Card, ACH and platform payment terms, defined in plain English

How to use this payments glossary

Terms are grouped into four topics, A to Z within each: a credit card processing glossary, ACH terms, platform payment models, and risk and compliance. A letter can come up again in a later topic, so scan all four groups. Guides across this site link straight to individual terms, and each definition points to the guide or page that covers it in depth.

Definitions are general and current as of October 2026. Card network rules, the Nacha Operating Rules and federal regulations change. Nothing here is legal, tax or compliance advice.

Browse the guides

Jump to the first term by letter: 0–9 A B C D E F I K M N O P R S T U V W

Card payments

3-D Secure (3DS)

An EMVCo protocol that authenticates the cardholder on online and in-app payments, invisibly or with a challenge such as a one-time passcode; v2.3.1.1 is current as of October 2026. It affects liability for fraud disputes.

Acquirer

The card network member bank that signs merchants and enters their transactions into the network. It stays responsible for merchants signed through ISOs or payment facilitators. See where the acquirer fits.

Authorization

The issuer, or the network on its behalf, approves or declines a card transaction. No money moves until settlement. See how a card payment moves.

Capture

Confirming an authorized sale so it can be cleared and settled, usually in batches. It is one stage in the life of a card payment.

Card network

The network, such as Visa or Mastercard, that links issuers and acquirers, carries authorizations and sets rules on interchange, disputes and surcharges. See networks, gateways and processors.

Card-not-present (CNP)

A card payment made without the physical card: online, in an app or by phone. Its interchange and fraud rules differ from card-present payments. See card processing for software platforms.

Cash discount

A lower price for paying by cash or another non-card method. Visa requires showing the card price alone or both prices side by side; a fee added at checkout may count as a surcharge. See cash discount rules.

Chargeback

A card payment reversed through the network after the cardholder disputes it with their issuer. The merchant can respond with evidence, under network rules and deadlines. Read chargebacks vs ACH returns.

Clearing

The step after authorization in which transaction details are validated and financially assessed before settlement. See what a processor does.

Compelling evidence

Evidence a merchant submits to answer a card dispute. Visa’s Compelling Evidence 3.0 criteria are updated for disputes processed from October 24, 2026, and qualifying fraud reports are left out of the VAMP ratio; confirm the current criteria with your acquirer. See evidence in disputes.

Convenience fee

A flat fee for paying through a genuine alternative channel. As of October 2026, Visa’s US rules allow it only when card-not-present payment is an alternative to the merchant’s usual channel, so a merchant that takes only card-not-present payments cannot charge one. It can’t be combined with a surcharge or used on recurring or installment payments. See convenience fee rules.

Dual routing

A Regulation II rule that debit issuers must enable at least two unaffiliated networks for every debit transaction, including card-not-present ones since July 1, 2023. See debit cards and Regulation II.

ECI (Electronic Commerce Indicator)

A value on an online card payment showing how the cardholder was authenticated. Under Visa Secure, ECI 5 (authenticated) and ECI 6 (attempted) protect the merchant from fraud disputes; ECI 7 does not. See 3-D Secure and disputes.

Encryption

Scrambling data so only a key holder can read it. Encrypted card data stays in PCI DSS scope wherever the key can be reached. Compare tokenization and encryption.

Funding

The acquirer or payment facilitator paying the merchant, net of fees, on its contract’s schedule. It follows settlement and is set by the contract, not network rules. See the four stages of a card payment.

Interchange

A fee set by the card network and paid by the acquirer to the issuer. Merchants pay a merchant discount rate that bundles it with other fees, and rates vary by card product, channel and merchant segment. Read credit card processing fees explained.

Issuer

The cardholder’s bank. It approves or declines transactions, bills the cardholder and receives interchange. See who does what in a card payment.

Merchant account

The underwritten relationship with an acquirer, or with a payment facilitator as a sponsored merchant, through which card funds settle. It is a different role from the gateway and the processor.

Merchant category code (MCC)

The code that classifies a merchant’s line of business. Mastercard requires the best-fitting MCC at onboarding, and some rules turn on it, such as Visa’s sponsored merchant threshold exemptions for utilities, medical, education and government.

