By Eric Kuvykin. Substantially revised October 17, 2026. The original publication date and URL are retained.
Identify decisions that depend on one person
A business can accept payments successfully every day while still depending on the owner for every exception. An unexpected absence then exposes missing permissions, undocumented provider contacts and refunds that nobody else knows how to complete. Review that dependency before it becomes urgent.
Choose a normal operating day and list the actions only the owner can perform. Separate actions that genuinely require owner approval from tasks that a trained manager could handle through a controlled role. The goal is continuity with accountability, not unrestricted access.
Create a short authority map
Identify who can approve refunds, investigate missing deposits, contact provider support and request changes to account settings. Record approval limits according to the business’s reviewed policy. Use individual accounts and supported permissions rather than distributing the owner’s password.
Ask the provider how an authorized replacement contact is established. A staff member who knows the business’s details may still lack authority to obtain support or change a setting. Resolve that process while the owner is available to approve the appropriate arrangements.
Prepare the exception file
Keep current provider contacts, merchant references, open issues and essential reports in an accessible, controlled location. Do not put passwords, full card details or unnecessary banking information into a general handoff document. Point to the approved systems that hold sensitive records.
For a Florida location preparing for a temporary closure or severe weather, test access from the approved alternative working arrangement. Confirm who can communicate with staff and customers if the usual premises or email account are unavailable. This planning exercise does not establish that a provider guarantees uninterrupted service.
Practice a realistic absence
Have the manager explain how to handle a refund request, an uncertain payment attempt and a deposit question using the documented procedure. Stop the exercise when it requires borrowing someone else’s credentials or guessing a payment status. Repair that step before calling the process complete.
Use the PCI Security Standards Council’s merchant resources to frame access and operating-policy questions. Confirm the responsibilities for the actual payment environment with the provider and appropriate specialists.
Review the file when staff, banks or providers change. A continuity plan should make routine service possible while preserving a record of who approved important actions. The test is whether a trained replacement can act safely and explain what happened when the owner returns.
References and related reading
Primary resource checked for this review: PCI Security Standards Council’s merchant resources. Confirm the current requirements and implementation with the responsible provider or appropriate adviser.
Continue with Simpler Small-Business Payments: Reduce the Number of Unresolved Handoffs and Payment Cybersecurity: Protect Access, Device Changes and Recovery.
For state and local business resources alongside this operating checklist, use the Florida business operations guide on All State Merchants.
