How to Find an ISO Business for Sale: A Buyer's Guide

Buyers searching for an ISO business for sale, a payment processing business for sale, or a merchant portfolio for sale usually discover the same thing within a few weeks: the market is large, the ecosystem is fragmented, and almost none of it is listed anywhere public. The transactions that do get reported are the ones at the top of the market. The ones most buyers can actually complete — a retiring agent's residual book, a two-office regional ISO, a software company with a payments attachment — mostly change hands quietly.

This guide sets out what is genuinely knowable from public data, what is not, and how a disciplined buyer builds a sourcing process anyway. Where a number comes from a published source, we cite it. Where a statement is a ResidualMatch inference from our own directory and deal exposure, we label it as such. Where no reliable dataset exists — and for two of the most commonly asked questions in this market, none does — we say so rather than manufacture a figure.

What "ISO for Sale" Actually Means

The phrase covers at least four economically different assets. Confusing them is the most common early mistake, because each carries a different risk profile, a different consent path, and a different valuation basis.

The practical difference is control. An entity purchase buys the whole machine and its history. A portfolio purchase buys a cash flow whose durability depends entirely on somebody else's contract — which is why processor documentation, not the spreadsheet of residuals, is the real asset being diligenced. We cover that distinction in depth in Selling an ISO: Whole Business vs. Merchant Portfolio and Processor Contracts and Portfolio Value.

Market at a Glance

The context for any acquisition thesis is a market that keeps growing in absolute terms while consolidating at the top. The figures below are the most recent authoritative public data points available at publication. Read the labels carefully — each measures something narrower than "the ISO market."

How Big Is the North American ISO Ecosystem?

Before you can estimate how many businesses trade, you need a defensible view of how many exist. No one publishes that number either, so this is the first of three ResidualMatch Research estimates in this article. Each is labelled, each carries a confidence level, and each is kept separate from the reported figures cited above.

The firm-count estimate starts with the ResidualMatch directory of roughly 3,000 North American payment companies and removes what does not belong: processors and acquirers, sponsor banks, gateways, hardware and terminal vendors, ISVs that do not own residual economics, consultancies and service suppliers, plus duplicate brands and records with no sign of current activity. What remains — firms that hold sponsor registrations and own a merchant portfolio — lands near 1,200. Card network programs offer a cross-check rather than a count: Visa's Third Party Agent registration program and Global Registry of Service Providers list ISO solicitation activity, but registry entries are compliance listings covering many service categories, and one operating company can hold several. They confirm the order of magnitude; they cannot confirm the number.

The agent-book estimate is weaker by construction and we mark it accordingly. It is inferred from typical agent counts per ISO across our directory population, scaled against the 37 million-plus US acceptance locations Nilson reported for 2025, and filtered to books with enough monthly residual to be worth transacting. Small variations in the "worth transacting" threshold move this figure substantially, which is why the range is wide.

How Many ISOs Are Bought and Sold Each Year?

There is a defensible public answer for one slice of the market, and for the rest there is a defensible model. We give you both, clearly separated.

The Nilson Report tracks merger and acquisition activity in merchant processing and acquiring. It counted 57 transactions across 25 countries in 2025 — 17 in the United States and 2 in Canada — against 74 worldwide in 2024 and 75 in 2023. That is the cleanest reportable series available, and it is the right number to cite when someone asks about industry M&A volume.

It is also a count of tracked, reportable merchant processing and acquiring transactions. It is not a census of ISO ownership changes. A retiring agent selling a 400-merchant residual book to a regional ISO for a low seven-figure sum is a real acquisition, is invisible to any public tracker, and will never appear in a deal database. The same is true of most sub-ISO buyouts, most intra-family transfers, most partner buyouts, and most portfolio sales financed by a specialty lender rather than announced by a press release.

ResidualMatch estimate: how many ISOs change hands each year? (confidence: medium)

Buyers still have to plan against a number. So rather than stopping at "the data does not exist," we triangulate one — and show our work. The following are ResidualMatch estimates, not reported statistics. The inputs are sourced; the conclusion is modeled.

Put plainly: ResidualMatch estimates that roughly 400 to 1,400 ISO and payment-portfolio transactions occur annually in the United States and Canada, centred near 660, the overwhelming majority of which are private and never appear in a public M&A database. The arithmetic behind that is deliberately simple so you can disagree with it in a specific place rather than in general. Roughly 1,200 firms at a 5% annual ownership turnover rate produces about 60 firm-level transactions a year in North America; Nilson tracked 19 in 2025, which is consistent with roughly a quarter of firm-level activity being reportable and the rest being private. Roughly 9,000 sellable agent and residual books at a 7% turnover rate produces about 600 book-level transactions a year. Take the low end of every input and you get roughly 35 company deals and 350 book deals; take the high end and you get roughly 120 and 1,300.

