Third-party Payment Providers: Legal Risks and Contract Essentials

Using third-party payment providers can make it faster to take card payments, online payments, subscriptions and marketplace transactions, but many New Zealand businesses sign up without properly checking the legal and commercial terms. That is where expensive problems can start. Common mistakes include accepting standard terms without reading the fee structure, assuming the provider carries all fraud and chargeback risk, and overlooking what happens if the provider freezes funds or terminates the account.

For a startup or SME, payment processing is often business critical. If a provider holds settlement funds, changes pricing, or shuts down your account during a busy period, the impact can hit cash flow immediately. The contract also affects customer refunds, privacy obligations, service levels, dispute handling and your ability to move to another provider later.

This guide explains what third-party payment providers mean for New Zealand businesses, the legal issues to check before you sign, the contract clauses that matter most, and the mistakes founders commonly make when they rely on a sales pitch instead of the actual terms.

Overview

Third-party payment providers sit between your business, your customer and the banking or card network infrastructure that processes payments. The legal risk usually sits less in the technology itself, and more in the contract terms about fees, liability, chargebacks, data handling, reserves, suspension rights and termination.

A careful contract review before you sign can reduce nasty surprises and give you more leverage while the deal is still being negotiated.

• Who is legally responsible for fraud, chargebacks, refunds and disputed transactions
• When the provider can hold funds, create a reserve, delay settlement or suspend your account
• How fees are calculated, changed and disclosed, including cross-border and hidden processing costs
• What service levels, support commitments and outage remedies actually apply
• How customer and transaction data is collected, stored, shared and used
• Whether the provider's terms match your own customer terms, refund process and privacy notice
• How long the contract runs, how termination works, and how hard it will be to switch providers
• Whether any sector-specific rules, card scheme requirements or overseas terms affect your New Zealand business

What Third-party Payment Providers Means For New Zealand Businesses

Third-party payment providers usually give businesses a faster path to accepting payments, but they also insert another contract into the middle of your customer transaction. That means your payment terms are no longer just about your customer and your bank. They are shaped by the provider's platform rules, risk settings and standard legal terms.

In practice, a third-party payment provider may handle online card payments, recurring billing, point of sale integrations, digital wallets, marketplace payouts or payment links. Some providers operate as payment facilitators. Others act more like gateways, merchant acquirers or software platforms with payment features attached.

That distinction matters because different providers take different positions on responsibility. One provider may assume more operational responsibility for processing. Another may put most of the risk back on the merchant through indemnities, broad suspension rights and liability clauses.

Why the contract matters so much

The provider's standard terms are often drafted to protect the provider first. That is not unusual, but it does mean a business should not assume the commercial headline tells the full story. A promise of fast onboarding or low rates can hide strict reserve rights, short notice fee changes or broad rights to reverse settlements.

This is where founders often get caught. They compare processing rates, but not the parts of the contract that affect cash flow and business continuity.

Common business situations where issues arise

The legal and operational risk is usually highest in moments such as these:

• Your business has high refund rates or a seasonal sales spike
• You sell subscriptions or take pre-orders well before delivery
• You process cross-border payments or foreign currency transactions
• You operate in a sector the provider treats as higher risk
• You run a marketplace and need split payments or payouts to third parties
• You rely heavily on one payment channel and have no backup option

A provider may respond to these situations by imposing reserves, delaying payouts, increasing monitoring, or asking for more verification documents. If that right appears in the contract, the provider can usually act quickly.

How this fits with New Zealand law

New Zealand businesses still need to meet their own legal obligations even when a third-party payment provider is involved. A provider does not take over your obligations to customers just because it processes the payment.

For example, if your marketing overstates how payment security works, or your refund messaging is misleading, the Fair Trading Act 1986 can still be relevant. If you collect personal information through checkout, account registration or billing flows, your obligations under the Privacy Act 2020 still matter, including being clear about collection, use and disclosure.

If you supply goods or services to consumers, your customer-facing processes also need to work with consumer protections that may apply, including expectations around refunds, service quality and fair representations. The payment provider agreement should support those obligations, not create conflicts that leave your staff and customers stuck in the middle.

Legal Issues To Check Before You Sign

Before you sign a contract with a payment provider, focus on who carries the financial risk, who controls the money, and how much flexibility the provider has to change the deal later. These clauses often matter more than the sales proposal.

Fees and pricing mechanics

The advertised rate is rarely the whole picture. Your agreement should clearly explain all fees and how they are triggered.

