Processor Holds, Reserves and Closures: What the Contracts Say

"Payment processors can hold your money for 180 days" is repeated so often that it sounds like an industry rule. It comes from one contract: PayPal's.

We read the US merchant agreements of Stripe, PayPal, Square, Shopify Payments and Wave on the processors' own sites on 10 September 2026. PayPal's is the only one that writes down a maximum for how long it can hold your money, and even that has an exception for court orders and legal process. Stripe's says it will release a reserve "only if, and to the extent that, Stripe is satisfied that the relevant risk exposure has been mitigated." Square's, Shopify's and Wave's put no time limit on a reserve.

Every one of the five can hold your payouts, set aside a reserve, and close your account for any reason. None of them promises a date when you get the money back.

The versions we read are listed in the table below, with their dates. This isn't legal advice, and we aren't lawyers. If a processor is holding a large sum of yours now, a lawyer who handles payments disputes is worth more than this article.

The five agreements side by side

Only one agreement has a clock

PayPal sets three periods. Risk-based holds "generally remain in place for up to 21 days from the date the payment was received". A payment challenged as one that should be reversed is held "until the matter is resolved (but no longer than 180 days)". And if PayPal decides you've engaged in restricted activities, it can hold your balance "for up to 180 days if reasonably needed to protect against the risk of liability". Holds based on "a court order, applicable law, regulatory requirement or other legal process" can run "longer than 180 days."

Two further lines in PayPal's agreement matter if you're thinking of leaving:

• You can't close your account while it's under a hold, limitation or reserve.
• If PayPal closes it, you get "unrestricted" funds. Its agreement says it will "make any unrestricted funds … available for withdrawal." Money still under a hold stays where it is.

Stripe writes no period at all. Its Financial Services Terms say it "has sole control over the Reserve", that you are "not entitled to draw funds from any Reserve", and that it releases them when "Stripe is satisfied that the relevant risk exposure has been mitigated." Stripe's Payments Terms let it use its remedies for risks that arise "after these Stripe Payments Terms terminate", so closing the account doesn't start a countdown either. We checked every day count in the Payments Terms. Each is about something else: notice periods, error reports, a data request after termination, a refund rule.

Square may "defer payout or restrict access to your Proceeds, temporarily or indefinitely, if we need to conduct an investigation". Its reserve can be "raised, reduced or removed at any time by Square, in its sole discretion." The only day counts in its Payment Terms are 30 days to report a processing error and 120 days to issue a refund.

Shopify Payments may require "a certain amount (including the full amount) of the funds received for a Transaction" to be "held for a period of time", and Shopify sets that period. After termination, "a Payment Processor may elect to continue to hold any funds deemed necessary". The US terms page carries no date, so there's no way to tell from the page which version you agreed to.

Wave's current US payments terms, processed by Adyen, say that "we or the Acquirer may require a Reserve for any reason, including high chargeback risk or indications of performance problems". Payouts arrive "no more than 30 days after funds settle to the Acquirer, subject to any Reserve imposed".

The processors' help pages describe how they use reserves in practice. None of it is a promise in the contract.

• Stripe: reserves are "fixed and rolling", and Stripe does "another credit review" a few days before one is set to expire.
• Square: its reserves are rolling, and accounts with reserves "will be reviewed after a minimum of six months."
• Shopify: its examples use 120 days.
• PayPal: the example in its agreement is 10% "held for a 90-day rolling period".

You'll also find "90 to 180 days after closure" quoted for Stripe and Square on payment blogs. We didn't find that figure in either company's agreement or help pages.

What sets it off: charging before you deliver

The trigger that appears in almost every agreement and help page is the gap between when you charge and when the customer gets what they paid for.

• Stripe's remedies — delayed payouts, a reserve, suspension — apply if you've "submitted one or more Transactions for goods or services not immediately deliverable to the Customer without first obtaining Stripe's consent". They also apply if there's a material "change in the average time between the initial charge and fulfillment". Its help page adds "an unexplainable sharp increase in processing volume".
• PayPal lists "Your delivery time frames" among the factors for a reserve.
• Shopify names "Businesses with extended billing cycles" and gives "annual subscriptions" as the example.
• Wave's reserve covers "unshipped merchandise and/or unfulfilled services".

That describes a lot of one-person businesses: a consultant who takes a deposit, a coach selling a three-month package upfront, a course that starts in six weeks, an annual retainer paid in January. None of these is prohibited. But Stripe's wording means selling something "not immediately deliverable" without its consent is, on its own, a stated reason for Stripe to act. Stripe's terms name its consent as the way around that, so if that's your model, asking Stripe before you launch is the cheap step.

You owe the chargebacks, and Stripe and Wave can debit your bank for them

The liability runs one way.

• Stripe: you're "liable to Stripe for the full amount of all Disputes … and other related costs, Refunds and Reversals regardless of the reason, timing" of the dispute. If Stripe can't collect, it "may, to the extent Law permits, deduct, recoup or setoff" from your reserve, your balance, "each User Bank Account", and a backup payment method. It can also fund a reserve by "debiting the User Bank Accounts".
• PayPal: "You are responsible for all reversals, chargebacks, claims, fees, fines, penalties and other liability incurred by PayPal".
• Wave: "You are liable for all chargebacks and returns, whether or not the chargeback or return complies with the Operating Regulations." When your Wave balance can't cover what you owe, its terms provide to "debit your bank account for the amount owed".
• Square: caps its own liability to you at "THE GREATER OF (A) THE AMOUNT OF FEES EARNED BY US … DURING THE THREE (3) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT … OR (B) $500."

Because Stripe can debit the bank account you link, which account that is makes a difference. A separate business account used only for payouts means a debit can't reach the money you pay rent from. That's our suggestion, not something any processor says.

