POS and payments provider due diligence

Diligence on a POS and payments provider is largely a reconciliation exercise. Three sets of records describe the same business: the processor’s statements, the provider’s own books and billing, and the merchant contracts. When they agree, the buyer can trust the numbers. When they do not, the gap is the finding. The checks below start with the records that anchor the numbers, and each says what a result means, because the same document can be harmless in one business and fatal in another. Questions of price belong on the worth page. This page is about verification.

Reconcile the processor statements to the books

Ask for the processor’s residual statements for as many past periods as the seller can produce, and for the provider’s revenue records for the same periods. Match them merchant by merchant, not in total, because a total that agrees can hide offsetting errors, such as one large merchant overstated by the same amount that a block of small ones is understated. Look for chargebacks, adjustments, reserves and clawbacks recorded in one set and not the other, and for revenue booked before the processor reports it. A seller who can walk the buyer from processor statement to bank deposit to ledger line has a business that can be diligenced. A seller who cannot has told the buyer something, whichever way the explanation goes.

Rebuild the merchant cohorts

The merchant list is the asset, so test it. Ask for the full list with onboarding date, sector, pricing, contract term and status, then group merchants by the year they boarded and count how many still process. The shape matters. A steady decline may reflect ordinary churn, while a cliff after a promotion may point to merchants who were bought rather than won. Check that the highest-volume merchants are real, are under written contracts and are not related to the seller. A list supplied only as a summary, with no merchant-level detail, is a finding in itself, because it prevents every other test in this section.

Read the processor agreement against the structure

The reseller or residual agreement is read twice, once for what it says and once for what it says about this particular deal. Look at the remaining term, how either side can end it, whether it can be assigned under its assignment clause, whether a change-of-control clause applies, and whether the processor can change the split or buy the portfolio. Then ask the processor, through the seller, for a written position on the buyer. A refusal to reunderwrite, or an unwillingness to say either way before closing, is a serious finding, because the stream the buyer is paying for may not transfer. Ask for any side letters, and ask the seller to confirm in writing whether any exist.

Registry searches and what a hit means

Search the personal property registries in each province where the seller or its assets are located. Ontario’s Personal Property Security Act maintains a registration system in which a secured party registers a financing statement, says that registration perfects a security interest, and defines types of personal property that include equipment, inventory and intangibles. Intangibles is a broad category covering personal property that is not goods, chattel paper, documents of title, instruments, money or investment property. A registration naming the seller means a secured party has, or may intend to take, a security interest in the collateral it describes, since the Act lets a financing statement for collateral other than consumer goods be registered before or after the security agreement is signed. The buyer needs to know which assets are caught and how the claim will be discharged at closing. The answer on running a PPSA registry search covers the mechanics. Quebec keeps its own register of personal and movable real rights under the Civil Code, and it is searched separately.

Regulatory and card-security records

If the business is a money services business, ask for its FINTRAC registration details. FINTRAC says such a business must register before operating in Canada and, where it engages agents, must verify their eligibility, obtain and keep certain documents, and obtain and review criminal record checks. If the seller says the business is not a money services business, ask for the reasoning, because FINTRAC distinguishes a provider of payment services for goods or services from one that solely supplies hardware or acts strictly as an agent of a money services business. For PCI-DSS, ask for the attestations and their scope, merchant by merchant wherever the provider is responsible, and ask how the standard applies to the business under its processor agreement.

Privacy and security incident records

Ask to see the breach record. Under PIPEDA an organization must keep a record of every breach of security safeguards involving personal information under its control, whether or not it posed a real risk of significant harm. It must report to the Privacy Commissioner, and notify individuals unless otherwise prohibited by law, if it is reasonable in the circumstances to believe a breach creates such a risk, and the Commissioner can ask to see the records. A provider with no entries at all deserves a question, because the duty covers every breach and not only reportable ones. In Quebec the privacy regulator says organizations must keep a register of confidentiality incidents, give it to the Commission on request, and notify the Commission and the people affected when an incident carries a risk of serious injury. Quebec businesses must also publish the title and contact details of the person responsible for protecting personal information on their website, or by other appropriate means if they have none, which is quick to check.

Findings that end deals, and what each one means

• The processor will not reunderwrite the buyer, or will not say: the stream may not transfer, so the price and the structure both need to be revisited before anything else is signed.
• Statements and books diverge without explanation: the earnings the price rests on cannot be confirmed.
• A registry search shows a lender’s claim the seller did not mention: the debt has to be dealt with at closing, and an omission of that size raises a question about what else was left out.
• A registration gap, or no reasoned analysis, under FINTRAC rules for a business that provides payment services: the buyer would inherit the compliance problem and should expect counsel to advise on it.
• A breach record that is empty, or an incident that was never recorded: the privacy exposure is unknown and nothing in the price caps it.