Why Stripe, PayPal, and Square Shut Down High-Risk Accounts (And What To Do Before It Happens)

The email always arrives the same way. No phone call, no warning, no negotiation. "We've determined your business presents an unacceptable level of risk. Your account has been closed and payouts have been paused." For a merchant doing $50K or $200K a month, that message is not an inconvenience. It is the sudden loss of revenue, plus weeks or months of your money held in a reserve you cannot touch. None of this is random, and almost all of it is predictable. Here is how aggregators actually underwrite, what triggers a shutdown, what termination really looks like, and the redundancy work to do while your account still works.

How Aggregator Underwriting Actually Works

Stripe, PayPal, and Square are payment aggregators (payment facilitators). You do not get your own merchant account with them. You become a sub-merchant under their master account with their acquiring banks.

That structure is why onboarding takes five minutes. Traditional acquirers underwrite before you can process: financials, processing history, business model review, sometimes personal guarantees. Aggregators flip the sequence. They let almost anyone start processing immediately, then underwrite you afterward, continuously, with automated risk models watching your live transactions.

This underwrite-after-onboarding model is a genuinely good trade for low-risk businesses. For high-risk businesses it is a trap with a delay timer. You were never really approved. You were provisionally tolerated until your data arrived. The first serious look at your business often happens after you have volume, customers, and payroll depending on the account.

Aggregators are also structurally conservative, because your risk is their risk. Every sub-merchant's chargebacks roll up into the aggregator's own ratios with its banks and with card network programs like VAMP. When the model flags you, the cheapest move is removal, not investigation. A support agent cannot override the risk engine, which is why appeals so rarely work.

The Categories They Won't Keep

Each aggregator publishes a prohibited and restricted business list, and they are longer than most founders expect. Recurring themes across Stripe, PayPal, and Square include: nutraceuticals and supplements, CBD and anything cannabis-adjacent, adult content, gambling and skill gaming, firearms, tobacco and vape, debt collection and credit repair, tickets and travel with long delivery windows, multi-level marketing, telemarketing, pseudo-pharmaceuticals, and "high-risk" subscription models like free-trial-to-rebill continuity offers.

Two things matter here. First, restricted is not the same as prohibited; some categories can process with pre-approval, but few merchants ever get it. Second, enforcement is often lagging. Merchants in these industries frequently process for months before classification catches up with them. Processing successfully today is not evidence you are allowed to be there.

If your vertical is on those lists, a shutdown is not a possibility to hedge against. It is a scheduled event without a published date.

The Triggers: Chargebacks, Refunds, and Pattern Breaks

For merchants in tolerated categories, terminations are usually ratio-driven or pattern-driven.

Chargebacks are the loudest signal. The card networks set the ceiling: Visa's monitoring program now flags merchants above a 1.5% combined fraud-and-dispute ratio in most regions, and Mastercard's programs combine ratio thresholds with dispute counts. Aggregators enforce internal limits well below those numbers, because they are protecting their own standing in those programs. Sustained ratios that would merely be "elevated" at a high-risk acquirer are termination territory at an aggregator. If you do not know your ratio and how it is computed, start with our chargeback ratio explainer, and use our chargeback reason code reference to diagnose what is actually driving your disputes.

Refund rates are the quieter trigger. A refund spike reads as pre-chargeback smoke: customers unhappy at scale, disputes incoming. High refund rates plus rising ticket sizes is a classic freeze pattern.

Pattern breaks round out the list. Sudden volume spikes, a jump in average ticket, a surge in card-testing traffic, mismatches between your stated business and your live website, and elevated decline rates all feed the model. Even your decline mix matters; a wall of issuer declines suggests issuers have started distrusting your traffic before your processor has.

What a Freeze or Termination Actually Looks Like

The mechanics are worse than most merchants expect, so plan for the real timeline.

First, processing stops immediately, sometimes mid-day, with checkout simply failing. Second, your balance and incoming settlements are held in reserve. The stated purpose is covering trailing chargebacks, which customers can file for months after purchase. Third, at the end of the hold period, remaining funds are released, minus any disputes and fees that landed during the window.

	Stripe	PayPal	Square
Typical hold on termination	Commonly 90-120 days, up to 180 in higher-risk cases	Up to 180 days is standard	Typically up to 90 days
Warning before action	Often none; sometimes a review request first	Often none; limitation notice via email	Often none
Appeal odds for true high-risk	Low	Low	Low

These are typical figures, not guarantees; terms of service allow longer holds where risk justifies it, and every case differs.

Then there is MATCH. MATCH (Member Alert to Control High-Risk Merchants) is Mastercard's database of terminated merchants, checked by essentially every acquirer during underwriting. If your termination is reported with a serious reason code (excessive chargebacks, fraud, transaction laundering), you and the listed principals typically stay on it for five years. A MATCH listing does not make new accounts impossible, but it forces you into the specialist high-risk market at worse terms. Avoiding a reportable termination is worth real money.

One warning while we are here. The panic response to a shutdown is often to quietly open a new aggregator account under a relative's name or a fresh LLC. Aggregators link accounts by device, bank account, domain, and identity signals, and processing under a misrepresented identity is fraud. It converts a business problem into a legal one. The legitimate escape route exists; use it.

The Migration Path: Dedicated High-Risk Merchant Accounts

The durable fix is graduating from sub-merchant status to your own merchant account with an acquirer that underwrites high-risk businesses on purpose.

The trade-offs are real: applications take days to weeks, you will provide financials and processing history, pricing is higher, and rolling reserves (a percentage of volume held back on a rolling window) are common at first. In exchange, you get an acquirer that knew exactly what you sold when it approved you. Elevated chargebacks trigger a conversation and a remediation plan instead of an email and a frozen balance. Your ratios are managed, not merely tolerated.

The full process, from choosing a provider to negotiating reserves, is in our high-risk merchant account guide. The short version: apply while you are healthy. Underwriters read a merchant with clean current processing very differently from one applying the week after a termination, possibly with a MATCH listing attached.

The Redundancy Checklist

Do these while your current account still works, roughly in this order.

1. Get your card data out of the PSP's exclusive control. Stand up an independent token vault and run a PCI-compliant migration of your saved cards, as covered in our token vault guide. This is the single highest-leverage item, especially for subscription businesses.
2. Open at least one dedicated high-risk merchant account as a live backup, even if it only takes a small slice of volume today. A dormant application is not redundancy; a warm, processing MID is.
3. Add a routing layer so switching processors is a configuration change, not an engineering sprint. Our MID load balancing guide covers the architecture.
4. Manage your ratios like the survival metric they are: fight winnable disputes, refund fast when you will lose, use chargeback alerts, and fix the descriptor and fulfillment issues behind your top reason codes.
5. Keep cash reserves outside the processor. Sweep balances daily and hold enough operating cash to survive 90 or more days with a frozen account.
6. Keep your underwriting file honest and current: your website, descriptors, and stated business model should match what you actually sell, everywhere.

Practical Takeaway

Aggregators are excellent on-ramps and terrible permanent homes for high-risk merchants. The shutdown email is not an accident of bad luck; it is the predictable output of an underwrite-later model meeting a business it was never built to keep. Treat your Stripe, PayPal, or Square account as a temporary convenience with a countdown attached. Build the vault, open the dedicated account, wire up the routing, and watch your ratios weekly. Merchants who prepare before the email treat it as a routing change. Merchants who don't lose a quarter of revenue and spend six months rebuilding. Be the first kind.