Merchant discount rate

What a merchant pays its bank or provider to accept cards, typically a percentage per transaction with interchange inside it. A Visa credit card surcharge cannot exceed it. See the layers of a card fee.

Payment gateway

The software that captures payment data from a checkout or invoice and sends it on for processing. BrainMerchant is the gateway between software platforms and the payment networks. See our payment gateway for software platforms or gateway vs processor.

Processor

In network terms, the company connected directly to the card network for authorization, clearing and settlement. “Card processing” also names the whole service a merchant buys. Read payment gateway vs payment processor.

Regulation II (Durbin)

The Federal Reserve rule capping debit interchange for issuers with $10 billion or more in assets at 21 cents plus 0.05%, plus a 1-cent fraud-prevention adjustment: unchanged since October 1, 2011 and current as of October 2026. See debit interchange rules.

Representment

The merchant’s evidence, sent through its acquirer, that a charged-back payment was valid. ACH has no card-style equivalent. See how disputes are resolved.

Settlement

Funds moving between banks after clearing: issuers and acquirers for cards, ODFIs and RDFIs through an ACH Operator for ACH. It is not when a merchant is paid. See settlement and funding.

Surcharge

An extra charge for paying by credit card. Visa’s US rules, as of October 2026, cap it at the lesser of the merchant discount rate or 3% and require 30 days’ notice to the acquirer and disclosure at the point of entry, at checkout and on every receipt. State laws differ, and this is not legal advice. See where surcharges are allowed.

Tokenization

Replacing a card number with a substitute token. It can shrink PCI DSS scope but does not remove it, and the token vault stays in scope. See tokenization and PCI scope.

VAMP (Visa Acquirer Monitoring Program)

Visa’s program that merged its dispute and fraud monitoring. Its ratio divides card-not-present fraud reports plus disputes by settled card-not-present transactions, so a fraud report counts even when no dispute follows. See VAMP and other card monitoring programs.

ACH payments

ACCTVERIFY

The Company Entry Description that micro-entries must carry, required since September 16, 2022. See account validation with micro-entries.

ACH (Automated Clearing House)

The US network that moves money between bank accounts in batches under Nacha’s rules, as credits (push) or debits (pull), settling on a schedule rather than in real time. Read how ACH payments work.

ACH credit

An entry that pushes money from the Originator to the Receiver, such as payroll or a vendor payment. See ACH credits vs debits.

ACH debit

An entry that pulls money from the Receiver’s account into the Originator’s, such as a bill payment. It needs the Receiver’s authorization and can be returned. See ACH debits on a platform.

ACH Network

The banks, ACH Operators and rules that carry ACH payments in the US. Nacha administers it; the ACH Operators process and settle. See who runs the ACH Network.

ACH Operator

The central clearing facility that passes entries from ODFIs to RDFIs and settles between them. The US has two: FedACH and EPN. See the participants in an ACH payment.

ACH return

An entry the RDFI sends back with a reason code. R01 to R04 have a two-banking-day window; unauthorized consumer debits can be returned for 60 calendar days with a WSUD. A return is not a chargeback. See ACH return codes.

Banking day

A day the ACH Operators are open, under the definition in effect since January 1, 2026. As of October 2026, Nacha has proposed, but not adopted, a new definition from June 18, 2027: any day except Saturdays, Sundays and federal banking holidays. Comments are due October 23, 2026. See what’s next for ACH.

Batch

A group of ACH entries sent together in a file and processed on a schedule, one reason ACH is not instant. See how entries move between banks.

CCD (Corporate Credit or Debit)

The SEC code for payments to and from business accounts, such as vendor payments, with at most one addenda record. Authorization rests on the two businesses’ agreement. See business debit authorization.

Company Entry Description

A ten-character field that tells the receiver what an entry is for. Since March 20, 2026, wage credits must say PAYROLL and consumer online purchases of goods PURCHASE. See required entry descriptions.

CTX (Corporate Trade Exchange)

The SEC code for business payments carrying full remittance data, up to 9,999 addenda records. See SEC codes compared.

eCheck

A common name for an ACH debit authorized online or by phone. It is not a paper check: it follows the Nacha rules for its SEC code, WEB for online authorizations and TEL for phone ones. See ACH payment processing for platforms.

