You Move Everyone's Card Data, and You Answer for Every Failure in the Chain.
Protecting processors, ISOs, payment facilitators, and merchant-services providers
Payment processors, ISOs, payment facilitators, and merchant-services providers sit in the middle of the card-payment chain — onboarding merchants, routing transactions, settling funds, and handling cardholder data at scale. The defining feature is that the business touches enormous volumes of card data and is accountable for the integrity of every transaction it processes, which creates two linked exposures: a cyber and PCI breach when that data is compromised, and a technology or professional error-and-omissions claim when processing failures, outages, or integration defects cost merchants money. Add merchant fraud, chargebacks, and the reserve mechanics that follow, and the risk profile looks nothing like an ordinary technology vendor. A merchant-services business needs coverage built around cyber and data liability and technology E&O together.
Properly structured coverage protects the data, the processing itself, and the funds moving through it.
The Payment Processor's Signature Exposures
The defining exposure is the cardholder data: a breach of the card numbers, tokens, and transaction records the business handles at scale triggers forensic, notification, card-brand assessment, and PCI-fine exposure that dwarfs most other losses, which is why cyber and privacy liability sits at the center of the program. Running alongside it is technology and professional liability — processing errors, settlement mistakes, platform outages, and integration or API failures that harm merchants and invite E&O suits. Funds-handling and settlement put the business in the path of employee theft and crime loss, merchant fraud and chargeback exposure drive reserve and credit risk, and the regulatory frame around money movement and consumer protection exposes the board to D&O and regulatory claims.
Key Risks in Payment Processing
Payment processors and merchant-services providers face exposure related to:
A cardholder-data breach exposing card numbers, tokens, and transaction records
Processing errors, settlement mistakes, or platform outages that harm merchants
Integration and API failures that disrupt a merchant's ability to transact
Merchant fraud, chargeback, and reserve exposure flowing back to the processor
Funds-handling loss through employee theft or collusion
Regulatory and governance claims against the board and officers
The cardholder-data breach and the processing-error E&O claim are what most define the class.
Core Coverages for Payment Processors
A properly built merchant-services program typically includes:
Cyber & Privacy Liability — Covers a cardholder-data breach, forensic and notification costs, card-brand assessments, and PCI fines — the signature and most consequential coverage.
Technology / Professional Liability — Covers processing errors, outages, settlement mistakes, and integration failures that cause merchants financial loss.
Commercial Crime — Covers employee theft, funds-handling loss, and fraud against the business in the settlement chain.
Directors & Officers — Covers governance, strategy, and management decisions of the board and officers.
General Liability — Covers premises and ongoing operations and third-party bodily injury and property damage.
Media Liability — Covers advertising injury, content, and intellectual-property claims arising from the platform and its marketing.
Commercial Property — Covers offices, servers, and business personal property against physical loss.
Workers' Compensation — Provides legally required coverage for the workforce.
Umbrella / Excess Liability — Adds higher limits above the primary program given breach and E&O severity.
What's Commonly Overlooked
Merchant-services programs are most often weakened by:
Cyber limits and PCI-fine coverage too small for the volume of card data handled
No technology E&O for processing errors, outages, and integration failures
Chargeback, reserve, and merchant-fraud exposure left outside the program
Social-engineering and funds-transfer-fraud sublimits below the real threat
Media and contractual liability from merchant agreements overlooked
The gap that hurts most is cyber and PCI coverage that does not match the scale of card data the processor touches.
Real-World Claim Examples
A breach exposes cardholder data across thousands of merchants, triggering notification and card-brand assessments
A platform outage during peak hours stops merchants from processing and they claim lost sales
A settlement or integration error misroutes funds and merchants sue for the shortfall
A wave of merchant fraud leaves the processor holding chargebacks beyond the reserves collected
A social-engineering scheme diverts a settlement wire out of the funds flow
Any one of these can be significant, and the data-breach and processing-error claims are the most distinctive.
