The frozen merchant account: risk reviews and getting released

Why did my card processor freeze my deposits?

A processor freezes deposits when its risk team decides the account needs a closer look before releasing your money. Because the processor is on the hook if a batch of payments is later reversed, it holds funds to cover that exposure while it reviews. The freeze is almost always about risk, not wrongdoing on your part. It is triggered by a pattern the system flagged, and it usually lifts once you satisfy the review or agree to a reserve.

That framing matters for how you respond. This is a card processing risk decision, not an accusation, so the fastest path out is to give the risk team what it needs to close the file, not to argue that the flag was unfair.

Common triggers behind a hold

Most freezes trace to one of a handful of patterns, and identifying yours tells you what documentation will end it fastest. A sudden jump in volume or a single unusually large charge looks like fraud to an automated system. A rise in chargebacks or refunds signals dissatisfied cardholders. A high-risk merchant category, mismatched or outdated business information, or a name that does not match your bank account all invite a review. Suspected account takeover triggers the strictest holds.

• Volume spike — recent processing statements and a short explanation of the change usually clear it
• High chargeback or refund rate — your refund and cancellation policies, plus your responses to the disputes
• High-risk category or mismatched details — business license and a bank letter matching your legal name
• Suspected account takeover — proof of identity and confirmation that you authorized the batches

The first 72 hours: how to respond to a freeze

Move fast, because a hold on your deposits is a hold on your income. Read the freeze notice the day it arrives; it names the reason, the documents wanted, and how to respond. Contact the processor's risk or underwriting team directly, not general support, and ask exactly what will release the funds. Send the requested documentation in one complete package rather than in pieces. Keep a written record of every contact, because timelines and promises matter if you escalate.

Have ready:

• The freeze notice and any case or ticket number
• Business registration and a bank letter or voided check matching the account name
• Recent processing statements and records for the flagged transactions
• Your refund and cancellation policies if chargebacks are the issue

If the risk team stalls, escalate to your acquiring bank in writing and reference the dates of your submissions. Piecemeal responses tend to restart the review, so complete beats fast.

Reserves, rolling holds, and reading your processor agreement

A reserve is money the processor holds back to cover future chargebacks, and it comes in a few shapes. A rolling reserve keeps a percentage of each batch for a set period before releasing it; a capped reserve holds until a fixed amount accrues; an upfront reserve is withheld immediately. Your processing agreement, not a general rule, defines what your processor can do and for how long. Read that agreement, because it also governs how much notice you are owed.

The same agreement that sets reserve terms also governs whether you may pass card surcharges to patients and what happens if the account is closed. Know these terms before a freeze, not during one. If a reserve is the outcome, get its size, its release schedule, and its trigger in writing, so you can plan cash flow around it instead of guessing.

Building continuity so a freeze can't stop your practice

The durable fix is to make a single processor's decision survivable. Keep a cash cushion sized to a few weeks of operating costs, so a hold does not miss payroll or rent. Maintain a second merchant account with a different processor you can switch to quickly. Set up patient payment options that do not depend on one rail. The federal small-business continuity framework, sized down to a practice of one, is a simple way to plan for this disruption 1Ref 1U.S. Department of Homeland Security (2026).Ready.gov Business.The federal business-continuity planning framework sized to a practice of one, used to plan a cash reserve and backup arrangements so a payment disruption does not stop operations..

• Cash reserve — a few weeks of runway turns a freeze into an inconvenience, not a crisis
• Backup processor — a second, dormant merchant account you can activate in a day
• Multiple rails — card on file, HSA/FSA cards, and simple invoicing so no single freeze halts collections
• Clean bookkeeping — current statements and reconciliations make any documentation request fast to answer

Steady, predictable processing is itself protection: keep chargebacks low, keep your business details current, and a routine review rarely becomes a freeze.

When the freeze is really a data-security flag

Sometimes a freeze is not about volume but about a suspected data compromise, and that changes what you owe. If the notice mentions suspected fraud, an account takeover, or a possible breach involving patient payment information, treat it as a security event, not a billing dispute. The HIPAA Security Rule requires safeguards for electronic patient information scaled to your practice, independent of anything the processor does 2Ref 2HHS Office for Civil Rights (2026).Summary of the HIPAA Security Rule.That the Security Rule requires safeguards for electronic patient information scaled to the practice, a duty that applies independently when a freeze signals a possible data compromise.. The Security Risk Assessment tool walks a small practice through the required risk analysis 3Ref 3Office of the National Coordinator / ASTP (2026).Security Risk Assessment Tool.That ONC/OCR publish a free Security Risk Assessment tool sized for small practices to conduct the risk analysis the Security Rule requires after a suspected compromise..

The two duties run in parallel. Resolving the processor's review gets your money released; running your own risk analysis is what tells you whether patient information was actually exposed and whether any notification obligation follows. Do not assume the processor's investigation covers your HIPAA responsibilities. Document what you find either way, because a clean record is the difference between a manageable incident and an unprovable one.