ENR (Automated Enrollment Entry)

A non-money entry a bank sends to a federal agency to enroll an account holder for that agency’s payments. It cannot go as Same Day ACH. See Same Day ACH rules.

Entry

Nacha’s word for one ACH payment instruction, credit or debit, with routing and account numbers and an SEC code. See what an ACH payment is.

EPN (Electronic Payments Network)

The Clearing House’s private-sector ACH Operator, one of the two in the US. See the two ACH Operators.

FedACH

The Federal Reserve Banks’ ACH service, the other US ACH Operator. See FedACH Same Day ACH windows.

IAT (International ACH Transaction)

The SEC code, defined in the Nacha Rules, for entries that are part of a payment into or out of the US. It cannot go as Same Day ACH. See entries Same Day ACH excludes.

Micro-entries

ACH credits under $1, plus offsetting debits that cannot exceed them, used to verify an account and labeled ACCTVERIFY. Since March 17, 2023, their Originators need commercially reasonable fraud detection. See account validation options.

Nacha

The organization that writes the Nacha Operating Rules and administers the ACH Network. It is not a government regulator and does not clear or settle payments. See Nacha’s role.

NOC (Notification of Change)

The RDFI’s notice that entry details, such as an account number, are outdated, with corrections. For recurring entries, apply them within six banking days or before the next entry, whichever is later. See NOCs and returns.

ODFI (Originating Depository Financial Institution)

An ODFI is the Originator’s bank, which sends its entries to an ACH Operator. Whether a platform is a Third-Party Sender depends on whose name is on the ODFI agreement. See the five ACH participants.

Originator

The business or person that starts an ACH payment through its bank, the ODFI. A debit needs the Receiver’s authorization. See what to collect before you debit.

PAYROLL

The Company Entry Description required since March 20, 2026 on PPD credits for wages and similar pay, but not pensions, reimbursements or tax refunds. See 2026 ACH rule changes.

PPD (Prearranged Payment and Deposit)

The SEC code for consumer credits or debits under a standing arrangement, such as payroll or bill payments. PPD debits need a signed or similarly authenticated authorization, with a copy for the consumer. See ACH authorization requirements.

Prenote

An optional zero-dollar test entry. With no return or NOC, live entries can start on the third banking day after its settlement date. Since June 21, 2024, prenotes can be sent at any time. See prenotes explained.

PURCHASE

The Company Entry Description required since March 20, 2026 on consumer WEB debits for online purchases of tangible goods, not services or bill payments. See entry descriptions for WEB debits.

R01 (Insufficient Funds)

The account could not cover the debit. The return window is two banking days, and the debit may be reinitiated at most twice within 180 days of settlement. See handling an R01.

R02 (Account Closed)

The account is closed. The return window is two banking days, and it counts toward the administrative return rate, so collect new account details rather than retry. See common return codes.

R10 (Customer Advises Originator is Not Known and/or Not Authorized)

Returned when a consumer says the debit was unauthorized or the Originator is unknown to them. Allowed for 60 calendar days with a WSUD, it carries an Unauthorized Entry Fee, and a retry needs new authorization. See unauthorized return codes.

R29 (Corporate Customer Advises Not Authorized)

Returned when a business says a debit to its account was not authorized. It has a two-banking-day window and counts toward the unauthorized return rate. See the R29 return code and its window.

R90 (Entry Returned Due to RDFI’s Sanctions Compliance Obligations)

From March 17, 2028, the return code for sanctions-related returns, taking that role over from R16. It is due at the ODFI by opening of business on the second banking day after the RDFI’s sanctions determination. See R16 and R90.

RDFI (Receiving Depository Financial Institution)

The Receiver’s bank. It posts entries to the Receiver’s account and sends returns and NOCs. See how an entry reaches the RDFI.

Receiver

The business or person whose account an entry credits or debits. The Receiver must have authorized the Originator. See how ACH authorization works.

Reinitiation

Resending a returned debit. After R01 or R09 it is allowed at most twice within 180 days of settlement, marked RETRY PYMT, with the same company name, ID and amount; unauthorized returns need new authorization. See retrying returned debits.

Same Day ACH

Entries that settle between banks on the day they are sent, in set windows; still batched, not real-time, and returns apply. As of October 2026, IAT and ENR entries are excluded, and the ODFI pays the RDFI a Same Day Entry Fee on each same-day entry. See Same Day ACH windows and limits.

