Payment processors have long focused their compliance efforts on managing risk among the merchants they serve, including by using enhanced underwriting and monitoring to reduce the risk of facilitating unlawful merchant conduct. Recent enforcement activity shows that the Federal Trade Commission (FTC) and other federal regulators are now also devoting significant attention to the other side of that relationship: how payment processors market, sell, bill, and provide services to merchants and other business customers.
The trend is particularly important for innovative software and financial technology companies that combine payments with subscription-based software and other services. Pricing claims, automatic renewals, recurring billing, and customer complaints about cancellation practices and so-called hidden or junk fees can all attract scrutiny, even in commercial relationships between sophisticated businesses.
While companies may have meaningful defenses to applying traditional consumer protection theories in the B2B context, recent enforcement actions—and even private lawsuits—show why payments and fintech companies should be prepared both to defend legitimate commercial practices and to demonstrate that their contracts, disclosures, billing practices, and operational controls support that defense.
In our experience representing payments and fintech companies in FTC and other law enforcement matters, these cases often turn on more than the challenged practice itself. The company's contemporaneous contracts, disclosures, policies, complaint data, and internal records can be critical to explaining the business practice, challenging the government's characterization of it, and ultimately shaping the outcome of an investigation.
FTC Enforcement Expands into B2B Payment Processing
In recent cases, the FTC has increasingly treated merchants (especially small businesses) that buy payment processing and related services as "consumers," applying familiar consumer protection theories to business-to-business (B2B) sales and contracting practices. The FTC has pushed even further in the contexts of subscriptions and automatic renewals, arguing that protections traditionally associated with online consumer transactions can apply to B2B arrangements. That includes use of the Restore Online Shoppers' Confidence Act (ROSCA), enacted against the backdrop of deceptive online negative option marketing, in cases involving commercial customers.
Fintechs and payment processors may have meaningful defenses to some of these expansive theories, but they should not build compliance programs around the expectation of eventually winning that legal argument. The better approach is to preserve two lines of defense: challenge overbroad readings of the law where appropriate, while maintaining practices and records that show clear disclosure, consent, and fair dealing. Implemented carefully, those safeguards need not come at the expense of product development or revenue generation; they allow companies to pursue legitimate commercial goals while positioning themselves to prevail on the facts even if the legal argument fails.
Another feature of recent payments enforcement is the FTC's coordination with state and local law enforcement. State consumer protection statutes can provide independent theories of liability and remedies, including civil penalties and restitution, and state enforcers may have particular interests in protecting businesses and customers in their jurisdictions. For companies facing an investigation, that can mean responding not just to one regulator and one body of law, but to a coordinated federal and state enforcement effort.
States also need not wait for the FTC to act. New York's FAIR Business Practices Act, for example, significantly expanded the attorney general's authority under General Business Law § 349 to challenge unfair and abusive, as well as deceptive, practices and removes the "consumer-oriented" limitation for attorney general enforcement. That expansion expressly reaches B2B transactions, giving New York another avenue to scrutinize sales, pricing, billing, and cancellation practices involving business customers. Other state UDAP laws and enforcement authorities likewise can create risk independent of any federal action.
Key Compliance Risks for Payment Processors and Fintech Companies
Recent enforcement activity suggests that several areas deserve particular attention in the B2B context.
- Sales claims and pricing comparisons. Claims about savings, processing rates, "free" equipment, or advantages over competitors should be substantiated and consistent with the customer's likely total costs. Quotes, pricing summaries, and sales presentations should tell a story consistent with the fees and obligations contained in the agreement.
- Fee and pricing disclosures. Processing, monthly, equipment, PCI compliance, chargeback, early termination, and other material fees should be clearly and conspicuously disclosed before the customer commits. Companies should also consider whether customers can understand how pricing is calculated and when rates and fees may change. A defense is much stronger when customer-facing materials explain the economics of the transaction clearly rather than leaving material conditions solely to linked contractual terms. Fees that are buried in fine print, introduced after enrollment, or calculated in ways the customer could not reasonably anticipate are a recurring focus of enforcement.