Regulatory & Compliance Context
Payment processors operate under a dense compliance frame layered on top of ordinary business law. PCI-DSS governs how cardholder data is stored, processed, and transmitted, and the card-network rules of Visa, Mastercard, and the other brands impose their own security, registration, and liability regimes. The CFPB reaches consumer-facing payment conduct, Bank Secrecy Act and anti-money-laundering obligations apply to the funds movement, state money-transmitter licensing applies where the business moves or holds funds, and the Gramm-Leach-Bliley Act governs the safeguarding of consumer financial information. This compliance weight shapes both the cyber and the D&O exposure.
Why Proper Placement Matters
Underwriters weigh transaction and dollar volume, the merchant mix and the risk level of the categories served, how cardholder data is secured and tokenized, PCI compliance status, chargeback and reserve practices, and prior breach and E&O losses. Because the exposures are severe and specialized, processor programs are placed through technology and cyber markets, frequently on an excess-and-surplus-lines basis where high volume, high-risk merchant categories, or loss history put the account outside admitted appetite. Scaling cyber and PCI coverage to the data volume, pairing it with real technology E&O, and sizing crime and social-engineering limits to the funds flow are the essential steps.
Our Approach
At Cory Washington & Co., we insure payment processors and merchant-services providers around the card data they move and the failures they answer for — placing cyber and PCI coverage as the foundation, pairing it with technology and professional E&O for processing and integration failures, and sizing crime and D&O to the funds flow and governance exposure. We also insure related businesses, including ATM operators, check cashing and money services, and crypto and digital-asset businesses.
You move everyone's card data and answer for every failure in the chain — we build the coverage to match it, cyber and technology E&O included.
All insurance descriptions on this website are provided by Cory Washington & Co. LLC strictly for general informational purposes. They are not intended to be, and should not be relied upon as, legal, financial, or insurance advice. The information presented is general in nature and does not guarantee the availability, terms, conditions, or scope of any insurance coverage. Actual coverage is determined solely by the specific policy language issued by the insurer and remains subject to underwriting approval. Nothing on this website creates or implies an agent-client relationship, binds coverage, or alters any existing policy. Cory Washington & Co. LLC expressly disclaims any liability for actions taken, or not taken, based on the content provided here. For advice regarding your particular situation, please consult directly with a licensed insurance professional at Cory Washington & Co. LLC or another qualified insurance professional, and always review your policy documents in full.
See the coverages a payment processor & merchant services business may carry — core, prevalent, and situational — plus the gap most often missed, in the Payment Processor & Merchant Services Coverage Checklist.
Complete the Payment Processor & Merchant Services Supplemental online in a few guided steps, download the fillable PDF, or browse all applications.
Frequently Asked Questions
How do I get payment processor & merchant services insurance through Cory Washington & Co.?
Request a quote or contact our team. We start with a short conversation about your operations, analyze your exposures, then negotiate payment processor & merchant services insurance across multiple carriers that compete for your account and present options with the trade-offs explained. Cory Washington & Co. LLC is licensed in all 50 states.
How are payment processor & merchant services insurance premiums priced?
Premiums vary from business to business. The main drivers of payment processor & merchant services insurance pricing are the nature of your operations, your revenue and payroll, your loss history, and the limits you carry. Rather than quote a flat figure, we negotiate across several markets and walk you through the options, so you only pay for the protection you actually need.
Is payment processor & merchant services insurance mandatory?
It depends on your situation. Some coverage is required by law; more often, payment processor & merchant services insurance is required by a contract, lease, lender, or client before they will do business with you — and even when it is not mandated, it guards against exposures that can be severe. We review your operations and obligations and tell you plainly what you need and why.
What if another agency has already declined or non-renewed my coverage?
Difficult, specialty, and previously-declined placements are a core part of our work. We access excess & surplus (E&S) and specialty markets that many generalist agencies cannot, and we explain the trade-offs clearly so you can decide with confidence.
Available in all 50 states. See how requirements differ in California, Texas, Florida, New York, or choose your state.