TL;DR — Quick Summary
- Three technology waves are converging simultaneously: AI-driven risk scoring is automating underwriting and cutting into traditional fee income. Embedded payments are removing ISOs from the transaction loop. Open banking APIs are commoditizing access to merchant data. Each wave is real, each is accelerating, and each is hitting different parts of the ISO revenue stack.
- The ISOs who survive will be on the right side of at least two waves: This doesn’t mean every ISO needs to become a fintech. It means understanding where each wave creates value for your merchants, partnering with the right platforms, and repositioning your value proposition accordingly.
- The three-step response is the same for all three waves: assess, pilot, scale. Pick one technology in each wave, find a merchant or segment to pilot with, measure the outcome, and scale what works. The ISOs who start running pilots in 2026 will have a significant advantage over those still waiting for the waves to arrive.
Automation
Disrupting Data
Market by 2027
Understanding the Three Converging Waves
The payment industry has absorbed technological change before — the shift from paper to electronic, from terminal to gateway, from batch to real-time. Each wave restructured the value chain, eliminated some participants, and elevated others. The current wave is different in one respect: three distinct technology transitions are happening simultaneously, and each is hitting a different layer of the ISO revenue model.
AI-driven risk scoring attacks the underwriting and fee income layer. Embedded payments attack the transaction routing layer. Open banking APIs attack the data and reporting layer. An ISO that is exposed on all three layers — processing-only, no platform, no data strategy — faces structural revenue erosion from three directions simultaneously. The ISOs that will thrive in 2030 are already positioning themselves on the right side of these transitions today.
The good news: each wave also creates new revenue opportunities for ISOs who understand them. The question is not whether to engage — the waves are not optional — but how to engage strategically rather than reactively.
Underwriting
in Platforms
API Economy
Market by 2027
Wave 1: AI-Driven Risk Scoring — The Underwriting Revolution
Traditional merchant underwriting relies on a combination of personal credit scores, time in business, industry risk ratings, and average processing volume. It’s a coarse classification system that produces false positives (risky-looking merchants who are actually safe) and false negatives (safe-looking merchants who are actually risky). AI-driven risk scoring is replacing this model with real-time, behavior-based assessment.
What it automates: AI models can assess merchant creditworthiness using transaction patterns, not just credit bureau data. Merchants with thin credit files but strong, consistent transaction histories — exactly the SMBs that traditional underwriting misclassifies — can be scored accurately in real time. This automates the underwriting function that many ISOs perform manually or semi-manually.
Revenue impact: Automated underwriting reduces the fees ISOs charge for risk assessment and manual review. It also reduces the margin on equipment leasing, since risk-based pricing becomes more precise and less profitable as a separate line item. ISOs who depend on underwriting fees and equipment margin as significant revenue components face direct pressure.
Opportunity side: AI risk scoring creates new opportunities for ISOs who can access it — more accurate merchant assessment means faster onboarding, fewer false declines, and better pricing accuracy. ISOs who integrate AI underwriting into their platform can offer faster, better merchant onboarding than competitors still relying on manual review. Partner with a fintech that has AI underwriting capability, or build it into your platform.
Wave 2: Embedded Payments — The Platform Displacement
Embedded payments is the integration of payment processing directly into a non-payment software platform — a restaurant POS, an e-commerce platform, an accounting tool, a vertical SaaS application. When a restaurant uses a POS system that has payment processing built in, the ISO is removed from the transaction loop. The software company captures the merchant relationship and routes the payment through their own processing infrastructure.
The embedded payments market is projected to reach $4.2 trillion by 2027, according to Juniper Research. The logic is compelling for software companies: payment processing is a high-frequency, high-revenue feature that increases switching costs, deepens the merchant relationship, and generates recurring fee income. Every vertical SaaS company is therefore evaluating whether to embed payments. The ones that do will displace the ISOs who previously served those merchants.
Revenue impact: ISOs serving merchants who move to embedded-payment platforms lose the merchant entirely. The platform takes the relationship, the transaction routing, and the associated fee income. This is the most direct structural threat to the processing-only ISO model.