The list that outlasts your account

The tail risk isn't a fine from Visa. Visa's monitoring program identifies an individual US merchant as excessive at 150 basis points and at least 1,500 fraud and dispute reports in a month. Hardly any one-person business sees 1,500 disputes a month.

The one to know about is Mastercard's MATCH list, a database of merchants whose processors closed their accounts. We couldn't open Mastercard's own rules manual, which blocked our requests, so this comes from Stripe's documentation of those rules:

• A merchant qualifies for the excessive chargebacks code when "monthly Mastercard chargebacks exceed 1% of total monthly Mastercard sales transactions and total 5,000 USD or more", with both "met in the same month".
• "Mastercard doesn't require a minimum count of individual chargebacks", and "Winning or reversing the chargebacks later doesn't alter this status."
• "closing a processing account doesn't prevent a listing."
• "Listings remain active for 5 years", and only the bank that listed you can remove it.
• "A MATCH listing generally disqualifies a merchant from processing with Stripe."

Visa's equivalent, VMSS, also keeps listings for five years, and "Visa doesn't allow merchants to appeal listings directly".

Here's the arithmetic on those thresholds. Suppose you sell 100 packages at $1,000 to Mastercard holders in a month and 6 are charged back. That's 6% of transactions and $6,000, so both tests are met. For a high-ticket, low-volume business, one bad month followed by an account closure is the scenario that matters.

The decision with a 30-day deadline

If a hold goes wrong, what you can do about it depends on the arbitration clause. Two of the five give you a one-time chance to opt out, and it expires 30 days in.

• PayPal: "If you are a new PayPal customer, you can choose to reject this Agreement to Arbitrate by mailing us a written opt-out notice", postmarked "no later than 30 days after the date you accept this user agreement for the first time." It calls mail "the only way you can opt out".
• Square: by written notice "within thirty (30) days after you first create a Square Account, or for existing customers who agree to this as a terms update, within thirty (30) days after first becoming subject to this arbitration agreement."
• Stripe: its US terms send disputes to arbitration under the AAA's commercial rules in San Francisco, with a class waiver and no opt-out. They add: "If this waiver of class or consolidated actions is deemed invalid or unenforceable, neither party is entitled to arbitration."
• Wave: arbitration, and no US opt-out in the Terms of Use it links.
• Shopify: its Terms of Service contain no arbitration clause and send US merchants' disputes to the courts of Ontario, Canada.

These clauses get enforced. In 2022, a class action against PayPal over held funds was sent to arbitration by a federal court in California. The appeals court affirmed that in September 2023 (N.D. Cal. No. 5:22-cv-00248).

Whether to opt out is your call, and a lawyer's. The point is that it's a decision you make when you open the account or accept new terms, not after a freeze.

What to do before anything goes wrong

• Save a dated copy of your processor's agreement. Shopify's US payments terms carry no date, and every processor here can change its terms.
• If you charge before you deliver, raise it with the processor first. Stripe's terms make its consent the difference between an ordinary sale and a stated trigger.
• Warn the processor before a launch or a large one-off invoice, since a sharp jump in volume is a named trigger. For a big invoice, ACH or wire keeps it off the card rail. Our invoicing article covers what each rail costs.
• Link a payouts-only bank account, for the reason above.
• Upload tracking where you ship. PayPal says it may release a hold earlier if you've "uploaded shipment tracking information", though earlier release "is at our sole discretion".
• Answer information requests quickly, and appeal where you're offered it. PayPal asks you to use its Resolution Center or the instructions in its notice. Stripe shows an appeal option on the Balances page only when a reserve can be appealed.
• Decide on arbitration within 30 days if you're with PayPal or Square.
• Keep chargebacks below both halves of the MATCH test: 1% of Mastercard transactions and $5,000 in a month.

What we checked in our own articles

We quote Stripe's fees in our invoicing guide and in what a solo business really spends on AI, and we suggest Stripe charges flowing into Wave in AI bookkeeping. None of them claimed anything about holds or reserves, so there was nothing to correct. None of them warned about holds either. The first two now link here.

[ADD YOUR OWN EXAMPLE HERE — a hold, reserve or closure you've had with a processor, how long it lasted, and what got the money released.]

The rest of the fine print

This belongs to a set of articles on the terms underneath the tools a one-person business runs on:

• who owns what AI tools produce
• whether you can put client data into ChatGPT
• whose job consent is when a notetaker joins a call
• what Canva's license allows for logos and client work
• what the FTC's fake reviews rule means for AI testimonials
• AI accessibility widgets after the FTC's accessiBe order

---

Last reviewed 10 September 2026. Not legal advice; we are not lawyers. Read on the processors' own sites on 10 September 2026: Stripe's Services Agreement General Terms (18 November 2025), Payments Terms and Financial Services Terms (24 April 2026 and 18 November 2025), its reserves FAQ and its documentation on high-risk merchant lists; PayPal's User Agreement (PDF, 1 September 2026) and Acceptable Use Policy (29 October 2022); Square's Payment Terms (30 July 2026), General Terms of Service (1 June 2026) and reserves help page; Shopify's Payments Terms of Service for the United States (undated), Terms of Service (1 August 2026) and reserves help page; Wave's US payments terms for Adyen-processed accounts (23 October 2025) and Terms of Use (25 January 2024); Visa's VAMP fact sheet; and the docket of the 2022 PayPal class action on CourtListener. Not read: Mastercard's rules manual (blocked), which terms apply to Wave accounts not processed by Adyen, Square's Commercial Entity Agreement, and the text of the court orders in the PayPal case. This article contains no affiliate links.