How to Audit Your Merchant Statement: The 6-Step Playbook

Most merchants have never read their processing statement line by line. The processor knows that. Pricing drifts up 0.05% here, a $25 fee appears there, and within 18 months the effective rate is 40 basis points higher than the day the contract was signed. An audit is how you get that back.

This playbook walks through the exact 6 steps an operator runs on a new account. No software, no consultant. A spreadsheet, three statements, and about 90 minutes.

What a statement audit actually is

An audit is not a sales pitch from another processor. It is a forensic read of three months of statements with one goal: separate what you cannot control (interchange and assessments) from what you can (the markup, the fees, the contract terms).

Roughly 85% of your processing cost is interchange and network assessments. Those numbers are set by Visa, Mastercard, Amex, and Discover. They are the same regardless of who processes for you. The remaining 15% is the processor markup plus fixed fees. That 15% is the entire negotiation surface.

The audit makes that 15% legible. Once you can see it, you can shrink it.

Step 1: Pull 90 days of statements

Three months is the minimum. If your business is seasonal or your card mix shifts, pull six. You want PDFs, not screenshots, because the line-item detail at the back of the statement is what matters and screenshots usually crop it off.

Most processor portals bury statement downloads two clicks deep. Look for "Statements," "Reports," or "Documents." If you cannot find them, email your account rep and ask for the last 6 months as PDFs. Do not accept a summary. You need the full statement, including the interchange detail pages at the back.

What a complete statement contains: a summary page, a fee schedule page, a deposit page, and 2 to 8 pages of interchange line items grouped by card type. If yours stops at the summary, the processor is hiding the interchange detail and that itself is a finding.

Step 2: Compute the effective rate

Open a spreadsheet. Three rows, one per month. Three columns: total processing volume, total fees paid (every fee on the statement, not just the discount line), and effective rate.

Effective rate equals total fees divided by total volume, expressed as a percentage. If you processed $200,000 and paid $5,800 in fees, your effective rate is 2.90%.

Now you have a real number. Not a marketing rate. Not the "qualified rate" on the contract. The actual rate.

Benchmarks I use:

Card-present retail with average ticket above $40: 2.10% to 2.50% is normal. Above 2.70% is overpaying.

Card-not-present ecommerce: 2.50% to 2.90% is normal. Above 3.10% is overpaying.

B2B with high commercial-card mix and no Level 2/3 enabled: 2.80% to 3.40% is normal. Above 3.50% means Level 2/3 is the next move.

Restaurants with tip adjustment: 2.20% to 2.60% is normal. Above 2.80% almost always means downgrades from late tip submission.

Step 3: Classify every line item

Every fee on the statement falls into one of three buckets:

Pass-through (non-negotiable): Visa interchange, Mastercard interchange, Amex OptBlue interchange, Discover interchange, network assessments, NABU, APF, dues. These are set by the networks. The processor only collects them.

Markup (fully negotiable): the basis-point spread above interchange, the per-transaction authorization fee, monthly account fees, statement fees, batch fees, IRS reporting fees.

Junk (often waivable):PCI non-compliance fees, monthly minimums, annual fees, gateway fees that duplicate processor fees, "regulatory product" fees that are just renamed markup.

Add a column to your spreadsheet and tag every line. The total of the "markup" and "junk" columns is your real bill from the processor. That is the number to attack.

Step 4: Spot the four hidden fees

Four fees show up on roughly 80% of merchant statements I review. None of them are interchange. All of them are pure margin to the processor.

1. PCI non-compliance fee. $20 to $40 per month, sometimes $99 per quarter, charged when the annual self-assessment questionnaire was never filed. Filing the SAQ takes 30 minutes and ends the fee. This alone is often $480 a year recovered.

2. Monthly minimum shortfall. Contract sets a $25 minimum monthly processing fee. Slow months trigger the shortfall. Usually 100% negotiable away on a renewal.

3. Batch and IRS reporting fees. $0.10 to $0.25 per batch, $7 per month for IRS 1099-K reporting. The 1099-K is something the processor is legally required to file. Charging extra for it is markup theater.

4. "Regulatory" or "network access" fees. A flat percentage, often 0.10% to 0.20%, dressed up to look like a pass-through. It is not. It is markup with a costume.

Quick math: on $250K monthly volume, a 0.15% "regulatory product fee" is $375 per month, or $4,500 per year, that exists for no reason except that nobody asked about it.

Step 5: Build the negotiation case

Do not call the processor with feelings. Call with three numbers: your 90-day effective rate, the markup-only rate (interchange stripped out), and the dollar total of the four hidden fees.

Then write a one-page request. It says: "Move me to interchange-plus pricing at IC + 0.25% + $0.10. Waive PCI non-compliance because we have completed the SAQ. Drop the monthly minimum. Cap chargeback fees at $15. The alternative is I move the account."

That is the negotiation. The processor will counter. The full lever-by-lever breakdown is in the Payment Processor Negotiation Playbook.

Step 6: Pick the next move

Three options after the audit. Renegotiate, switch, or stay.

Renegotiate if your effective rate is within 0.20% of benchmark and the relationship is otherwise clean. Most processors will save the account.

