You woke up, checked the Shopify admin out of habit, and the payout line said On hold. No email. No phone call. Just a number sitting in a column where cash used to be, and a supplier invoice due Friday.
What’s in This Article
Most Aussie founders treat this as a customer service problem. They open a chat, explain the situation politely, and wait. That is the wrong move, and it is why holds that should take four days stretch into four weeks. One merchant on the Shopify community forums reported roughly USD 55,000 in pending payouts frozen until September 2026, with front-line chat agents unable to release a cent of it.
Brands that survive a payout freeze do something different. They treat processor risk the same way they treat inventory risk: something you plan for before it happens, not something you argue about after. The freeze still lands. It just stops being an extinction event, because there is a second gateway already live, an evidence pack already built, and enough cash sitting outside the processor to cover payroll while the review runs.
This is the 5-layer system. Work through it once and you will never be the founder writing a desperate forum post at 2am.
Layer 1: Know the Three Ways Your Money Actually Gets Held
Founders use “frozen” to describe three completely different events. They have different causes, different timelines, and different fixes. Getting the diagnosis wrong costs you weeks.
- The review hold. Every Shopify Payments account gets periodic reviews across its lifespan. Payouts pause while the risk team checks ownership details, business address, tax registration or ID verification against what is on file. This is usually a document problem, not a behaviour problem, and it is the fastest one to clear.
- The rolling reserve. The processor keeps paying you, but withholds a slice of every sale. Industry standard sits between 5 and 15 per cent held for 30 to 180 days. Shopify has applied reserves as high as 20 per cent for up to 120 days on accounts it classifies as high risk. Your revenue looks fine. Your bank balance quietly does not.
- The suspension. The account is switched off entirely and the balance is held through the chargeback window, commonly 90 to 120 days. This is the one that kills stores, because you lose the cash and the ability to trade at the same moment.
Baseline matters here. In Australia, the minimum settlement time on Shopify Payments is two business days, and new accounts start longer and shorten as fulfilment history builds. Your bank then adds one to three business days on top. So a payout that lands five business days after the sale is normal. A payout that has not moved in eight is a signal.
Do this today: open Settings, Payments, View payouts and write down your actual average gap between order date and money-in-bank date over the last 30 days. That number is your baseline. You cannot spot an anomaly without one.
Layer 2: Watch the Four Ratios That Trigger a Review
Processors are not making emotional decisions about your brand. They are watching a small set of numbers against card scheme thresholds, and those thresholds got tighter in 2026.
Visa retired the old VDMP and VFMP programs and replaced them with VAMP, which combines fraud reports and disputes into a single ratio against settled transactions. The merchant threshold dropped from 2.2 per cent to 1.5 per cent on 1 April 2026. Mastercard’s Excessive Chargeback Merchant tier triggers at 100 chargebacks and a 1.5 per cent ratio in a single month. Shopify’s own internal trigger point is stricter again, with merchants reporting high-risk classification once the chargeback-to-transaction ratio approaches 1 per cent.
Track these four every Monday. It takes six minutes.
- Chargeback ratio. Chargebacks this month divided by transactions this month. Green under 0.5 per cent. Amber 0.5 to 0.9 per cent. Red at 1 per cent and above. Note the denominator: scheme programs count the current month’s disputes against the current month’s transactions, so a sales dip during a dispute wave doubles your ratio without a single extra chargeback.
- Refund rate. Refunds as a share of gross sales. A refund rate climbing past 10 per cent reads as a fulfilment or product-quality problem long before disputes appear.
- Fulfilment lag. Median hours between order paid and tracking number issued. Anything drifting past 72 hours is the single strongest early predictor of a dispute wave, because “item not received” is the most common claim reason.
- Volume velocity. This month’s processed volume against your trailing three-month average. A sudden three-times spike, which is exactly what a good BFCM or a viral TikTok looks like, is treated by risk models the same way it treats fraud.
That last one catches good operators off guard constantly. Growth itself is a risk flag. If you are about to run a campaign that will triple your daily volume, tell your processor before it happens rather than explaining it after.