How much of the market is invisible? (ResidualMatch estimate, confidence: medium)

This is the figure that most changes how a buyer allocates sourcing effort. Nilson tracked 19 North American merchant processing and acquiring transactions in 2025. Set that against our modeled total of roughly 660 annual ISO and portfolio transactions and the reported share is about 3%. Restrict the comparison to firm-level deals only and the reported share rises to roughly 25%. So: ResidualMatch estimates that around 95–97% of all ISO and merchant-portfolio ownership transfers in North America never appear in a public M&A dataset, and that even among whole-company sales, roughly three in four are private.

The practical consequence is a sourcing conclusion, not a trivia point. A buyer who works only from announced transactions, broker listings and deal databases is looking at a few percent of the market, and at the few percent that is most competitively bid. Against a firm base of roughly 1,200, our transaction model also implies a market turnover rate of about 5% of companies and about 7% of residual books per year — meaning the ownership of the North American ISO ecosystem substantially recycles roughly every fifteen to twenty years, with consolidation steadily moving books upward into larger platforms rather than removing them from the market.

How Many New ISOs Are Started Each Year?

This one is genuinely harder, because the definitional problem comes before the statistical one. There is no single licence or filing that makes a company an ISO; the status arises from commercial registration with an acquirer or processor sponsor, not from a public register.

• Card network programs govern registration of third-party agents rather than publishing counts of independent ISO businesses. Visa operates a Third Party Agent registration program and the Visa Global Registry of Service Providers, which covers ISO solicitation activity among many other service categories — but a registry entry is a compliance listing, not evidence of an active, standalone ISO business, and the registry is not designed to be read as a business census.
• Legal entity formations tell you nothing specific: most new ISOs incorporate as ordinary LLCs or corporations with no payments-specific classification.
• One operating company can hold multiple registrations across several sponsors, and one registration can cover several brands or DBAs.
• Rebrands, dormant registrations, agent offices operating under a larger ISO's registration, and white-label programs all distort any count in the same direction — upward.
• The boundary itself is moving: a software company that monetizes payments through a payfac-as-a-service partner performs an ISO's economic function without ever calling itself one.

ResidualMatch estimate: new firm formation (confidence: low)

We will still commit to a range, with a wider error band and a narrower definition. Counting only newly formed North American firms that register with a sponsor and build their own merchant portfolio — excluding individual agents writing business under someone else's registration, excluding rebrands, and excluding dormant registrations — ResidualMatch estimates roughly 100 to 250 genuinely new ISO and merchant-services firms per year, with a central estimate of about 150.

The logic runs backwards from the population. If the active firm base is roughly 1,200 and has been broadly flat to slightly declining for several years under consolidation pressure, then formations must be approximately offsetting exits. Exits come from acquisitions (our ~60 firm-level estimate), plus wind-downs, sponsor de-registrations and absorptions into larger platforms, which together plausibly run at a similar or slightly higher rate. That puts replacement demand in the 100–250 band. Consolidation is real but it is not emptying the market — it is churning it.

The more consequential formation trend is one the count misses entirely. McKinsey's January 2026 ISV research found US payment processing revenue flowing through integrated software vendors grew roughly 20% annually over the prior five years, reaching an estimated $16 billion in 2025 from about $6.5 billion in 2020, with around 90% of surveyed US SMEs reporting they use an ISV solution for payments or business management. Many of the businesses being created with ISO-like economics today are software companies that never register as ISOs at all. For a buyer, the implication is direct: the pipeline of acquirable payment businesses increasingly includes software-led and embedded-payments companies alongside traditional agent-led ISOs, and the diligence for those two looks quite different.

Where Buyers Actually Find Opportunities

Because the market is private, sourcing is a portfolio activity. Serious buyers run several channels at once and accept that each produces a different kind of deal at a different price and pace.

Build the Mandate Before You Start Sourcing

Buyers who source without a written mandate end up evaluating everything and closing nothing. A mandate is one page and it makes every subsequent conversation faster, because you can tell an owner in thirty seconds whether their business fits.

• Asset type: whole operating company, merchant portfolio, agent book, or software-led business
• Size: target monthly net residual, or revenue/ARR range for an operating business
• Cheque size and capital structure: cash available, debt capacity, tolerance for earnout and holdback
• Geography and any regulatory or licensing constraints
• Processor and sponsor relationships you can support or must avoid
• Verticals you understand, and verticals you will not underwrite (high-risk, cash advance, certain MCCs)
• Merchant count and average account size — 2,000 micro-merchants is a different business from 120 mid-market accounts
• Maximum acceptable concentration in the top 5 and top 10 merchants
• Attrition tolerance and the trend you require, not just the level
• Growth expectation: is this a run-off cash flow purchase or a platform you will build on?
• Integration and migration tolerance: are you willing to reboard merchants, and can you?
• Operational involvement: passive residual ownership versus running staff, support and sales
• Target economics: required return, hold period, and the multiple range that produces it

Set the return requirement before you see a specific deal. Portfolio economics are driven by attrition and contract durability far more than by the headline multiple — see Merchant Attrition and Portfolio Value and ISO Valuation Multiples: What Buyers Are Paying for how those inputs interact.

