CapRate

1. One-liner

Reads your processor statement each month and tells you the day your 3% surcharge became illegal overcharging.

2. Trend signal — why now?

Three things happened at once, and they point the same direction.

The surcharging population exploded. Slightly more than a third of US small businesses — 35% — now add a surcharge for credit-card payers, up from just 1–2% in 2019. That is a near-30× expansion of a regulated population in six years. Nobody who turned this on in 2023 was thinking about quarterly recalculation math.

The rule is a moving target, and the merchant is on the wrong side of it. The card-brand rule is not “3%.” It is the lower of the brand cap (Visa 3%, Mastercard 4%) or your actual cost of acceptance — and merchants must calculate their effective rate by dividing total monthly processing fees by total monthly credit volume. That denominator moves every single month. Card mix shifts, a big debit month lands, a processor re-tiers you, seasonality hits — and a merchant who set 3% eighteen months ago and never touched it is now collecting more than their cost. IntelliPay, who sells into this market, says it plainly: “Programs rarely fail at launch. They fail eighteen months later, when the rate was never recalculated, a state law changed, the website was rebuilt without the disclosure, or refunds were never tested.”

Enforcement got teeth and a calendar. Visa publicly designated 2026 a high-enforcement year, with audits and fines up. This is not theoretical — Visa has sent in-person auditors to small merchants and runs an escalating ladder: warning letter, then $5,000, then $25,000. Visa’s CEO Ryan McInerney framed it as “We’re just making sure that when consumers do get surcharged, it’s something that’s fair and equitable.” Downstream of the card brands, the acquirer audit outcome is: surcharge config disabled → merchant must refund affected customers → fine. And the state layer bites independently — a California restaurant that added a 3% surcharge drew two complaints to the state Attorney General and was forced to refund roughly $11,000 of surcharges across the prior six months.

The tell that this is unbuilt: I went looking for the methodology and the vendor content itself doesn’t have it. A plain-English 2026 compliance guide walks through the cap, the notice, the signage — and provides no methodology for calculating or proving effective cost of acceptance, noting merchants’ effective rate is “around 2.5%–3.0% all-in” without explaining how to substantiate it in an audit. Meanwhile the audit-readiness guidance says the quiet part: “If asked to demonstrate that surcharge did not exceed cost in a specific quarter, the answer needs to be a file, not a recollection.”

Everyone sells the surcharge feature. Nobody sells the file.

Provenance:
  - Signal 1 (demand): 35% of US small businesses now surcharge, up from 1-2% in 2019 — https://www.paymentsdive.com/news/third-of-us-small-businesses-add-credit-card-surcharges/739018/ — 2026-08-31
  - Signal 2 (economic/regulatory): Visa designated 2026 a high-enforcement year; audit outcome = config disabled + customer refunds + fines; CA restaurant refunded ~$11,000 over 6 months after AG complaints — https://strictlyzero.com/announcements/payments-announcements/credit-card-surcharge-laws-by-state-2026-the-complete-merchant-guide/ — 2026-08-31
  - Signal 3 (feasibility/gap): Audit demands a quarterly cost-of-acceptance worksheet tied to actual statements — "the answer needs to be a file, not a recollection" — and no standalone tool exists independent of the processor — https://intellipay.com/surcharging-compliance-best-practices-build-a-program-that-survives-an-audit/ — 2026-08-31
  - Signal 4 (enforcement precedent): Visa sent in-person auditors; fine ladder warning → $5,000 → $25,000 — https://fortune.com/2023/07/30/visa-cracks-down-credit-card-surcharges-bodegas-small-business/ — 2026-08-31
  Category: Regulatory arbitrage

3. The opportunity

The gap is a conflict of interest, and that’s why it has survived.

Every existing player in surcharging — CardX by Stax, IntelliPay, the 200+ processors and ISOs reselling this technology — makes money from the merchant’s processing fees. CardX sells “0% net cost” credit-card acceptance and claims “automated compliance,” but its own site is silent on whether it recalculates a merchant’s effective cost of acceptance over time or tracks state-law change. IntelliPay offers a complimentary compliance review — consulting, delivered once, as a sales motion for their processing.

Ask what these vendors would have to tell the merchant to do the job properly: “Our fees came down this quarter, so your surcharge is now overcollecting and you’re out of compliance.” Or worse: “Your effective rate dropped because your customers shifted to debit — and you can’t surcharge debit at all.” A processor structurally will not build the tool that audits its own pricing against the merchant’s exposure. This is the classic buy-side/sell-side split: the tooling followed the fee-payer, and the merchant carrying the refund liability got nothing.

