CompanyGraph
Global Payments Inc.
GPN · NYSE Arca · United States
Runs a single software connection that handles both checkout software and card payment approval for merchants.
Global Payments runs a platform called Genius that gives merchants a single connection handling both their point-of-sale software and the card authorization that routes transactions through Visa and Mastercard. That single connection is registered to a specific processor identification number, and any merchant who wants to switch to a competing processor must re-certify a new number with Visa and Mastercard and retest every piece of software attached to it — a process the card networks control and that takes three to six months for complex systems, regardless of how much money a competitor spends trying to speed it up. The same API that creates that switching friction also creates the platform's biggest internal problem: mandatory security patches required by PCI DSS run on a different schedule than the point-of-sale software sharing the same connection, so applying a required patch can break live merchant checkout, forcing a choice between a compliance violation and a rollback that breaks the unified system the whole lock-in depends on. If Visa or Mastercard ever changed their rules to let merchants carry their certified processor identification numbers to a new provider without full re-certification, the three-to-six month switching cost would disappear and so would the mechanism holding merchants in place.
How does this company make money?
The company takes a percentage cut of every card transaction — typically 2 to 3 percent of the transaction value — as an interchange fee. It also charges merchants a monthly subscription fee for the POS software modules. On top of that, it collects a per-transaction processing fee of $0.10 to $0.30 on each payment, with the exact amount depending on the type of card used and how risky the merchant's business is rated.
What makes this company hard to replace?
A merchant's payment setup is certified to a specific processor identification number registered with Visa and Mastercard — moving to a new processor means re-certifying a new number and retesting every POS integration, which takes 3-6 months for complex systems. On top of that, the merchant's underwriting and risk history is stored in proprietary models that cannot be exported to a competing processor, so switching means starting that profile from scratch.
What limits this company?
The platform must meet PCI DSS Level 1 certification — the payment industry's top security standard — which requires an on-site audit every year and ongoing security patches. Those patches run on their own schedule, separate from the checkout software that shares the same API. When a mandatory security patch breaks the checkout software, the company must either leave a live security violation in place or roll back the patch and break merchant payments — and either choice undermines the reliability the whole platform is built on.
What does this company depend on?
The platform cannot run without access to Visa and Mastercard networks for routing transactions, PCI DSS Level 1 certification from qualified security assessors, acquiring bank partnerships in each country where it operates, AWS cloud infrastructure to run the Genius platform, and Federal Reserve ACH network access to fund merchant settlements.
Who depends on this company?
Restaurant POS software providers would lose their embedded payment functionality if the processing API went down. E-commerce platforms whose checkout flows rely on real-time authorization responses would stop being able to complete sales. Franchise operators who depend on next-day ACH settlement to their business bank accounts would have their daily cash flow cut off.
How does this company scale?
Routing more card transactions is cheap — it runs through software load balancing across existing network connections and does not require new physical infrastructure. But adding merchants in a new regulated market requires obtaining local banking licenses and building correspondent banking relationships, which involves multi-year regulatory approval and cannot be sped up with money alone.
What external forces can significantly affect this company?
When the Federal Reserve raises or lowers interest rates, the income the platform earns on the timing gap between when it collects funds and when it pays out changes. In Europe, PSD2 regulations require extra authentication steps on card transactions, which adds friction to checkout flows. US-China trade tensions create problems for merchants who have international supply chains and need to move money across borders.
Where is this company structurally vulnerable?
If Visa or Mastercard changed their rules to allow processor identification number portability — or if a regulator ordered that merchants could carry their certified identification number to a new processor without repeating the full certification process — the 3-6 month switching barrier would disappear, and the lock-in that holds the business together would collapse.