What changed in September
On September 11, federal banking and credit-union regulators requested comments on proposed third-party risk-management guidance. The proposal emphasizes tailoring oversight to the risk of a relationship and describes the guidance as nonbinding. It is a proposal for financial institutions, not a new merchant compliance rule. For business owners, the useful connection is practical: dependence should be understood before a critical service fails.
Draw the transaction, not the organization chart
Take one ordinary sale and follow its records. Identify who accepts the payment request, who returns the authorization, who reports the settlement and who reconciles the bank deposit. Beside each step, write the record identifier available to your staff. An authorization code, batch number and deposit reference answer different questions; treating them as interchangeable can send a support case in circles.
Ask for an escalation path that crosses company boundaries
Ask the provider who opens a downstream incident when the problem belongs to its partner. Can your business see the incident number? Who provides the next update? What information must be supplied, and what customer data should never be sent through ordinary email? Request these answers in writing and keep them with your operating procedures. A promise of continuous support is less useful than a named route for a missing settlement.
Rehearse a small failure
Use a tabletop exercise rather than disrupting live payments. Suppose yesterday’s sales appear in the point-of-sale system but the expected deposit is absent. Have staff assemble the batch report, settlement schedule and bank activity, then explain where they would escalate. Record what they could not find. This exercise tests the handoff without collecting extra sensitive data or making a test transfer.
Keep a usable exit record
Before renewing a service, establish which transaction reports can be exported, how long records remain accessible after cancellation and which equipment or integrations depend on the account. Store an approved export sample in your normal secured records system. The objective is continuity: the next employee should be able to reconstruct an unresolved payment even if the original salesperson or account manager is unavailable.
Retrospective analysis reviewed October 17, 2026. Primary source. Photograph: RDNE Stock project / Pexels, illustrative stock imagery.
Eric Kuvykin
Publisher and editorial director covering payments, fintech, merchant services, banking, AI, technology and operating strategy for small and medium-sized businesses.