The incumbent weakness is specific and exploitable:

• They sell the switch, not the proof. Turning surcharging on is a five-minute config. Surviving an audit eighteen months later requires a dated twelve-month cost-of-acceptance worksheet tied to actual statements, plus a rate-decision memo. Nobody ships that artifact.
• They are point-in-time. The failure mode is drift — a rate that was legal in March and illegal by November because the card mix moved. A one-off compliance review cannot catch a moving denominator.
• They are single-processor. A merchant with a POS processor and a separate online gateway has two different effective rates and one surcharge setting. Nobody reconciles across them.
• They ignore the state layer. Connecticut and Massachusetts ban surcharging outright. Colorado (HB21-1289) caps at 2% or actual cost — stricter than the card brands. California SB 478 and New York GBL §518 impose upfront all-in price display. A multi-state merchant on one flat 3% is non-compliant in several jurisdictions simultaneously and doesn’t know it.

The 10× is arithmetic AI can do continuously that a bookkeeper does never: parse a messy monthly merchant statement, separate credit from debit volume, compute the true blended effective rate per card product, compare it to what the merchant is actually charging, and produce a signed, dated file.

4. Target market

Primary customer: Owner-operators and their bookkeepers at US independent merchants doing $300K–$5M in annual card volume, actively running a surcharge or dual-pricing program, in high-ticket service verticals where the surcharge is material and the customer is likely to complain: auto repair shops, HVAC and plumbing contractors, medical and dental practices, veterinary clinics, law firms, independent restaurants and bars, B2B distributors, and municipal/utility billers.

Why they buy — the pain in their words: They aren’t lying awake about card-brand rules. They’re worried about the sequence that starts with an annoyed customer. The California restaurant case is the exact fear: two complaints to the AG, six months of surcharges clawed back, ~$11,000 gone. It reaches them as “a customer said we’re not allowed to do this — are we?” and they have no way to answer beyond a recollection. Meanwhile the actual live risk is invisible: IntelliPay’s own worked example shows a flat 3% on $500,000 annual volume overcollecting roughly $2,160 a year on lower-cost card products — every dollar of which is refundable liability sitting on the books.

Rough TAM reasoning: ~33 million US small businesses; a large majority take cards. If 35% of card-accepting SMBs surcharge, the surcharging population is in the millions. But the honest serviceable slice is much narrower: merchants with enough volume that a surcharge is material, enough sophistication to fear an audit, and multi-state or multi-processor complexity. Call it 150,000–400,000 merchants in the $300K–$5M volume band across the target verticals. At $79–$249/mo, capturing 0.3% of the low end is a ~$4M ARR business. This does not need to be a category winner to work.

Why now for them: Visa named 2026 the enforcement year, the merchant’s own processing costs have been moving (record-high average swipe fees of 2.35%, plus the April 2024 interchange adjustments and premium rewards-card mix shifting rates), and the merchants who switched surcharging on during the 2023–24 wave are now hitting exactly the eighteen-month mark where programs fail.

5. Product sketch (MVP)

• Statement ingest. Forward or upload the monthly merchant statement from any processor — PDF or CSV. Parse fees, credit volume, debit volume, and card-product mix. No processor switch, no integration required to start.
• The number. A single monthly figure: your true effective cost of acceptance, per card brand and per product type, computed the way an auditor would compute it — total fees ÷ total credit volume.
• The verdict. Green / amber / red against what you are actually charging today, with the specific overcollection in dollars: “You charged 3.00%. Your March cost of acceptance was 2.71%. You overcollected $1,840 across 612 transactions.”
• Drift alarm. Fires the month your surcharge crosses your cost, or when your debit mix indicates debit is being surcharged (a hard prohibition, and a CFPB exposure).
• State-rule overlay. Flags where your rate is illegal by jurisdiction — CT/MA bans, Colorado’s 2% cap, California SB 478 and New York §518 disclosure form — based on the states you operate and ship in.
• The audit file. One-click, dated, immutable PDF: twelve-month cost-of-acceptance worksheet tied to the underlying statements, the rate-decision memo, the acquirer 30-day notice letter, and dated signage/checkout screenshots. This is the deliverable the whole product exists to produce.
• Rate recommendation. The compliant rate to set for next quarter, with the reasoning written out so the bookkeeper can hand it to the owner.
• Refund exposure meter. Running total of cumulative overcollection — the number that would be clawed back if an acquirer or AG asked today.

6. AI angle — what’s load-bearing

Remove the AI and this product dies at the front door.

