Industry · High-risk
On 4 September 2026 the Federal Trade Commission announced a $4.85 million settlement with Nuvei, the Montreal payment company. Four days later it announced a $12 million settlement with Humboldt Merchant Services, the Tempe, Arizona high-risk ISO that is a corporate affiliate of North. Both companies are reviewed on this site — Nuvei at B, Humboldt at B- — and neither review listed the action when the orders were entered. Both settled without admitting the allegations. Both are now under federal orders that spell out, in numbers, what a processor must check before it opens an account and what chargeback rate obliges it to investigate. We read the two complaints and the two orders in full. This is what is in them, and what a business applying for a merchant account — at these companies or anywhere else — should expect to change.
The short version: the FTC's theory in both cases is that a processor which knew, or consciously avoided knowing, that its merchants were defrauding consumers is itself liable under Section 5 of the FTC Act. The evidence it cites is not exotic. It is chargeback ratios, MATCH listings, mailbox addresses and card-network warnings — the same things every underwriter already looks at. What the orders do is convert those signals from judgment calls into written rules with thresholds, and the thresholds are lower than the card networks' own.
Humboldt is a registered ISO of BMO Harris Bank under a sponsorship agreement dating from December 2009, and markets itself to 'tough to place' merchants. The complaint, filed in the Eastern District of Michigan on 8 September 2026, alleges that for years it processed for more than a thousand merchants that were shell entities — fronts for third parties running unauthorised-billing schemes, most of them selling nutraceutical supplements through 'free' trial offers that rolled into subscriptions. The FTC's press release puts the volume at more than $100 million through those accounts from 2021 to 2023; paragraph 117 of the complaint puts it at 'at least $139 million' from January 2021 through January 2024, about a quarter of everything Humboldt processed from its two main referral agents in that period.
The mechanics are worth understanding, because they are what the order is written to stop. A firm the complaint calls Reseller Consultants recruited individuals with the promise of $750 a month, had them form an LLC, open a box at a UPS store and a bank account in the LLC's name, then handed the bank access and the merchant account to an 'advertiser' who ran the actual business. The signer's involvement ended at the signature. In December 2023 the Department of Justice filed a sealed complaint to stop what it described as ongoing wire and bank fraud by Reseller Consultants, and a court put the firm into receivership the following month. One of its customers was Legion Media, which the FTC sued in June 2024 for a 'free gift' scam that billed consumers repeatedly after a small shipping fee; the court shut it down that September.
The FTC says Humboldt had every warning. Mastercard told it during reviews from 2017 to 2019 that thousands of its accounts appeared to be involved in load balancing and card sharing. A senior Humboldt underwriter warned management in 2019 that the company had for years opened shell accounts with straw signers used for 'obvious load balancing'. The accounts came mainly from two outside sales agents, one of them a close friend of Humboldt's president, who the complaint says secretly split the agent's residuals. And at the end of 2020, Humboldt moved its 'Performance Marketing' accounts from its own BIN onto a lower-risk BIN licensed to its affiliate NorthAB, LLC — the former North American Bancard — because it believed approval rates would rise. By 2021 those accounts were charging back at over 7% of sales, almost a hundred times the NAB BIN's overall rate.
Humboldt's statement to Payments Dive was that the agreement 'formalizes many processes and controls already put into place', that the matter closes 'with no admissions of wrongdoing', and that the conduct 'occurred under former Humboldt leadership'.
The Nuvei complaint, filed in the District of Arizona on 3 September 2026 against Nuvei Corporation and four subsidiaries including the former SafeCharge companies in Cyprus and Guernsey, centres on one merchant. Reimage, later also trading as Restoro, sold 'repair' software for $30 to $60 through pop-ups made to look like Microsoft virus warnings, then routed buyers to call centres in the Philippines and India that sold remote tech-support plans at $300 to $500 — or, in one cited case, $1,000 for the same package. The FTC sued Reimage itself in March 2024 and obtained a $26 million judgment. Nuvei, the complaint says, processed more than $30 million for it between 2017 and 2023.
The specifics are what make it a processor case rather than a merchant case. Reimage's accounts at Nuvei exceeded the 1% chargeback threshold in 57 of the 60 months from January 2018 to December 2022, often at 4% to 9%, and the FTC alleges the volume was spread across multiple accounts and merchant-of-record entities to keep any one of them under the networks' radar. In early 2020 Visa warned Nuvei that Reimage was impersonating Microsoft; in May 2020 it rejected Reimage's response and fined Nuvei €25,000, which Nuvei deducted from Reimage's proceeds. Nuvei then, the complaint says, took on more of Reimage's volume, including auto-renewing subscription charges. An internal message quoted in the complaint has the head of risk management saying, 'The only [thing] that we can do is to trust them that they stopped it.'