- End-user fees. Where a processor or platform imposes a fee on its merchant or directly on the merchant's customer, the relevant issues may include who authorized the fee, who receives it, what service it supports, and how it is presented. A platform fee is not inherently an unauthorized or "junk" fee, but clear contractual authority and disclosure can be critical to defending it.
- Sales agents and scripts. Written scripts, training materials, compensation structures, recorded calls, and monitoring can become evidence for either side. Companies should understand not only what their approved materials say, but also what employees and independent sales agents actually tell prospective customers. The same is true of representations regarding product functionality, pricing, and customer service availability.
- The merchant or customer agreement. Commercial contracts matter, particularly when sophisticated businesses are purchasing payment processing, software, and related services. The defense is strongest when advertisements, sales presentations, quotes, enrollment flows, and the agreement tell a consistent story about pricing, contract length, renewal, equipment obligations, early termination fees, and other material terms.
- Cancellation versus right to terminate. Fixed-term commercial agreements can legitimately impose notice requirements and consequences for early termination. Companies should nevertheless be able to distinguish enforcement of contractual rights from operational obstacles that prevent customers from exercising the rights they actually have. The written cancellation policy also needs to match how cancellation works in practice.
- Billing authority. A disputed ACH debit is not necessarily an unauthorized debit. Merchant agreements often authorize debits for processing fees, equipment, chargebacks, termination amounts, and other obligations. Companies should be able to connect a challenged charge to clear contractual authority, documented consent, and an explainable calculation.
- Integrated financial products. Payments companies increasingly combine processing with lending, payroll, software, and other financial products. Cross-defaults, acceleration provisions, exclusivity requirements, or other connections among those products may serve legitimate business and risk-management purposes. Companies should understand and document those purposes and consider whether customers receive appropriate disclosure of material restrictions or consequences.
- Customer complaints. Regulators may use complaints and internal communications to argue that a company knew of recurring problems. But complaint data can also be powerful defense evidence. Tracking complaint volumes, outcomes, refunds, resolution times, and corrective measures can provide important context and help distinguish isolated disputes from systemic practices.
How Fintech Companies Can Prepare for Regulatory Investigations
Companies that review these practices now, and document both their conclusions and any changes made in response, will be better positioned to reduce enforcement risk while continuing to pursue legitimate product and revenue goals. Just as importantly, they will have a contemporaneous record to rely on if their practices are later viewed through the lens of an enforcement investigation. The most useful question for a payments or fintech company to ask is how its records would read to a regulator reviewing them after the fact: do they show a company that dealt with customers transparently and fairly, and that identified and fixed problems when they arose? That story should be reflected in its sales materials, contracts, disclosures, consent records, billing practices, cancellation procedures, complaint handling, and internal communications.
Enforcement investigations are inherently retrospective. Regulators can review years of customer complaints, internal communications, billing data, and business decisions together, with the benefit of knowing how events ultimately unfolded. That hindsight can make individual mistakes or decisions that appeared reasonable at the time look like evidence of a broader practice. Contemporaneous records showing what the company knew, why it made particular decisions, and how it responded when problems emerged can provide critical context.
Enforcement complaints are mostly built from the company's own records. Regulators can use screenshots, sales scripts, customer complaints, internal emails and chats, contracts, enrollment flows, support records, and company research to construct a narrative that the company knew what customers were experiencing but continued the challenged practices. A company facing that narrative needs to be able to tell the other side of the story, using those same records to show how its practices worked, why decisions were made, and how issues were identified and addressed.
That is why building the defense before an investigation begins can be so helpful. We have seen strong contemporaneous records make a meaningful difference in defending practices, narrowing the government's theories, and resolving investigations. The same clear contracts, disclosures, records of consent, operational controls, and complaint management practices that reduce enforcement risk can become the evidence needed to defend legitimate business practices when they are challenged. Good compliance and good litigation defenses are often the same thing.
Organizations seeking guidance on these developments or their potential impact are encouraged to contact the authors.