The load-bearing work is statement normalization. There is no standard merchant statement. Every processor, ISO, and payfac emits a different PDF with different fee nomenclature — interchange, assessments, dues, per-item, monthly minimums, PCI fees, batch fees, gateway fees, tiered vs. interchange-plus presentation — buried in inconsistent multi-page layouts designed, frankly, to be hard to read. Deciding which of forty line items belongs in “cost of acceptance” for a specific card product, then splitting credit from debit volume correctly, is exactly the judgment task that used to require a payments consultant reading the statement by hand. Modern document-understanding models do it in seconds per statement, at a cost of cents.

That’s the collapse: a $500/hour payments consultant’s one-off statement audit, run automatically every month for $99. The second AI job is the state-rule overlay — reading and diffing surcharge statutes across 50 states and mapping them onto a merchant’s operating footprint, kept current as legislatures move.

Everything downstream — the verdict, the alarm, the PDF — is deterministic arithmetic and templating. The AI does the dirty ingestion and the legal mapping. Without it, the product is a spreadsheet the merchant will never fill in, which is precisely why the file doesn’t exist today.

7. Localization angle (if any)

N/A — this is a US-first play, deliberately. The wedge is the American regulatory mess: card-brand rules layered on a 50-state patchwork where three states ban the practice, Colorado caps tighter than the networks, and California and New York impose their own disclosure regimes. That fragmentation is the moat, not an obstacle.

There is a natural second market later — Australia, where the RBA has moved hard on surcharging and excessive-surcharge rules, and Canada, where post-settlement surcharging is permitted with its own caps and Quebec carve-outs. Same product shape, different rule table. But shipping US-first is correct: the enforcement calendar is now, and the rule table is the asset.

8. Business model — path to $1M–$5M ARR

• Pricing: $79/mo (single location, one processor) · $149/mo (multi-location or multi-processor, the sweet spot) · $249/mo (multi-state, includes state-rule overlay and quarterly signed rate memo). Annual prepay at 2 months free.
• ACV: ~$1,500 blended, assuming the $149 tier dominates and roughly 40% take annual.
• Rough math to $1M ARR: 560 merchants × $149/mo × 12 ≈ $1.0M. That is a genuinely small number of customers in a population measured in the hundreds of thousands.
• Rough math to $5M ARR: ~2,800 merchants at the same blend, or ~1,900 with meaningful mix shift to the $249 multi-state tier plus a bookkeeper/accountant multi-client seat. Realistically $5M is reached via the accountant channel (one firm managing 30–80 merchant clients) rather than one-by-one direct sales.
• Expansion path: More locations and more processors per account is the natural first expansion. Then the advisor tier — bookkeepers, fractional CFOs and merchant-services consultants managing a book of clients, priced per managed merchant. Then adjacent evidence products for the same buyer: chargeback/dispute file assembly, PCI attestation trail, and interchange-optimization findings (which are a natural byproduct of parsing the statement, and a credible upsell that saves the merchant money rather than just protecting them).

A note on honesty: the refund-exposure meter is the retention mechanic. Once a merchant sees a cumulative liability number, cancelling means deliberately choosing to stop watching it. That’s sticky in a way that a dashboard is not.

9. Go-to-market wedge — first 100 customers

The distribution insight: surcharging merchants are self-identifying in public. They have to be — disclosure at point of entry is mandatory. That makes them scrapeable in a way most compliance buyers are not.

1. Scrape the disclosure. Merchant websites and checkout pages carrying “a 3% surcharge applies to credit card transactions” (and variants) are indexable, as are Yelp/Google review bodies where customers complain about the fee. Assemble 3,000 US merchants in the target verticals. Send each a free one-page Surcharge Exposure Report computed from their publicly-posted rate and their vertical’s typical card mix — with the headline “your posted rate is X%, the typical effective cost in your category is Y%, here is your estimated annual overcollection.” That’s a personalized, numeric, slightly alarming artifact, not a pitch. Target 8–12% reply on a specific-number cold email; convert 3–5% to a paid statement audit.

2. The complaint mine as a target list. Consumers actively report merchants for improper surcharging — there are public consumer-facing pages dedicated to reporting a business for surcharging a card purchase improperly, plus AG complaint channels and review threads. Merchants named in those complaints are pre-qualified: they have already had the scary conversation. Reach them within days with “we saw the complaint, here’s whether you’re actually exposed.”

3. Sell through the bookkeeper, not the owner. The owner doesn’t read the merchant statement; the bookkeeper does, and hates it. Target the r/Bookkeeping and r/Accounting communities, state CPA society listservs, and the QuickBooks ProAdvisor directory with a free “statement decoder” tool. One bookkeeper brings 5–20 merchant clients. This is the channel that takes the business from $1M to $5M and it compounds — offer revenue share.