Same Day Entry Fee

The fee the ODFI pays the RDFI on each Same Day ACH entry. A sponsor bank or processor may pass it through to the platform. See what ACH payments cost.

SEC code (Standard Entry Class code)

The three-letter code, such as PPD, CCD, CTX, WEB or TEL, that says what kind of entry a payment is and how it was authorized, which decides the authorization rules. See SEC codes explained.

Settlement date

The date an entry settles between the ODFI and the RDFI. Return windows, reinitiation limits and prenote waits count from it. See when ACH entries settle.

TEL

The SEC code for consumer debits authorized orally by phone. For a single TEL debit, record the authorization or send written notice before settlement, and keep it for two years. See phone authorizations.

Unauthorized Entry Fee

The fee the ODFI pays the RDFI for each debit returned as unauthorized (R05, R07, R10, R11, R29 or R51), usually passed on to the Originator or platform. See ACH return fees.

WEB

The SEC code for consumer debits authorized online or over a wireless network, and for person-to-person credits. Originators must run commercially reasonable fraud detection that includes account validation. See WEB debit validation.

WSUD (Written Statement of Unauthorized Debit)

A consumer’s signed statement that a debit was unauthorized, which allows a return for 60 calendar days after settlement. Since October 1, 2024 it can be signed on or after the day the entry is presented. See unauthorized return windows.

Platforms and payment models

CIP (Customer Identification Program)

The federal rule requiring banks to collect a customer’s name, date of birth (for individuals), address and ID number before opening an account, and to verify identity. For business customers, the CDD rule adds everyone owning 25% or more and one control person. In card programs, Mastercard expects acquirers and payment facilitators to run similar checks on merchants and their owners. See onboarding duties.

Embedded payments

Payments built into a software product, onboarding included, so your customers bill and collect where they already work. Read embedded payments for software platforms.

Integrated payments

A software product connected to a payment provider that its customers contract with directly, so the merchant relationship sits with the provider. See embedded vs integrated payments.

ISO (Independent Sales Organization)

An agent of the acquirer that signs up and supports merchants but, under Visa’s framework, does not process transactions, receive settlement funds or access card data. See payment facilitator vs ISO.

ISV (Independent Software Vendor)

A company that builds and sells software. In payments, a software company that offers payments in its product through a referral, an integration or an embedded model. See how software companies add payments.

KYB (Know Your Business)

Checking a business and its owners before onboarding it. Mastercard requires verified owner information, sanctions screening, a MATCH Pro query and an accurate MCC. See KYB and MATCH checks.

Marketplace

Under Visa’s rules, a narrow model: a branded e-commerce site or app that handles payments and refunds for its retailers, receives their settlement and is liable for disputes. See marketplaces and Platform Merchants.

MATCH

Mastercard’s database of merchants that acquirers have terminated for specific reasons. Acquirers and payment facilitators must query it through MATCH Pro before onboarding. See onboarding checks.

Merchant Servicer

A Visa third-party agent category for providers a merchant contracts with directly. Visa’s October 2026 guidance includes payment gateways and vertical SaaS platforms, registered through an acquirer. See Merchant Servicer registration.

Nested Third-Party Sender

A Third-Party Sender that sends entries through another Third-Party Sender, with no direct ODFI agreement. Since September 30, 2022, nested relationships must be disclosed. See nested sender disclosure.

PayFac-as-a-Service

A vendor label, not a network category: a provider runs the payment facilitator infrastructure and compliance while a platform offers payments. The provider is typically the registered PF, but contracts decide liability. See PayFac-as-a-Service compared.

Payment facilitator (PayFac or PF)

A company that signs sponsored merchants for an acquirer, receives their settlement, or both. The acquirer registers it and stays responsible for it and its merchants. A PF cannot sponsor another PF. See the PayFac model.

Platform Merchant

Mastercard’s term for a merchant that hosts third-party sellers online and accepts cards for their sales. It must run KYC on those sellers. See how Mastercard treats platforms.

Sponsored merchant

A business accepting cards through a payment facilitator; Mastercard says submerchant. Above $1 million in annual Visa volume, Visa generally requires a direct acquirer agreement, with exceptions. Mastercard’s threshold differs. See sponsored merchant thresholds.