Switch if your effective rate is more than 0.30% above benchmark, you are on tiered or blended pricing, the contract has more than 6 months left of early termination exposure, or the processor has held funds in a reserve you never agreed to. On reserves specifically, see Capped vs Rolling Reserves.

Stay only if the processor matches market and the integration cost of switching exceeds 12 months of savings.

What audits typically uncover

Across roughly 200 statements I have reviewed in the last three years, here is the dollar range of what a clean audit surfaces:

Under $50K monthly volume: $80 to $400 per month in junk fees and modest markup compression. Annual: $1,000 to $4,800.

$50K to $250K monthly: 0.20% to 0.45% effective-rate reduction plus $300 to $800 per month in junk. Annual: $5,000 to $20,000.

$250K to $1M monthly: 0.15% to 0.35% effective-rate reduction plus reserve and funding-window improvements. Annual: $20,000 to $80,000.

Above $1M monthly: the audit usually pays for a full RFP and a six-figure contract restructure. Often pairs with multi-acquirer routing, covered in Approval Rate Recovery.

One pattern shows up at every volume tier: the longer the contract has run without renegotiation, the bigger the gap. A 4-year-old contract is almost always 0.30% above a freshly negotiated one, regardless of who the processor is. Pricing drifts. Markup creeps. Junk fees accumulate. The audit is the forcing function that resets the clock.

The second pattern: about 30% of audits surface a fee category the operator did not know existed. The most common surprise is the "non-qualified" bucket on tiered contracts, which is sometimes 40 to 60% of total volume getting charged at the highest tier. The operator was sold on the "qualified" rate. Their actual blended rate is 1.2% higher.

Free DIY vs paid audit

Three flavors of audit exist. They are not the same product.

DIY (free, this playbook): works for any volume up to about $250K monthly. The math is not hard. The work is reading carefully.

Free audit from a competing processor: this is a sales tool. The competing processor will find real savings, but those savings come bundled with their own contract. The numbers are usually accurate. The recommendation is biased. Treat it as a second opinion, not as truth.

Paid third-party audit ($500 to $5,000): worth it above $500K monthly, especially on tiered or blended legacy contracts. The auditor has no skin in which processor you end up with, and the dollar findings usually clear 10x the fee in year one.

Frequently asked questions

How long does a merchant statement audit take?

A focused audit on a single processor takes 60 to 90 minutes if you have three months of statements in PDF. Pulling the statements is usually the slowest step. The math itself is one spreadsheet.

How much do merchants typically save after an audit?

On a $100K monthly volume account, a clean audit usually surfaces 0.20% to 0.45% of effective-rate savings, which is $2,400 to $5,400 per year. Above $500K monthly, savings often run six figures because the dollar base is larger and the contract was usually never renegotiated after the first year.

What is the most common hidden fee on a merchant statement?

The PCI non-compliance fee, usually $20 to $40 per month, charged because nobody completed the annual self-assessment questionnaire. After that: monthly minimum shortfall, batch fees, and statement fees. None of these are interchange. All of them are markup the processor keeps.

Should I do the audit myself or pay someone to do it?

If your monthly volume is under $50K, do it yourself with this playbook. If you are above $250K monthly and on a tiered or blended contract, paying for a third-party audit is usually worth it because the dollar savings dwarf the fee. Free audits offered by other processors are sales tools, not audits.

Can I negotiate using only one month of statements?

You can, but you lose leverage. A processor will argue your card mix was unusual that month. Three months is the minimum to make the negotiation airtight. Six months is better if your volume swings seasonally.

Worked example: a 90-day audit on a $180K monthly account

A specialty retail operator, three locations, $180K monthly volume across the chain, average ticket $58. They had been on the same processor for 5 years on tiered pricing.

Step 1: pulled three monthly statements as PDFs. Step 2: total volume across the three months was $542,000. Total fees across the three months was $17,710. Effective rate: 3.27%.

Step 3: classified line items. Interchange and assessments came in at $12,180 (2.25% of volume), which is normal for this card mix. Markup, fees, and junk: $5,530 (1.02% of volume). The 1.02% markup line is the tell. Healthy markup at this volume is 0.20% to 0.35%. Three times market.

Step 4: hidden fees. PCI non-compliance at $30/month per location, $90/month total, $1,080 per year. Monthly minimum shortfall on the slowest location: $25/month, $300 per year. "Network access fee" at 0.18% across all locations: $324/month, $3,888 per year. Combined junk: $5,268 per year recoverable before any rate negotiation.

Step 5: built the case. Effective rate 3.27%. Market for this volume and card mix on IC++ was 2.55% to 2.70%. Gap: 0.57% to 0.72%. On $2.16M annual volume, that is $12,300 to $15,500 per year on top of the $5,268 in junk.

Step 6: outcome. Existing processor matched IC + 0.25% + $0.10, struck PCI non-compliance, dropped the network access fee, removed monthly minimums. New effective rate: 2.61%. Annual savings versus prior contract: $14,300. The audit took 3 hours. The negotiation call took 40 minutes.

Want a 15-minute call with Barak?

If you want a second set of eyes on a contract, statement, or pricing offer, Barak takes a limited number of merchant calls per week.

Get my matched shortlist →