Look closely at:

• transaction fees and minimum monthly fees
• setup, onboarding or integration charges
• chargeback, retrieval and dispute fees
• cross-border and currency conversion charges
• payout or settlement fees
• refund processing fees
• hardware, software or subscription costs tied to the payment service
• the provider's right to change pricing, and how much notice you get

If the provider can change fees on short notice, your margin can disappear quickly. That matters even more for low-margin ecommerce businesses, hospitality operators and subscription models.

Settlement timing, reserves and held funds

The main cash flow risk is often the provider's right to hold your money. Many contracts let providers delay settlement, create rolling reserves, freeze payouts during investigations, or reverse transactions after they have already appeared settled.

Before you accept the provider's standard terms, check:

• when funds are normally settled to your account
• whether weekends, public holidays or cut-off times affect settlement
• when the provider can delay settlement
• whether it can impose a reserve and how that reserve is calculated
• how long held funds can be retained
• whether there is any process to challenge or review a hold

This is especially important if wages, supplier payments or stock purchases depend on predictable settlement cycles.

Chargebacks, fraud and refunds

Do not assume the payment provider absorbs fraud losses. In many contracts, the merchant remains responsible for chargebacks, fraudulent use, card-not-present disputes and customer complaints, even if the provider's tools are involved.

The agreement should make clear:

• who bears the loss for unauthorised transactions
• what fraud screening tools are included and what is optional
• what evidence is needed to defend a chargeback
• who handles customer disputes and card scheme requests
• how refunds must be processed and within what timeframe
• whether the provider can debit your account for reversals or penalties

If your customer terms promise generous refunds, but the provider's process is slow or restrictive, the business wears the operational pain.

Privacy and data use

Payment data can involve personal information, and sometimes sensitive financial information. Your provider agreement should tell you what data the provider collects, whether it acts solely on your instructions in any respect, and what it can do with transaction and customer data for its own purposes.

Check the contract and your own privacy documentation for consistency on:

• what customer information is collected during payment
• where data is stored and whether it is transferred overseas
• what subcontractors or processors are involved
• how long data is retained
• what security standards the provider applies
• who must notify affected parties if there is a privacy breach or security incident

If the provider's checkout or payment page collects information directly from customers, your privacy disclosures should accurately describe that arrangement.

Service levels, outages and support

If payments fail, sales can stop instantly. That makes uptime, incident response and support terms commercially important, even if they sit in the legal fine print.

Look for:

• any guaranteed uptime or service availability commitment
• scheduled maintenance rules
• response times for incidents and support requests
• remedies if the service is unavailable
• liability exclusions for outages and technical failures

Many standard terms offer very little if the platform goes down. That may be acceptable for a small side channel, but not for your main revenue stream.

Term, termination and exit planning

You should know exactly how the relationship ends before you sign. A provider that is easy to join can be awkward to leave.

Important points include:

• whether the contract has a fixed term or rolls on automatically
• termination rights for each party
• minimum notice periods
• early termination fees
• whether the provider can terminate immediately for broad risk reasons
• access to transaction records and reporting after termination
• how long funds may continue to be held after exit

If your provider is integrated into your website, app, subscriptions or point of sale system, the practical switching costs may be much higher than they look.

Liability, indemnities and limitations

The contract usually limits the provider's liability and expands yours. That is standard drafting, but the scope matters.

Pay particular attention to:

• caps on the provider's liability, and whether they are tied to recent fees paid
• excluded losses such as indirect loss, loss of profits or data loss
• your indemnities for customer claims, misuse, breaches of law or scheme breaches
• whether the provider can set off amounts it says you owe against settlement funds

Before you rely on a verbal promise from sales staff, check whether the written contract excludes all prior statements. If it does, those verbal assurances may be hard to enforce.

Consistency with your own contracts and policies

Your payment provider agreement should align with the promises you make elsewhere in the business. If your website, order terms, subscription terms or account sign-up process say one thing, but the provider's process works differently, customer disputes become more likely.

Make sure your business documents are consistent on:

• refund timing and payment reversals
• recurring billing consent and cancellation
• who appears on card statements
• how failed payments are retried
• how personal information is handled at checkout

Common Mistakes With Third-party Payment Providers

The most common mistake is treating the provider's standard terms like a routine click-through. Payment processing is too central to cash flow for that approach.