Third-party agent (TPA)

Visa’s term for third parties such as ISOs, payment facilitators and Merchant Servicers, registered through an acquirer. One provider can hold several roles. See ISOs, PFs and Merchant Servicers.

Third-Party Sender (TPS)

A Third-Party Service Provider that itself holds the ODFI agreement and sends entries for customers who do not. Since September 30, 2022, each TPS must do its own ACH risk assessment. See Third-Party Sender rules.

Third-Party Service Provider (TPSP)

Any party performing ACH processing functions for another. A platform whose customers hold the bank agreement themselves is a TPSP, not a TPS. See where a platform fits in ACH.

Vertical SaaS

Software built for one industry, such as property management or healthcare. Visa lists vertical SaaS platforms among Merchant Servicer functions. See payments in vertical software.

Risk and compliance

Administrative return rate

The share of debits returned R02, R03 or R04 for account-data problems. Validating accounts before the first debit helps keep it low. See return rate limits.

AOC (Attestation of Compliance)

The signed declaration that sums up a PCI DSS assessment, by SAQ or ROC. Ask a payment provider for its AOC as evidence of validation. See what to ask about PCI.

ECM and HECM

Mastercard’s Excessive and High Excessive Chargeback Merchant labels for merchants over set monthly chargeback thresholds, which can bring fines. Confirm current figures with your acquirer. See card monitoring programs.

Fair Credit Billing Act

A federal law, carried out through Regulation Z, that lets consumers dispute credit card billing errors with their issuer within set time limits, separate from network rules. See consumer law and disputes.

False Pretenses

Nacha’s term for a payment authorized only because someone misrepresented who they were, whom they acted for or who owns the receiving account. See fraud monitoring requirements.

Form 1099-K

The IRS form for reporting payments to payees. As of October 2026, card sales have no minimum threshold, and third-party network payments are reportable above $20,000 and 200 transactions. A PF paying sponsored merchants takes on these duties. See payment facilitator duties.

Fraud monitoring

As of October 2026, Nacha requires banks, non-consumer Originators, TPSPs and TPSs to have risk-based processes to identify suspected unauthorized and False Pretenses entries. On the card side, Visa’s VAMP and Mastercard’s ECM and HECM labels measure merchants’ fraud and dispute levels instead. See Nacha’s 2026 fraud monitoring rules.

Money transmission

Holding and moving others’ money, which states license. A PF or marketplace that receives settlement funds may need a license; many states follow the CSBS model act and its conditional agent-of-payee exemption. Get legal review. See money transmission for PayFacs.

Overall return rate

The share of debits returned for any reason, with narrow exceptions; the broadest of Nacha’s three return-rate measures. See keeping return rates low.

PCI DSS (Payment Card Industry Data Security Standard)

The PCI Security Standards Council’s standard for anyone that stores, processes or transmits cardholder data or can affect its security, SaaS platforms included. The card brands, not PCI SSC, set validation levels. Read PCI compliance for SaaS platforms.

Regulation E

The federal rule that protects consumers in electronic transfers, including ACH. Recurring consumer debits need a signed or similarly authenticated authorization and a copy for the consumer. See Regulation E and recurring debits.

ROC (Report on Compliance)

The report from an on-site PCI DSS assessment, typically required each year for Level 1 service providers and for any service provider not eligible to self-assess. See PCI levels and validation.

SAQ (Self-Assessment Questionnaire)

A PCI DSS self-assessment form. The ones that come up for platforms and their merchants are SAQ A (card-not-present merchants that fully outsource card data), SAQ A-EP (e-commerce sites that can affect the payment page), SAQ D for Merchants and SAQ D for Service Providers. SAQ A and SAQ A-EP are for merchants only; a service provider’s only SAQ is SAQ D for Service Providers. See which SAQ applies.

Service provider (PCI DSS)

In PCI DSS, a business that handles card data for another business or can affect its security. Its only SAQ is SAQ D for Service Providers; otherwise it needs a ROC. See who PCI DSS covers.

Unauthorized return rate

The share of debits returned as unauthorized, such as R10 or R29. Nacha monitors it for Originators and Third-Party Senders. See return rate thresholds.