Processor Holds, Reserves and Closures: What the Contracts Say

"Payment processors can hold your money for 180 days" is repeated so often that it sounds like an industry rule. Of the five contracts we read, only PayPal's contains it.

We read the US merchant agreements of Stripe, PayPal, Square, Shopify Payments and Wave on the processors' own sites on 10 September 2026. PayPal's is the only one that writes down a maximum for how long it can hold your money, and even that has an exception for court orders, regulatory requirements and legal process. Stripe's says it will release a reserve "only if, and to the extent that, Stripe is satisfied that the relevant risk exposure has been mitigated." Square's, Shopify's and Wave's put no time limit on a reserve.

Every one of the five can hold your payouts, set aside a reserve when it judges you a risk, and end its payment service to you without needing to show you broke the rules. None of them promises a date when you get the money back.

The versions we read are listed in the table below, with their dates. This isn't legal advice, and we aren't lawyers. If a processor is holding a large sum of yours now, a lawyer who handles payments disputes is worth more than this article.

The five agreements side by side

Only one agreement has a clock

PayPal sets three periods. Risk-based holds "generally remain in place for up to 21 days from the date the payment was received". A payment challenged as one that should be reversed is held "until the matter is resolved (but no longer than 180 days)". And if PayPal decides you've engaged in restricted activities, it can hold your balance "for up to 180 days if reasonably needed to protect against the risk of liability". Holds based on "a court order, applicable law, regulatory requirement or other legal process" can run "longer than 180 days."

Two further lines in PayPal's agreement matter if you're thinking of leaving:

• You can't close your account while it's under a hold, limitation or reserve.
• If PayPal closes it, you get "unrestricted" funds. Its agreement says it will "make any unrestricted funds … available for withdrawal." Money still under a hold stays where it is.

Stripe writes no period at all. Its Financial Services Terms say it "has sole control over the Reserve", that you are "not entitled to draw funds from any Reserve", and that it releases them when "Stripe is satisfied that the relevant risk exposure has been mitigated." Stripe's Payments Terms let it use its remedies for risks that arise "after these Stripe Payments Terms terminate", so closing the account doesn't start a countdown either. We checked every day count in the Payments Terms. Each is about something else: notice periods, error reports, a data request after termination, a refund rule.

Square may "defer payout or restrict access to your Proceeds, temporarily or indefinitely, if we need to conduct an investigation". Its reserve can be "raised, reduced or removed at any time by Square, in its sole discretion." The only day counts in its Payment Terms are 30 days to report a processing error and 120 days to issue a refund.

Shopify Payments may require "a certain amount (including the full amount) of the funds received for a Transaction" to be "held for a period of time", and Shopify sets that period. After termination, "a Payment Processor may elect to continue to hold any funds deemed necessary". The US terms page carries no date (we retrieved it on 10 September 2026), so there's no way to tell from the page which version you agreed to. Shopify Payments runs on Stripe or PayPal, each with its own agreement, and we didn't read those.

Wave's US payments terms for accounts processed by Adyen say that "we or the Acquirer may require a Reserve for any reason, including high chargeback risk or indications of performance problems". Payouts arrive "no more than 30 days after funds settle to the Acquirer, subject to any Reserve imposed". Wave also says that "If your processing of credit card payments is powered by Stripe, you're bound by their Terms of Service", and nothing we read says which Wave accounts are on which. If you're on Wave, check which processor your account uses.

The processors' help pages describe how they use reserves in practice. None of it is a promise in the contract.

• Stripe: reserves are "fixed and rolling", and Stripe does "another credit review" a few days before one is set to expire.
• Square: its reserves are rolling, and accounts with reserves "will be reviewed after a minimum of six months."
• Shopify: its examples use 120 days.
• PayPal: the example in its agreement is 10% "held for a 90-day rolling period".

You'll also find "90 to 180 days after closure" quoted for Stripe, and "up to 90 days" for Square, on payment blogs. We didn't find either figure in the agreements or help pages we read.

What sets it off: charging before you deliver

The trigger that appears in Stripe's, PayPal's and Wave's agreements, and in Shopify's help pages, is the gap between when you charge and when the customer gets what they paid for.