4. Ride the enforcement news cycle. Every acquirer audit wave, every state AG action, every Visa rule bulletin is a distribution event. Maintain the definitive free public resource — a state-by-state surcharge rule table with the current caps and disclosure requirements, updated as legislatures move. This is the piece competitors’ blogs conspicuously do not maintain accurately, it is cheap to keep current with the same AI that runs the overlay, and it captures the “is my surcharge legal in [state]” search intent at the exact moment of fear.

5. Partner against the processors, carefully. Independent merchant-services consultants and ISOs who don’t own the surcharge platform will white-label this as a differentiator when pitching against CardX/Stax incumbents. Ten such consultants, each with 40 merchants, is 400 warm introductions.

10. Build complexity — justification

Low. The hard part is a document-understanding pipeline over messy processor PDFs — genuinely fiddly, but it is off-the-shelf model work plus a normalization layer and a growing library of per-processor statement templates, not research. The compliance arithmetic is elementary division; the state rule table is content work, not engineering. No payment processing, no money movement, no PCI scope — the product only ever reads statements, which keeps the regulatory surface almost nil and means there is nothing to get approved before launch.

A solo technical builder ships a credible v1 — ingest, effective-rate calculation, verdict, audit PDF — in 6–8 weeks, and can hand-process the first 20 customers’ statements manually while the parser matures. The state overlay follows in weeks 9–12. Ops cost is a few cents per statement per month, so gross margin stays north of 90%.

11. Gating checklist

Gate	Pass?	Note
Legal in target market	✅	Reads merchant-supplied statements and public statutes. No money movement, no PCI scope. Must disclaim that output is not legal advice.
Ethical — no harm / dark patterns	✅	Actively pushes merchants to charge customers less and to stop overcollecting. The consumer benefits alongside the buyer.
Market exists (evidence above)	✅	35% of US SMBs surcharge; documented fines, AG refund orders, and a declared 2026 enforcement year.
1–5 person team can build this	✅	Solo builder, 6–8 weeks to v1.
Launchable with <$50K / ₹40L	✅	Realistically $8–15K: model inference, a legal review of the rule table, and cold-email tooling.

12. Feasibility score

Axis	Weight	Score	Notes
Problem intensity	20	16/20	Real money and real liability — documented $11K clawback, $5K–$25K fine ladder, forced customer refunds. Docked because it’s a latent pain: most merchants don’t feel it until the audit letter lands, which makes the sale a fear sale rather than a bleeding-neck sale.
Demand evidence	15	13/15	Strong and independent: 35% adoption (30× growth since 2019), Visa’s declared enforcement year, in-person auditors, AG-forced refunds, and vendors publicly admitting programs fail at 18 months. Docked because I found no direct merchant complaint threads asking for this specific tool.
Build feasibility	15	12/15	Off-the-shelf document AI plus arithmetic; no PCI, no money movement. Docked for the long tail of processor statement formats, which is grindy and never quite finished.
Distribution clarity	15	11/15	Genuinely good — surcharging merchants publicly disclose their rate, so the target list is scrapeable and the cold email carries a personalized number. Docked because cold email to owner-operators converts unevenly, and the bookkeeper channel is a slower compound.
Revenue mechanics	15	11/15	$149/mo is well inside SMB tolerance against a $25K fine, and 560 customers to $1M is achievable. Docked because it’s an insurance-shaped purchase: churn risk is real once a merchant feels safe, and $5M likely requires the advisor channel to work.
Time to first revenue	10	8/10	Free exposure report → paid audit is a short funnel; first paying customer plausible within 4–6 weeks of launch. Not a 9–10 because there is no pre-existing pool of people searching for this by name.
Defensibility	10	5/10	Execution-and-corpus moat only. The statement-parser library and the maintained 50-state rule table compound over 12 months and are annoying to replicate. But nothing stops a processor-neutral platform from bolting this on — and note that the processors themselves won’t, for the conflict reason above, which is the real protection.
Total	100	76/100

13. Qualitative modifiers

Founder-fit tags

technical-heavy · domain-expertise-required

You need someone who can build a robust document pipeline and someone who genuinely understands merchant statements — interchange-plus vs. tiered pricing, what belongs in cost of acceptance, how ISOs pad fees. A founder out of the payments/ISO world with a technical partner is the ideal pair. Without the domain half, the calculation will be subtly wrong and the product is worse than useless — it would produce a confidently incorrect audit file.

