Merchant Examples and the Rules That Apply
A coffee shop, a web store, a plumber, and a big-box retailer can all be merchants. Here is how Visa and Mastercard define the role, and what it means for each.
A coffee shop with a card reader. A web store selling candles. A plumber who takes card payments over the phone. They look like different businesses, but the card networks see one role in all of them. This page uses merchant examples to show what that role is, and what rules come with it. For the full picture of the term itself, see the definition of merchant.
What a merchant is, in Visa's own words
Visa's guidelines define the pieces around the merchant.
Visa's guidelines define an acquirer as a client that signs a merchant or payment facilitator and directly or indirectly enters a transaction into Interchange. So a merchant is the party the acquirer signs. Visa's guidelines define a cardholder as an individual who is issued a card. That is the person on the other side of the sale.
Between them sits the thing being paid with. Visa's guidelines define a payment credential as a number or other credential that identifies a cardholder's account for use in a transaction. A merchant, then, is whoever accepts that credential as payment through the deal their acquirer signed.
The storefront with a terminal
The clearest merchant example is a shop with a counter and a card machine. Visa's guidelines define a point-of-sale terminal as the electronic device used for authorizing and processing Visa card transactions at the point of sale.
The hardware is not what makes the shop a merchant. A market stall with a small reader counts too. What makes it a merchant is the signed deal with an acquirer and the acceptance of payment credentials. The terminal is just where it happens.
The online seller and the subscription
A web store never sees a card. It still accepts payment credentials, so it is still a merchant. Many online sellers also bill the same customer again and again. Visa's guidelines define a recurring transaction as one in a series of transactions using a stored credential that represents cardholder agreement for future purchases.
A streaming service that bills monthly fits that definition. So does a meal-kit company or a software plan. Each one stores the customer's credential and charges it on a schedule the customer agreed to.
The freelancer and the tradesperson
A freelance designer who invoices by card link is a merchant too. So is a plumber who takes a card payment over the phone. Some of these sellers do not handle the payments themselves. Visa's guidelines define third party agents as entities that provide payment-related services to a client or its merchants.
So a solo worker can hand the payment work to one of those agents and still hold the merchant role. The sale runs through the agent, but the merchant is the one whose goods or services are being bought.
Small sellers and big ones: merchant levels
Is a small local shop a merchant the same way a giant retailer is? Yes. Mastercard's manual names merchant levels, and its rules differ by level.
Mastercard's manual says compliance with the PCI DSS is required for a Level 4 Merchant, although validation of compliance to Mastercard is not required. Mastercard's manual says a Level 4 Merchant may validate compliance with the PCI DSS by successfully completing an annual SAQ. Mastercard's manual says Level 4 Merchants may engage a PCI SSC-approved QSA to complete a ROC instead of performing an SAQ.
Mastercard's manual says a qualifying Level 1 or Level 2 Merchant outside the U.S. Region may use the PCI DSS Risk-based Approach. Visa's guidelines define the Payment Card Industry Data Security Standard as a set of requirements for protecting sensitive cardholder information.
Merchants in sensitive categories
Some merchant examples sit in categories the networks watch closely. Mastercard's manual says a merchant must have policies that prohibit using its website to promote or facilitate human trafficking, sex trafficking or physical abuse. Mastercard's manual says a merchant must give its acquirer monthly reports on flagged content, complaints and take-down requests.
These duties fall on merchants whose sites host user content or sell adult material.
The rules every example shares
Visa's guidelines also define terms that come up for every merchant above.
The first is authorization. Visa's guidelines say authorization is a process where an issuer, a VisaNet processor, Visa Scheme Processor, or Stand-In Processing approves a transaction.
The second is the address check. Visa's guidelines define the Address Verification Service as a service through which a merchant verifies a cardholder's billing address.
The third is a rare but odd one. Visa's guidelines define a pick-up response as an authorization response where the transaction is declined and confiscation of the card is requested. A merchant told to keep a card is being asked to act on that response. For Mastercard's rules, see mastercard merchant rules.
Finding your own merchant status
So how do you know what kind of merchant you are? Start with the basics. If you accept payment credentials under a deal signed by an acquirer, you are a merchant.
You also have an identifier. To learn about it, read what is a merchant id and the deeper merchant id meaning. That ID is how the networks and your acquirer point at your specific business.
Put the examples together and one pattern shows. A counter, a website, a phone line, or an invoice link. The shape of the sale changes. The merchant role underneath it does not.