• Stripe's remedies — delayed payouts, a reserve, suspension — apply if you've "submitted one or more Transactions for goods or services not immediately deliverable to the Customer without first obtaining Stripe's consent". They also apply if there's a material "change in the average time between the initial charge and fulfillment". Its help page adds "an unexplainable sharp increase in processing volume".
• PayPal lists "Your delivery time frames" among the factors for a reserve.
• Shopify names "Businesses with extended billing cycles" and gives "annual subscriptions" as the example.
• Wave's reserve is sized to cover, among other things, "unshipped" merchandise and unfulfilled services.

That describes a lot of one-person businesses: a consultant who takes a deposit, a coach selling a three-month package upfront, a course that starts in six weeks, an annual retainer paid in January. Stripe's wording means selling something "not immediately deliverable" without its consent is, on its own, a stated reason for Stripe to act. Stripe's terms name its consent as the way around that, so if that's your model, asking Stripe before you launch is the cheap step.

You owe the chargebacks you don't win, and Stripe and Wave can debit your bank for them

The liability runs one way.

• Stripe: you're "liable to Stripe for the full amount of all Disputes", unless a dispute "is resolved to final disposition in User's favor", "and other related costs, Refunds and Reversals regardless of the reason, timing or whether User uses the Stripe Payments Services to manage" them. If Stripe can't collect, it "may, to the extent Law permits, deduct, recoup or setoff" from your reserve, your balance, "each User Bank Account", and a backup payment method. It can also fund a reserve by "debiting the User Bank Accounts".
• PayPal: "When you receive a payment, you are liable to PayPal for the full amount of the payment sent to you plus any fees if the payment is later invalidated or reversed for any reason."
• Wave: "You are liable for all chargebacks and returns, whether or not the chargeback or return complies with the Operating Regulations." When your Wave balance can't cover what you owe, its terms provide to "debit your bank account for the amount owed".
• Square: caps its own liability to you at "THE GREATER OF (A) THE AMOUNT OF FEES EARNED BY US … DURING THE THREE (3) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT … OR (B) $500."

Because Stripe can debit the bank account you link, which account that is makes a difference. A separate business account used only for payouts means a debit can't reach the money you pay rent from. That's our suggestion, not something any processor says.

The list that outlasts your account

The tail risk isn't a fine from Visa. Visa's monitoring program counts card-not-present transactions only. Since 1 April 2026, by its own fact sheet (which carries no publication date), it identifies an individual US merchant as excessive at 150 basis points and at least 1,500 fraud and dispute reports in a month, where the merchant's acquirer isn't itself flagged. Hardly any one-person business sees 1,500 disputes a month.

The one to know about is Mastercard's MATCH list, a database of merchants whose processors closed their accounts. We couldn't open Mastercard's own rules manual, which blocked our requests, so everything below is Stripe describing Mastercard's and Visa's rules, not the card networks' own text. According to Stripe's documentation:

• A merchant qualifies for the excessive chargebacks code when "monthly Mastercard chargebacks exceed 1% of total monthly Mastercard sales transactions and total 5,000 USD or more", with both "met in the same month".
• "Mastercard doesn't require a minimum count of individual chargebacks", and "Winning or reversing the chargebacks later doesn't alter this status."
• "closing a processing account doesn't prevent a listing."
• "Listings remain active for 5 years", and only the bank that listed you can remove it.
• "A MATCH listing generally disqualifies a merchant from processing with Stripe."

Visa's equivalent, VMSS, also keeps listings for five years, Stripe says, and "Visa doesn't allow merchants to appeal listings directly".

Here's the arithmetic on those thresholds as Stripe states them. Suppose you sell 100 packages at $1,000 to Mastercard holders in a month and 6 are charged back. That's 6% of transactions and $6,000, so both tests are met. For a high-ticket, low-volume business, one bad month followed by an account closure is the scenario that matters.

The decision with a 30-day deadline

If a hold goes wrong, what you can do about it depends on the arbitration clause. Two of the agreements we read give you a one-time chance to opt out, and it expires 30 days in.

