Nonprofit Payments Can’t Be a Black Box: Why Owning Your Merchant Account Matters
Earlier this month, the nonprofit sector got a painful reminder that “set it and forget it” donation infrastructure can quickly become a single point of failure.
Coverage from sources like Nonprofit News Feed and restructuring analysts chronicled what happened at Flipcause: Delayed remittances to nonprofits, a cease-and-desist order from the California Department of Justice, its payment processor’s termination of services and freeze of roughly $2.2 million in funds, and a Chapter 11 bankruptcy filing in Delaware with tens of millions in donations owed to thousands of nonprofits.
In those accounts, the sole payment processor is at the center of the dispute, holding a commingled pot that included both Flipcause’s operating funds and donor money earmarked for nonprofits. When that pooled account was frozen, donor dollars were effectively locked inside a processor–platform dispute, and organizations that thought they were “just using a fundraising tool” suddenly found themselves in a bankruptcy case.
The underlying pattern matters more than any single name. In many platform-centric models:
- The platform, not the nonprofit, is the merchant of record—often through a single large processor.
- Donor funds are pooled under the platform’s merchant ID, then remitted downstream on the platform’s schedule.
- Payout timing and holds are governed by the platform’s processor and risk policies, not the nonprofit’s.
When that platform experiences processor issues, regulatory action, or an operational failure, thousands of organizations just like yours can feel the shock at once—often with little warning.
Whatever the ultimate outcomes in court in nonprofit funds mismanagement and potential fraud cases like the one Flipcause is the subject of, the operational lesson is immediate: if your fundraising flow depends on someone else’s rails, you’re exposed to payout interruptions, policy changes, processor actions, and compliance shocks you don’t control.
This blog outlines a practical framework describing why nonprofits should own their merchant account. It’s assurance that donor gifts and monthly contributions keep moving even when the landscape shifts.
When “convenient” becomes “vulnerable”
Nonprofits run on trust—and cash flow. If donations slow down, programs pause. If gifts are declined or mishandled, supporters don’t just abandon a transaction; they lose confidence in the organization’s ability to steward their financial support.
But many donation stacks were built for speed, not resilience, and that leaves nonprofits vulnerable to several common risks.
- Funds held outside your control: When a third party sits between the supporter and your organization, gifts can sit in an account you don’t own. This creates “float” risk, delayed payouts, and opaque timing for when dollars actually hit your bank.
- Single points of failure: If a platform’s payment processor cuts ties, tightens risk thresholds, or places holds, your donation flow can be disrupted overnight. In the Flipcause situation, public reporting references impacts tied to processor actions—including the payment processor’s decision to terminate services and freeze funds. This is a vivid illustration of how quickly a platform–processor relationship can cascade into missed payouts for nonprofits.
- Compliance expectations are tightening: New rules—such as expanded monitoring requirements for automated clearing house (ACH) or eCheck fraud and card-network programs that scrutinize excessive fraud and disputes—raise the bar on how platforms and merchants manage payment risk. What used to count as “commercially reasonable” controls are no longer enough as regulators and networks formalize monitoring and enforcement.
- Fraud is accelerating and industrialized: Industry research projects cumulative online payment fraud losses in the tens of billions each year. A large majority of organizations already report attempted or actual payments fraud, and attackers are now using automation and AI to test cards, take over accounts, abuse refunds, and probe weak defenses at scale.
The takeaway: if you can’t see and control the payment lifecycle end to end, you’re playing defense with one hand tied behind your back. “Convenient” becomes “vulnerable” when a single third party controls both your merchant identity and your fraud posture.
Resilience, predictability, and donor confidence
For nonprofits, successful results aren’t gained simply by reducing fraud losses. Success lives in the operational outcomes that keep your mission funded and your supporters engaged. When you combine ownership of your merchant account with modern fraud protection, you’re aiming at outcomes like:
More predictable cash flow: Fewer surprise holds, fewer payout mysteries, and fewer lastminute scrambles to reconcile what cleared. When failure scenarios do occur—nonsufficient fund returns, expired cards, or bank issues—you can layer in services such as automated recovery and card-on-file updating to reduce involuntary churn and keep recurring gifts on track.
Better donor experience: Fewer unnecessary declines, fewer confusing error messages, and donation flows that feel fast, mobile-friendly, and trustworthy. Supporters can give using the methods they prefer—cards, ACH/eCheck, digital wallets, or recurring monthly gifts—without running a gauntlet of clumsy fraud checks.
Stronger governance: Clearer accountability for payment operations, reporting, and oversight. As regulations and platform rules tighten, you can show boards, auditors, and major donors that you understand where money flows, how it’s protected, and how quickly issues are identified and escalated.
Protection that scales: As donor volumes grow and campaigns expand, your payment platform should support high-volume, low-latency monitoring with always-adapting models and configurable thresholds. That means your fraud defenses can keep pace as your supporter base and fundraising channels grow—without requiring a proportional increase in manual review work.
The nonprofit sector doesn’t need more cautionary tales to prove the point. The urgency is already here: fraud is rising, regulation is tightening, and donation interruptions tend to hit at the worst possible time.
Rethinking the foundation, not just the form
At a glance, donation pages and buttons may all look similar. The critical difference lies underneath:
- Who is the merchant of record? Is it you or a third-party platform?
- Where do funds actually sit between authorization and settlement?
- Who is responsible for fraud monitoring, compliance, and payout decisions?
- How quickly can you adapt if a processor, platform, or bank changes course?
If your fundraising platform can’t give you clear answers on ownership, transparency, and modern fraud defense—or if the answers leave you exposed—it’s time to rethink the foundation, not just the form.
That doesn’t have to mean abandoning the tools your team loves. It does mean adopting a payments architecture where your organization owns the merchant account, has end-to-end visibility into the payment lifecycle, and can layer in AI-powered fraud protection that fits your risk posture and mission.
If you want to pressure-test your current setup, CSG Forte can help you:
- Map where donations and monthly gifts actually travel today.
- Identify single points of failure in payout flows and processor relationships.
- Evaluate your fraud controls across ACH, card, and digital channels.
Talk with CSG Forte about setting up a dedicated merchant account for your nonprofit to protect supporter gifts, strengthen your cash flow, and keep your mission moving, even when the landscape is changing around you.