Assuming "standard terms" are non-negotiable

Some providers will not move much on core platform terms, but that does not mean every issue is fixed. Larger merchants, growing startups and businesses with unusual transaction profiles can often negotiate onboarding conditions, pricing, notice periods, support arrangements or custom schedules.

Even where the legal terms stay mostly standard, you may still be able to get operational commitments confirmed in writing.

Focusing only on transaction fees

Founders often compare the headline percentage and stop there. The bigger cost may come from held funds, chargeback administration, foreign exchange margins, hardware lock-in or account suspension during a peak trading period.

A provider with a slightly higher processing rate but better settlement certainty can be cheaper in the real world.

Not checking who can suspend the account, and why

Many agreements let the provider suspend processing where it suspects fraud, unusual activity, compliance concerns or increased risk. Those triggers are often drafted broadly.

If your business model includes pre-orders, subscriptions, events, or irregular sales spikes, broad suspension rights can create real disruption. Before you sign, ask how the provider actually handles risk reviews and what evidence it needs from merchants.

Relying on verbal promises

Sales conversations often sound more flexible than the written terms. A founder may be told that reserves are unlikely, that support is available around the clock, or that the account is a good fit for a particular sector.

If the contract says the provider can still impose a reserve, limit support, or terminate for risk reasons, the written wording usually controls. Get important points documented before you spend money on setup or integration.

Forgetting privacy and customer communications

Checkout flows can involve multiple parties collecting information, including your site, the provider, anti-fraud tools and embedded wallet services. If your privacy disclosures are vague or outdated, customers may not understand who receives their information or why.

That can create complaints, confusion and avoidable compliance issues.

Building around one provider with no fallback

Some businesses hardwire a single provider into subscriptions, online checkout, invoices and in-store systems. If the provider changes risk settings or terminates the account, the business can be left scrambling.

A backup option is not always easy, but thinking about portability early can reduce pressure later. This includes checking integration flexibility, access to transaction records, and how quickly you could migrate recurring payment arrangements.

Using the wrong provider for the business model

A provider that works well for simple retail sales may be a poor fit for a marketplace, software platform, membership model or high-ticket business. The terms may not support split payments, staged payments, long delivery windows or delayed fulfilment.

That mismatch often shows up only after disputes or account reviews begin. It is much easier to assess those issues before you sign than after revenue starts flowing through the platform.

FAQs

Can a payment provider freeze my business funds?

Yes. Many provider agreements allow the provider to delay settlement, hold funds or create a reserve where it identifies fraud risk, chargeback exposure, compliance concerns or unusual activity. The key question is when it can do this, for how long, and whether the contract gives any review process.

Am I still responsible to customers if a third-party provider handles the payment?

Usually, yes. The provider processes the payment, but your business still has its own obligations to customers regarding refunds, representations, privacy and service delivery. The payment contract should support your customer-facing processes rather than contradict them.

Are payment provider standard terms negotiable in New Zealand?

Sometimes. Large platform providers may have limited room on core legal terms, but pricing, onboarding details, support commitments, settlement arrangements and custom commercial schedules can sometimes be negotiated, especially for businesses with meaningful transaction volume or unusual needs.

What should I check before accepting online payment provider terms?

Check fees, settlement timing, reserve rights, chargeback responsibility, termination rights, privacy and data handling, support levels, liability caps and whether the provider can change terms unilaterally. Also check that the provider's process matches your own customer terms and refund practice.

Do overseas provider terms create extra risk for New Zealand businesses?

They can. Overseas terms may use foreign law, overseas dispute processes, broad data transfer rights or terminology that does not align neatly with New Zealand business practices. That does not always make the agreement unsuitable, but it does mean the contract needs careful review.

Key Takeaways

• Third-party payment providers can simplify payment processing, but the legal and commercial risk often sits in the contract terms rather than the technology.
• Before you sign, check fees, reserves, settlement timing, chargebacks, refund mechanics, privacy obligations, service levels, liability limits and termination rights.
• Do not assume the provider carries fraud risk or that standard terms fairly balance the relationship.
• Make sure the provider agreement matches your customer terms, recurring billing process, privacy disclosures and operational reality.
• Get important promises in writing before you rely on a sales conversation or spend money on setup and integration.
• Think about exit planning early, including data access, held funds and how you would switch providers if the relationship changes.

If you want help with payment service agreements, chargeback and liability clauses, privacy and data terms, or termination and exit rights, you can reach us on 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.