• PayPal: "If you are a new PayPal customer, you can choose to reject this Agreement to Arbitrate by mailing us a written opt-out notice", postmarked "no later than 30 days after the date you accept this user agreement for the first time." It calls mail "the only way you can opt out".
• Square: by written notice "within thirty (30) days after you first create a Square Account, or for existing customers who agree to this as a terms update, within thirty (30) days after first becoming subject to this arbitration agreement."
• Stripe: its US terms send disputes to arbitration under the AAA's commercial rules in San Francisco, with a class waiver and no opt-out. They add: "If this waiver of class or consolidated actions is deemed invalid or unenforceable, neither party is entitled to arbitration."
• Wave: arbitration, and no US opt-out in its Terms of Use (effective 29 January 2025).
• Shopify: its own Terms of Service contain no arbitration clause and send US merchants' disputes to the courts of Ontario, Canada. Disputes about money a processor holds may run under the Stripe or PayPal agreement behind Shopify Payments, which we didn't read.

One case shows how this plays out. Evans v. PayPal, Inc. (N.D. Cal. No. 5:22-cv-00248) was a 2022 class action whose complaint alleged that PayPal kept merchants' money after its 180-day holds ended. The docket shows the court granted PayPal's motion to compel arbitration in June 2022, and the appeals court affirmed in September 2023. We read the docket, not either ruling.

Whether to opt out is your call, and a lawyer's. The point is that it's a decision you make when you open the account or accept new terms, not after a freeze.

What to do before anything goes wrong

• Save a dated copy of your processor's agreement. Shopify's US payments terms carry no date, and Stripe, PayPal and Square each have an agreement dated 2026.
• If you charge before you deliver, raise it with the processor first. Stripe's terms make its consent the difference between an ordinary sale and a stated trigger.
• Warn the processor before a launch or a large one-off invoice (our suggestion), since a sharp jump in volume is a named trigger in Stripe's help page. For a big invoice, ACH or wire keeps it off the card rail. Our invoicing article covers what each rail costs.
• Link a payouts-only bank account, for the reason above.
• Upload tracking where you ship. PayPal says it may release a hold earlier if you've "uploaded shipment tracking information", though earlier release "is at our sole discretion".
• Answer information requests quickly, and appeal where you're offered it. PayPal asks you to use its Resolution Center or the instructions in its notice. Stripe shows an appeal option on the Balances page only when a reserve can be appealed.
• Decide on arbitration within 30 days if you're opening a PayPal account (its opt-out is for new customers) or are with Square.
• Keep chargebacks below both halves of the MATCH test as Stripe describes it: 1% of Mastercard transactions and $5,000 in a month.

What we checked in our own articles

We quote Stripe's fees in our invoicing guide and in what a solo business really spends on AI, and we suggest Stripe charges flowing into Wave in AI bookkeeping. None of them claimed anything about holds or reserves, so there was nothing to correct. None of them warned about holds either. The first two now link here.

The rest of the fine print

This belongs to a set of articles on the terms underneath the tools a one-person business runs on:

• who owns what AI tools produce
• whether you can put client data into ChatGPT
• whose job consent is when a notetaker joins a call
• what Canva's license allows for logos and client work
• what the FTC's fake reviews rule means for AI testimonials
• AI accessibility widgets after the FTC's accessiBe order

---

Last reviewed 14 September 2026. Not legal advice; we are not lawyers. Read on the processors' own sites on 10 September 2026, with Stripe's dispute clause and Wave's Terms of Use re-read on 14 September: Stripe's Services Agreement General Terms (18 November 2025), Payments Terms and Financial Services Terms (24 April 2026 and 18 November 2025), its reserves FAQ (undated) and its documentation on high-risk merchant lists (undated); PayPal's User Agreement (PDF, 1 September 2026) and Acceptable Use Policy (29 October 2022); Square's Payment Terms (30 July 2026), General Terms of Service (1 June 2026) and reserves help page; Shopify's Payments Terms of Service for the United States (no date on the page; retrieved 10 September 2026), Terms of Service (1 August 2026) and reserves help page (undated); Wave's US payments terms for Adyen-processed accounts (23 October 2025) and Terms of Use (29 January 2025); Visa's VAMP fact sheet (undated); and the docket of Evans v. PayPal, Inc. on CourtListener. Not read: Mastercard's and Visa's own rules (Mastercard's manual blocked us), the Stripe and PayPal agreements behind Shopify Payments, which terms apply to Wave accounts not processed by Adyen, Square's Commercial Entity Agreement (opened once by our research tool, not re-checked), and the text of the court orders in the PayPal case. No link in this article pays us; see how we make money.