Opportunity side: The same dynamic creates an opportunity for ISOs who are themselves embedded in the right platforms. White-label POS platforms that integrate payment processing — like OrderPin — are ISO-owned embedded payment infrastructure. Every merchant on the OrderPin platform is an ISO-embedded merchant, not a platform-owned one. The ISO who provides the platform controls the embedded payment relationship, not the other way around.
Wave 3: Open Banking APIs — The Data Commoditization
Open banking regulations (PSD2 in Europe, similar frameworks emerging in the US) require banks to provide standardized APIs that allow third parties to access customer financial data — with customer consent. In payment processing, this means that any fintech with an open banking API can access a merchant’s bank account transaction history directly, without going through the ISO’s processing feed. The merchant’s financial data is no longer exclusively accessible through the payment processor.
This commoditizes the data layer that many ISOs depend on for reporting, benchmarking, and advisory services. If a merchant can get their transaction data directly from their bank via open banking API — and many business intelligence platforms are already doing this — then the ISO’s data advantage disappears. The merchant can get their own data; the question is whether the ISO’s data product is valuable enough to justify staying.
Revenue impact: Reporting fees, data subscription services, and advisory revenue that depends on exclusive data access face pressure as open banking APIs proliferate. Merchants who can get equivalent data from open banking tools — for free, directly from their bank — have less reason to pay the ISO for it.
Opportunity side: Open banking creates as many opportunities as it disrupts. ISOs who use open banking APIs gain access to richer merchant financial data than processing alone provides — bank statements, cash flow patterns, business performance metrics — that enable better underwriting, more accurate benchmarking, and new advisory products. The ISOs who integrate open banking data into their platform will have a data advantage that raw processing data cannot match.
The Three Waves: Threat, Opportunity, and ISO Response
| Wave | Attacks Layer | Threatens Revenue | Creates Opportunity |
|---|---|---|---|
| AI Risk Scoring | Underwriting | Underwriting fees, equipment margin | Faster onboarding, better pricing |
| Embedded Payments | Transaction routing | Processing fees (merchant displacement) | White-label platform = embedded advantage |
| Open Banking APIs | Data layer | Data/ reporting revenue, advisory fees | Richer data, better benchmarking |
How OrderPin Helps ISOs Navigate the Three Waves
OrderPin is a restaurant POS software ISV whose white-label platform gives ISOs embedded-payment infrastructure under their own brand — directly addressing Wave 2 from the right side of the wave rather than as a victim of it.
- Embedded payment infrastructure: OrderPin’s POS platform integrates payment processing under your ISO brand — every transaction flows through your processing infrastructure, not a third-party platform’s. You are the embedded payment provider, not the displaced one.
- POS-first data advantage: OrderPin captures item-level POS data — not just transaction amount and timestamp, but what was sold, to whom, at what price, through which channel. This data depth is immune to open banking API commoditization — banks don’t have your POS data.
- API-ready architecture: OrderPin’s open API lets your ISO build AI underwriting, benchmarking tools, and advisory products on top of the platform data — positioning you on the opportunity side of all three waves simultaneously.
- White-label brand ownership: The merchant relationship, the data, and the payment relationship all carry your ISO brand. As these waves play out, the merchants who trust your brand — not OrderPin’s — are the merchants you retain.
The ISO Three-Step Response Framework
For each wave, the strategic response is the same three-step framework — assess, pilot, scale:
Assess: Which side of each wave is your business on? Map your revenue by layer — underwriting, processing, data/reporting, advisory. For each layer, identify which wave threatens it and which side of that wave you currently sit. The assessment takes one day and reveals your vulnerability profile.
Pilot: Pick one technology in each wave and run a pilot with one merchant or segment. AI underwriting: partner with a fintech and test on 10 merchants. Embedded payments: test white-label POS with one multi-location account. Open banking: integrate one open banking API into your reporting for 30 days. Pilots cost little and generate the real-world data you need to make build/partner/ignore decisions.
Scale: What works in the pilot, scale across your merchant base. What doesn’t work, kill quickly and move on. The goal is to be on the right side of at least two of the three waves within 18 months — not to have all the answers today, but to have started running experiments that generate the answers.
