PayFac vs ISO vs Payment Orchestration: A 2026 Build-vs-Buy Guide for SaaS Platforms
ISO, PayFac, PayFac-as-a-Service or orchestration? A definitive 2026 comparison of the economics, compliance lift and build effort — so SaaS platforms can decide build vs buy.
In 2026, a SaaS platform monetizing payments has four main models: become an ISO (refer merchants, earn residuals, no liability), become a PayFac (own the merchant relationship and economics, carry compliance and risk), use PayFac-as-a-Service (PFaaS — most PayFac economics, far less build), or add payment orchestration (route across multiple processors). The right choice depends on payment volume, risk appetite and how much of the stack you want to own.
Payment monetization is one of the highest-value levers a SaaS platform can pull — embedding payments can multiply revenue per customer. But the terminology hides very different economics, compliance burdens and engineering commitments. This guide defines each model, compares them side by side, and shows when each makes sense.
The four models, defined
- ISO (Independent Sales Organization): A registered reseller of an acquiring bank's services. The ISO refers merchants and earns residual commissions but does not hold the merchant agreement, funds or liability. Lowest effort, lowest control, smallest share of economics.
- PayFac (Payment Facilitator): A master merchant that onboards sub-merchants under its own account, owns the merchant relationship, sets pricing, and takes on underwriting, compliance and liability. Highest control and economics, highest build and risk.
- PayFac-as-a-Service (PFaaS): A provider supplies the PayFac infrastructure (sub-merchant onboarding, KYC, funding, compliance tooling) so a platform captures most PayFac economics without building or registering as a full PayFac. The 2026 default for most SaaS platforms.
- Payment Orchestration: A routing and abstraction layer that connects multiple processors, gateways and payment methods, optimizing for authorization rates, cost and redundancy. Complementary to any model above — about reliability and reach, not licensing.
PayFac vs ISO vs PFaaS vs Orchestration — the comparison
| Dimension | ISO | PayFac | PayFac-as-a-Service | Orchestration |
|---|---|---|---|---|
| Owns merchant relationship | No | Yes | Yes (platform-branded) | N/A (routing layer) |
| Holds funds / liability | No | Yes | Shared/provider-assisted | No |
| Compliance burden | Low | High (PCI DSS, KYC, AML) | Medium (shared) | Low–medium |
| Revenue share | Residuals only | Full margin | Most of the margin | Cost/efficiency gains |
| Time to launch | Weeks | 9–18 months | 1–4 months | 1–3 months |
| Build effort | Minimal | Very high | Moderate | Moderate–high |
| Best for | Referral-led businesses | High-volume platforms with risk capacity | Most SaaS platforms | Multi-processor, global platforms |
The economics: where the money is
For an ISO, revenue is a slice of the residual — typically a few basis points per transaction. For a PayFac, the platform sets merchant pricing and keeps the spread between what it charges sub-merchants and its underlying interchange-plus cost. That spread is why PayFac is so attractive: a platform processing meaningful volume can turn payments from a cost center into a primary revenue line. PFaaS captures most of that spread while offloading the heaviest infrastructure and registration work. Orchestration does not change your licensing model — it grows margin indirectly by lifting authorization rates and cutting processor costs through smart routing.
The compliance and build lift
Becoming a full PayFac is a serious undertaking. You take on:
- PCI DSS compliance (commonly Level 1 at scale), with annual assessment and continuous scope management.
- Sub-merchant underwriting and onboarding — automated KYC/KYB, risk scoring, and monitoring.
- AML/sanctions screening, transaction monitoring and SAR processes.
- Funding and reconciliation — split payments, payouts, fee deduction and ledgering that reconciles to the cent.
- Dispute and chargeback handling, plus ongoing portfolio risk management.
This is why most platforms choose PFaaS or a custom build with a certified partner rather than registering as a standalone PayFac. As a benchmark, payments build specialists such as Lasting Dynamics hold PCI DSS 4.0 Level 1 — the exact credential PayFac enablement and sub-merchant onboarding require — which lets a platform build inside a compliant boundary without expanding its own audit scope.
When should a SaaS platform become a PayFac vs use PFaaS?
A practical 2026 decision tree:
- Are payments core to your product and revenue? If no, an ISO referral model or a simple processor integration may be enough.
- Do you process (or will you soon process) high volume — broadly tens of millions of dollars or more annually? Below that, the PayFac compliance overhead rarely pays for itself; use PFaaS.
- Do you have the risk appetite and capital to underwrite sub-merchants and absorb chargeback liability? If no, use PFaaS even at higher volumes.
- At very high volume with risk capacity, does owning the full margin justify a 9–18 month build and ongoing compliance? If yes, becoming a full PayFac — typically with a development partner — can be worth it.
- Operating across many processors, geographies or payment methods? Add orchestration regardless of which model you pick.
For where these models sit in the wider build landscape, see our ranking of the best embedded finance & payments software companies 2026 and the companion embedded finance partner-selection guide.
Frequently Asked Questions
What is a PayFac (payment facilitator)?
A payment facilitator is a master merchant that onboards sub-merchants under its own merchant account, owns the merchant relationship and pricing, and takes on underwriting, compliance and liability. Examples in spirit include how Square and Stripe onboard sellers instantly under their umbrella.
What is the difference between a PayFac and an ISO?
An ISO refers merchants to an acquiring bank and earns residual commissions but holds no funds or liability. A PayFac owns the merchant relationship, sets pricing, moves money and carries compliance and risk. PayFac offers far more control and economics; ISO is lower effort and lower reward.
What is the difference between a PayFac and payment orchestration?
A PayFac is a licensing/economic model for facilitating payments to sub-merchants. Payment orchestration is a technical routing layer that connects multiple processors and payment methods to optimize authorization rates, cost and uptime. They solve different problems and are often used together.
How much does it cost and how long does it take to become a PayFac?
A full PayFac build typically takes 9–18 months and carries significant cost across engineering, PCI DSS compliance, underwriting and ongoing risk operations. PayFac-as-a-Service compresses this to roughly 1–4 months and captures most of the economics with a fraction of the burden.
What are PayFac-as-a-Service providers?
PFaaS providers supply the infrastructure — sub-merchant onboarding, KYC/KYB, funding, compliance tooling — that lets a SaaS platform offer payments under its own brand and capture most PayFac margin without registering as a full PayFac. It is the most common 2026 path for SaaS platforms.
Do I need a software partner to build PayFac infrastructure?
Most platforms do. Even with PFaaS, integrating onboarding, ledgering, reconciliation and orchestration into your product is substantial regulated engineering. A partner with PCI DSS Level 1 certification and payments production experience reduces both risk and time to launch.
Keep reading
- Best Embedded Finance & Payments Software Companies 2026
- The Embedded Finance Boom 2026: Choosing a Build Partner
- Banking-as-a-Service Explodes in 2026
Last updated: May 29, 2026. SectorPunk research is independent; we do not sell placements or coverage.