Screening an Opportunity

Most opportunities can be eliminated or advanced on a first pass with a fairly short list of questions. The purpose of screening is not to value the deal — it is to decide whether it deserves the time that valuation and diligence will consume.

• Normalized residual or revenue: what is the recurring figure after removing one-time items, non-recurring fees, equipment sales and any inter-company arrangements?
• Trend over 12–24 months: a flat headline residual can conceal an eroding base propped up by recent boarding.
• Merchant-level reconciliation: does the seller's account-level data tie back to processor statements? If it cannot be reconciled, nothing else you are told can be verified.
• Concentration: revenue share of the top 5 and top 10 merchants, and whether concentration is rising.
• Attrition: account attrition and residual attrition, measured separately, with the direction of travel.
• Merchant tenure distribution: a book weighted to accounts under twelve months carries higher forward attrition risk.
• Processing volume and mix: card-present versus card-not-present, average ticket, seasonality.
• Margin per merchant and basis points retained, and whether pricing has been recently raised to dress up the residual.
• Agent splits: what portion of the gross residual is already committed to agents, and are those obligations assignable?
• Processor and acquirer agreements: term, exclusivity, minimums, buyout or right-of-first-refusal clauses, and portability.
• Assignment and consent: who must approve the transfer, on what timeline, and at what cost.
• Chargeback and high-risk exposure: loss history, reserve obligations, and any MATCH/Terminated Merchant File activity.
• Technology dependencies: gateways, CRM, boarding systems, and whether any are the seller's personal accounts.
• For entity purchases only: employees, contractor classification, leases, litigation, tax positions, and outstanding liabilities.

The full request list and verification approach is in the ISO Acquisition Due Diligence Checklist.

Two Deals, Same Residual, Different Value

The clearest way to see why screening matters is to compare two opportunities that would look identical in a listing summary. Both generate $50,000 in monthly net residual. The figures below are illustrative, constructed by ResidualMatch to demonstrate the mechanics — they are not observed transaction data.

Opportunity A is a durable, diversified, transferable cash flow. Opportunity B is the same monthly number attached to a fragile one: a third of it sits with five merchants, the base is young, attrition is worsening, and the transfer itself is conditional on a processor with a buyout clause. A buyer applying the same multiple to both would be paying identical prices for materially different assets. In practice B either clears at a significantly lower multiple, carries a much larger holdback and earnout, or does not clear at all.

Approaching Owners Directly Without Looking Like Spam

ISO owners receive unsolicited acquisition messages constantly, most of them templated and unserious. Five things separate an approach that gets a reply from one that gets deleted.

• A specific thesis: say why this business, in this vertical, in this geography, fits what you are building. Generic interest reads as a fishing expedition, because it usually is.
• Credibility: who you are, what you have acquired or operated, and who backs you. Anonymous buyers get anonymous responses.
• Confidentiality discipline: acknowledge that the owner's staff, agents and merchants do not know, and structure the conversation accordingly.
• A realistic process: describe your steps and timelines honestly. Owners have usually been through at least one process that collapsed and are alert to buyers who promise speed they cannot deliver.
• Evidence of ability to close: proof of funds, a credit relationship, or a track record. This is the single most common reason serious sellers disengage.

What to Request Before an LOI vs. After

Red Flags

• Residual data that cannot be reconciled to processor statements at account level
• A recent residual increase with no corresponding volume, boarding or documented pricing change
• Attrition that is accelerating rather than steady, or attrition quoted on accounts but not on residual
• Concentration in a handful of merchants, particularly if it grew in the last twelve months
• Processor agreements with buyout clauses, rights of first refusal, or non-assignment provisions the seller downplays
• Undocumented agent splits or verbal arrangements
• Gateways, CRMs or boarding portals registered to the owner personally
• Unexplained concentration in high-risk MCCs relative to how the book was represented
• A seller who will not permit direct confirmation with the processor at any stage
• Pressure to sign a purchase agreement before consents are mapped
• Entity deals: contractor classification of a de facto sales team, or unresolved tax and lien positions
• A price anchored to a multiple heard from a peer rather than to the book's own economics

Most of these are survivable if priced and structured for. The unsurvivable one is unverifiable residual data — see Common Mistakes Buyers Make in Payment Portfolio Acquisitions.

A Simple Acquisition Process

• Mandate — write the one-page brief covering asset type, size, geography, economics and constraints.
• Sourcing — run marketplace, direct outreach, processor, broker and network channels in parallel.
• Screening — apply the first-pass questions; eliminate quickly and without regret.
• NDA and initial data — request the pre-LOI package; test whether the seller can actually produce it.
• Valuation — model normalized residual, attrition, concentration and consent risk; produce a defensible range, not a single number.
• LOI — set price basis, structure, exclusivity length, diligence period, and who obtains which consents.
• Diligence and consents — reconcile at account level and run the consent process in parallel, not after; consents are the usual cause of delay.
• Close — definitive agreement, disclosure schedules, assignments, lien releases, and a written change to residual payment direction.
• Transition — verify the first post-close residual payment arrives in the right amount, to the right account, on schedule; then execute the merchant and agent communication plan.