Page 22 - GS250802

Insights and Expertise

often come to the table with a pre-existing portfolio of
their own customers.

These could be veterinarians forming a portfolio of clients
of a VAR that is a veterinary clinic platform provider.
Legal ease: The VAR's primary business is to supply its veterinary
platform services to merchants. By integrating the
veterinary platform services with payments, the VAR
stands to increase the stickiness of its service, supply a
better service and perhaps earn more revenue if the ISO
shares residuals with the VAR.

The VAR is different from a typical agent because it must
It's a VAR's world: manage its own distinct business relationship with the
merchant. The VAR will be concerned about how adding
payments may impact that relationship. For example, if
Legal issues arising the payments integration does not go well, that might
have a negative impact on the core business. ISOs should
from ISO-VAR deals be attuned to this sensitivity of the VAR while still staking
out their own ground around the payments relationship.

By Adam Atlas 2. Data flows
Attorney at Law When zeroing in on getting APIs to work together, ISOs
might lose sight of the flow of data between cardholder,
ARs are all the rage in acquiring. A VAR is a merchant, VAR and ISO. An ISO that takes responsibility
third-party company that bundles payment for cardholder or merchant data should have a clear
processing services (merchant accounts, pay- understanding of the exact flow of data so that it can then
V ment gateways, POS systems) with its own isolate possible risks and create the right legal framework
software, hardware or services to sell a more complete for the data.
solution to merchants.
For example, if the VAR has collected merchant information
For example, a veterinary clinic software planform service such as company name, shareholder information, etc., to
could become an agent of an ISO and resell payment what extent will the ISO rely on that information or go
services to veterinarians that are integrated with the back to the merchant for fresh disclosure. The flow of
software platform. In this example, the veterinarian cardholder data, such as card numbers, is highly regulated
software platform business becomes a VAR for the ISO. under PCI-DSS requirements, and the ISO should make
sure that any party (VAR, the ISO itself or a third party)
VARs are different from classic, or traditional, agents has the necessary PCI certifications to hold cardholder
because VARs often have pre-existing relationships with data.
merchants. That pre-existing relationship complicates 3. Competing rights in data
the ISO's expectation of owning the relationship with the
merchant, at least as it relates to payments. Most acquirers expect to own data related to their merchant
processing relationships. The ISO should consider
Once upon a time, merchants were found grouped navigating two complicated sets of competing rights in a
around chambers of commerce or industry associations. single set of data, such as the merchant's identity.
Increasingly, merchants are clustered in portfolios that
cling to one digital platform or another. These clusters On the one hand, the VAR will want to own that information
of merchants make for ideal sales targets for ISOs—with in support of the equity value of its core business serving
help from the platform. Given the popularity of VAR the merchant (outside of payments). On the other hand,
relationships in the acquiring sales business, it's a good the ISO is duty-bound to acquire rights in that information
time to consider some of the legal issues that it presents for the acquirer or for itself.
for ISOs.
ISOs and VARs often advocate for a winner-take-all
1. Why a VAR is not just another agent outcome, where either the ISO or the VAR owns all

Historically, agents have not had a business relationship merchant data, each seeking to put the other in a secondary
with the merchants they solicit for an ISO. Indeed, the position. This kind of posturing is often unhelpful because
agent's primary connection to a merchant that they solicit it deprives the VAR of their rightful interest in merchant
has traditionally been the merchant services sold. VARs information for its core business, or it deprives the ISO of
its industry-mandated interest in merchant data.
22