Three other merchants appear. DK Automation, a business-opportunity seller with false earnings claims, processed more than $10 million before Nuvei closed it in late 2021. American Tax Service, which the FTC and Nevada sued in October 2025 for impersonating tax authorities, was approved at $300,000 a month despite a signatory's bank-fraud conviction and processed $6.6 million in a year. And Premier Health Solutions, a medical-discount-plan seller that had been placed on MATCH in 2020 for excessive chargebacks and sanctioned by three state regulators in 2022, was onboarded in late 2023 and processed more than $90 million in eighteen months until Nuvei's sponsoring bank instructed it to terminate the account in June 2025.
Nuvei's statement: 'The settlement covered processing with five former merchant accounts, representing less than 0.011% of transaction volume across our portfolio of more than 150,000 merchants.' It added that it 'cooperated fully throughout this process' and that the settlement's obligations 'are consistent with the direction of our existing program, and implementation is already underway'.
This is the part a merchant can use. Both orders are permanent injunctions, and both list categories a processor may no longer serve, questions it must ask before boarding, and numbers that oblige it to investigate an account it already has.
Neither order binds any other processor. But both complaints are built on the card networks' existing rules, which the Nuvei complaint sets out at length: an acquirer or ISO must establish a merchant's identity and principals, its business location, what it sells, how it sells it, its marketing practices and its volume; it must check MATCH; it must classify outbound telemarketers under MCC 5966 and screen them harder. The FTC's position is that a processor which has those rules and does not follow them 'should have known'. That is the standard every sponsor bank will now hold its ISOs to, and it arrives at the merchant as a longer application. Our guide to who actually holds your merchant agreement explains why the ISO, the payfac and the acquiring bank each have their own reason to ask.
Expect to be asked for, and to have ready: evidence of a physical business address that is not a mailbox — a lease, a utility bill, a photograph of premises; processing statements covering at least the past two years, or a plain statement that you have none; your current marketing pages and, if you sell a trial or a subscription, the exact enrolment and cancellation flow; your chargeback and refund counts by month; a list of every entity you or your principals have processed under; and a disclosure of any regulatory or attorney-general action naming the business or its owners. The Humboldt order treats a mailbox-only address plus a trial offer as a refusal category. Other underwriters will treat it as at least a reason to ask.
The chargeback figures deserve a second look. The Nuvei complaint describes Mastercard's programme as starting at 100 chargebacks and 1% in a month, with 'excessive' status at 1.5% for two consecutive months. The orders set investigation at 1% and 50 or 75 chargebacks, over two months in six. A merchant who has been managing to the networks' numbers is now, at these two companies, above the line that triggers a file review. The networks' own thresholds have also moved this year; our guide to chargeback monitoring in 2026 has Visa's current figures.
A Humboldt merchant who fits none of the banned categories has, on the face of the order, nothing to do. One who does — an ecommerce-only business selling a negative-option offer from a UPS Store address, say — should assume the account cannot continue and should start a replacement application now, because a termination for cause carries the risk of a MATCH listing, and getting off MATCH is far harder than avoiding it. The order also forbids Humboldt from balancing one merchant's volume across several accounts or descriptors, so a merchant that holds multiple MIDs for one business should expect them to be consolidated. Humboldt's review already notes that it publishes no reserve policy and that almost all of its BBB complaints concern reserves being held; a closure under this order does not shorten a reserve.
The North relationship matters for a different reason. The complaint establishes that Humboldt onboarded merchants through NAB's separate sponsorship agreement with BMO Harris from October 2020 — a BIN whose credit policy, the FTC notes, restricts the very merchant types Humboldt was placing on it. Humboldt's review already warns that a quote from Humboldt and a quote from North are not two independent quotes. The order applies to Humboldt and to 'all other Persons in active concert or participation' with it who receive notice; North is not a defendant.
For Nuvei's merchants, the practical change is screening and monitoring rather than a ban, unless you sell tech support by phone or pop-up. Nuvei serves large, mostly international merchants — its review says it suits merchants processing $500,000 a month or more and not small businesses — and its statement is that the order's terms match a programme already under way. The one thing to watch is the Payoneer acquisition announced on 15 June 2026: $7.40 a share in cash, about $2.75 billion, expected to close in mid-2027. Payoneer is not named in the order, but its future parent is bound by one for a decade.
Neither of the site's reviews listed these actions at the time of writing. Our guide to high-risk merchant accounts covers the reviewed alternatives for a merchant who now needs one, and what each publishes about its own underwriting.