Frequently Asked Questions
Which wave poses the greatest threat to a typical processing-only ISO?
Embedded payments (Wave 2) is the most immediate structural threat. It directly removes the ISO from the transaction loop by displacing the merchant onto a platform that routes payments through its own infrastructure. A processing-only ISO who loses a merchant to a POS platform with embedded payments doesn’t just lose one merchant — they lose the merchant’s entire future transaction stream. AI risk scoring and open banking are significant but slower-moving threats. Embedded payments is already happening at scale.
Does every ISO need to become a technology company to survive these waves?
No. Partnership is a valid strategy. Not every ISO should build their own AI underwriting engine, white-label POS, or open banking integration. The viable paths are: (1) build — for ISOs with the capital and technical talent to build differentiated platform capability; (2) partner — align with platforms like OrderPin that give you embedded payment infrastructure under your brand without building it yourself; (3) specialize — focus on a niche vertical or geography where these waves move more slowly and your relationship depth is a genuine moat. All three are valid. None of them are optional — waiting and doing nothing is not a fourth option.
What does “being on the right side of the wave” mean for embedded payments?
It means you provide the embedded payment infrastructure, not consume it. If your ISO white-labels a POS platform that integrates payment processing under your brand, you are the embedded payment provider. Every transaction your merchants make flows through your processing — you are the platform. If instead your merchants use a third-party POS with embedded payments owned by that POS company, you are displaced. The strategic question is simple: are you the platform, or are you on the platform?
How do open banking APIs threaten ISO data revenue if merchants can get their own data?
Open banking lets merchants access their bank data directly — but that data is not the same as POS transaction data. Bank data shows flows: money in, money out. POS data shows behavior: what sold, when, to whom, at what price, with what modifiers. A restaurant’s bank statement doesn’t tell you their best-selling menu item or their peak hour pattern. The threat to ISO data revenue is real but limited to the processing data layer. POS data — particularly item-level operational data — is not accessible via open banking APIs and remains uniquely valuable.
What is a realistic timeline for these waves to materially impact ISO economics?
AI risk scoring is already embedded in many processors’ underwriting — it’s happening now. Embedded payments is accelerating rapidly: every major POS company is evaluating payment integration, and the embedded finance market projections reflect active investment, not speculation. Open banking in the US is slower-moving than in Europe but the regulatory direction is clear. A realistic timeline: 12-24 months for embedded payments to materially displace processing-only ISOs in competitive markets; 24-36 months for open banking to commoditize processing data; 36-60 months for AI underwriting to fully automate the risk assessment function.
How should an ISO prioritize investments across the three waves?
Priority order: Wave 2 (embedded payments) first — it’s the most immediately structural and the hardest to recover from if you’re displaced. Secure your platform position before the window closes. Wave 3 (open banking) second — the data advantage it enables is significant but building it takes time, and partners are available now. Wave 1 (AI risk scoring) third — there are more off-the-shelf AI underwriting tools available than for either of the other two waves, so you can move faster on partnership. Within 18 months, you want to know your position on all three waves with real pilot data — not speculation.
Three technology waves — AI risk scoring, embedded payments, and open banking APIs — are converging simultaneously on the ISO business model. Each wave attacks a different revenue layer: underwriting fees, transaction routing, and data/reporting. ISOs who are processing-only, platform-light, and data-dependent face structural erosion from three directions. The response is not to panic but to run structured experiments: assess your position on each wave, pilot one technology per wave in the next 6 months, and scale what works. The ISOs who are running pilots in 2026 will have a structural advantage over those still waiting. Being on the right side of these waves is not optional — it’s the difference between building a durable business and watching your margin compress until the model breaks. OrderPin is a restaurant POS software ISV whose white-label platform provides embedded payment infrastructure under your brand — directly addressing Wave 2 from the right side of the wave, while giving your ISO the POS-first data depth that open banking cannot commoditize.
About OrderPin
OrderPin is a white-label POS platform built for ISO and MSP partners. We offer full data ownership, flexible pricing, and seamless API integrations to help you build a recurring revenue business under your own brand. Learn more about OrderPin’s white-label solution