Key assumptions to validate (3–5)

1. Assumption: A meaningful share of active surchargers are currently overcollecting — i.e. their real effective rate sits below their posted rate. How to test: Obtain 25 real merchant statements from friendly merchants and bookkeepers, compute effective cost of acceptance by hand, compare to their posted surcharge. If fewer than 8 of 25 are overcollecting, the core alarm rarely fires and the product has no recurring hook.
2. Assumption: Merchants will pay to prevent an audit outcome they haven’t yet experienced. How to test: Send the free exposure report to 300 scraped merchants; measure not replies but conversions to a paid $199 one-time statement audit. Willingness to pay once predicts willingness to subscribe.
3. Assumption: Statement parsing generalizes across the top processors without per-merchant hand-holding. How to test: Collect statements from the 15 most common processors/ISOs in the target verticals; measure extraction accuracy on fees, credit volume and debit volume. Below ~95% on the core fields, unit economics degrade into manual services.
4. Assumption: Bookkeepers will bring multiple clients rather than treating this as a one-off. How to test: Recruit 10 bookkeepers to the free statement decoder; measure how many bring a 2nd and 3rd client within 60 days.
5. Assumption: Card-brand and state rules stay stable enough that the rule table is an asset, not a treadmill. How to test: Track surcharge-related legislative activity across all 50 states for one quarter; count material changes.

Risk flags

1. Platform/incumbent dependency: A processor-neutral platform (or a Stax/CardX competitor looking to differentiate) could ship a “compliance monitor” tab. The conflict-of-interest argument protects you from the processors, but not from a neutral third party. Speed and the rule-table corpus are the answer.
2. Latent-pain churn: This is insurance. A merchant who runs 9 months without an audit may rationally cancel. Mitigation is the refund-exposure meter and the interchange-optimization upsell that returns cash — a product that saves money churns far less than one that only prevents loss.
3. Liability risk: If the audit file is wrong and a merchant is fined anyway, you’re on the receiving end of the anger. Requires hard disclaimers, “not legal advice” framing, conservative rounding in the merchant’s favour, and E&O insurance before scaling. Do not let the product state a legal conclusion — it states a computed number and a flag.
4. Regulatory reversal: The Visa/Mastercard interchange settlement continues to evolve and card-brand surcharge rules could be relaxed or restructured, softening urgency. Conversely a state-level surcharge ban wave would shrink the customer base outright — Connecticut and Massachusetts already ban it.
5. Data access friction: Merchants must forward statements. Every manual step costs conversion. Email-forwarding ingest is table stakes; processor API/portal integrations become necessary sooner than you’d like.

14. Structured verdict

Score:                  76/100
Verdict:                GO
Confidence:             Medium
Best-fit builder:       Technical founder with a payments/ISO domain partner who can read a merchant statement cold
Time to revenue:        6-10 weeks from start of build
Capital to launch:      $8-15K (₹7-13L)
Top 3 assumptions to validate first:
  1. A meaningful share of active surchargers are currently overcollecting — hand-compute effective cost of acceptance on 25 real statements; need 8+ overcollecting
  2. Merchants pay to prevent an audit they haven't had — 300 free exposure reports, measure conversion to a paid $199 one-time audit
  3. Statement parsing generalizes — 95%+ extraction accuracy on fees/credit volume/debit volume across the top 15 processors
Kill criteria:
  - Abandon if fewer than 8 of 25 hand-audited merchants are actually overcollecting (the alarm never fires, so there is no recurring product)
  - Abandon if <2% of 300 free exposure reports convert to a paid one-time audit within 45 days
  - Abandon if a processor-neutral platform ships equivalent monitoring with statement ingest before v1 launch
  - Abandon if statement extraction accuracy stalls below 90% on core fields, forcing a manual-services business model

15. Next step — 1-week validation sprint

• Day 1–2: Get 25 real merchant statements. Post in r/Bookkeeping, r/smallbusiness and two vertical Facebook groups (auto repair, HVAC) offering a free hand-done surcharge compliance check in exchange for the statement. Compute effective cost of acceptance manually for each and compare against their posted surcharge rate.
• Day 3–4: Scrape 300 merchants publicly disclosing a surcharge rate on their website or checkout. Send the personalized free exposure report with an estimated overcollection number and a single call to action: a $199 one-time statement audit, delivered by hand.
• Day 5: Decide.

Falsifiable outcome: Go if ≥8 of 25 statements show the merchant charging above their true effective cost of acceptance and ≥6 of 300 cold recipients (2%) pay $199 for the manual audit. The first number proves the problem is live rather than theoretical; the second proves someone will pay for the file before you’ve written a line of parser code. Miss either and the idea goes back on the shelf — a compliance product whose alarm never fires is a newsletter, not a business.