined by Visa, and must ensure its registration of the payment facilitator — including the attestation of due diligence review — is confirmed by Visa before submitting transactions on behalf of the facilitator or its sponsored merchants. A facilitator considered high-integrity risk must be registered as a High-Integrity Risk Payment Facilitator even if it was previously registered.

There is also an identifier detail that causes real reconciliation confusion:

• an authorization record must carry both the payment facilitator identifier and the sponsored merchant identifier
• a clearing record carries only the payment facilitator identifier

If your reconciliation joins authorization to clearing on sponsored-merchant identity, it will not join. That is by rule, not a bug in your acquirer's file. For the surrounding operating model, see PSP, PayFac and acquirer operations.

What the public rules do not tell you

Visa's registration programme sorts agents into categories, and the public Core Rules do not enumerate them. The document names specific types where a rule turns on one — payment facilitators, marketplaces, staged digital wallet operators, business payment service providers, consumer bill payment service providers — but there is no published list of agent categories with their definitions, fees or per-category requirements. That material sits in the registration programme documentation, which is not public.

This article therefore does not publish an agent-category taxonomy, a registration fee, or a processing timeline, because none of those could be taken from a document that resolves. Anyone quoting you a category or a fee is reading something you should ask to see.

Ask your sponsor two questions: which category do you intend to register us under, and what does that category require of us? They have to answer both to complete the filing.

What an operator actually does differently

• Put registration on the critical path, not the compliance checklist. It must complete before any contracted services or transaction activity, and you cannot file it yourself.
• Assume you are in scope until your sponsor says otherwise in writing. The definition catches indirect, payment-related services; it does not require you to touch card data.
• Build the identifier inventory now if you operate in the US or Canada — every numeric ID, issuing and acquiring identifier, BIN and account range, with an owner and an annual refresh date.
• Budget a second registration per additional sponsor, and per country in LAC.
• Tell your sponsor about ownership changes immediately. Their clock is five business days from learning of it.
• Do not market registration as Visa approval. The rules say plainly it confirms nothing about your compliance.
• Treat Mastercard as separate work. Its equivalent programme is not described here and its requirements should not be inferred from these.