The Australian backdrop is worth knowing, because it explains why the screws keep tightening. AusPayNet reported card fraud on Australian-issued cards rose 20 per cent to AUD 913 million in 2024, with card-not-present fraud up 19 per cent to AUD 816 million. The FY25 figures improved slightly, with the overall fraud rate falling from 77.6 cents to 71.8 cents per AUD 1,000 spent, but domestic card-not-present losses still ran at AUD 312 million. Every processor operating here is pricing that risk into how quickly they hold your money.
If disputes are your weak spot, the deeper mechanics live in the Shopify chargeback defence playbook. Layer 2 here is about surveillance. That article is about the fix.
Layer 3: Build the Evidence Pack Before Anyone Asks For It
When a review lands, the risk team sends a generic request and gives you a short window to respond. Founders lose days hunting for documents that should have taken thirty seconds to attach. Every day of hunting is a day your cash sits still.
Create a folder called Processor Evidence Pack. Put these in it now, and set a calendar reminder to refresh it every quarter.
- Entity documents. ASIC company extract, ABN registration, GST registration confirmation. The registered address on these must match the address in your Shopify Payments settings character for character. Mismatched addresses are one of the most common review triggers and one of the dumbest ways to lose two weeks.
- Director identification. Photo ID and proof of address for every listed director, current and unexpired.
- Bank verification. A bank statement header showing account name, BSB and account number, in the same legal entity name as the store.
- Supplier proof. Recent purchase orders or invoices showing you actually buy the stock you sell. This is what separates a real brand from a dropship shell in the reviewer’s eyes.
- Fulfilment proof. A CSV export of the last 90 days of orders with tracking numbers and delivery scan dates. Australia Post and Sendle both export this in a few clicks.
- Policy pages. Current screenshots of your shipping, returns and refunds pages, with the delivery windows you actually hit. Promising three-day delivery you cannot meet is a self-inflicted dispute machine.
- Dispute history. A one-page summary of every chargeback in the last six months: reason code, amount, outcome, and what you changed as a result.
That last document is the one nobody builds and the one that changes outcomes. Risk teams are assessing future loss, not past behaviour. A merchant who can show that “item not received” disputes fell from eleven to two after moving to a 3PL with same-day dispatch is a different risk profile to a merchant who just says the problem is fixed.
Layer 4: Run a Second Gateway That Is Already Live
This is the layer that turns a catastrophe into an inconvenience, and it is the one almost nobody does until after they have been burned.
A backup gateway you sign up for during a suspension is useless. New merchant accounts take days to underwrite, and an application submitted while your primary processor has just terminated you is an application that gets declined. The backup has to be approved, integrated and processing real transactions before the freeze.
Look at any large Aussie DTC checkout: Koala, Bondi Sands, Culture Kings. You will find card, PayPal, Afterpay and Zip sitting side by side. That is not just a conversion play, although it is that too. It is redundancy. If one rail stops, the others keep taking money.
Setting up an Airwallex backup gateway on Shopify
Airwallex was founded in Melbourne and now handles local payment methods across more than 130 countries, which makes it a sensible second rail for Aussie brands selling offshore. Setup runs roughly like this.
- Open an Airwallex business account and complete verification with the same ASIC entity details you use on Shopify Payments. Allow three to five business days.
- In the Airwallex dashboard, go to Payments, then Online payments, and request activation of the card acquiring product for your business category.
- Install the Airwallex app from the Shopify App Store and connect it to your account.
- In Shopify, go to Settings, Payments, Additional payment methods and add Airwallex. Leave it configured but not set as primary.
- Run five real test transactions through it using your own card, then refund them. You need proof it works and proof the refund path works.
- Document the exact switch-over steps in a one-page runbook. During a freeze you will be stressed and you will not want to be reading documentation.
If your business is domestic-only and you also trade in person, Zeller is the other obvious option. It is Australian-built, used by more than 100,000 businesses here, and its transaction account gives you a settlement destination that sits outside the processor holding your money. Same principle: get approved and tested while things are calm.
One warning. Do not split volume 50-50 across two gateways to “spread risk”. Thin volume on each account means neither builds the processing history that earns you faster settlement, and both look unstable. Run 90 to 95 per cent through the primary, keep a genuine 5 to 10 per cent flowing through the backup so the account stays warm and underwritten.
Layer 5: Hold a Freeze Float
A gateway keeps you trading. It does not give you back the money already sitting in the held balance. That is what the float is for.
The maths is simple and most founders have never done it. Take your average daily processed volume. Multiply by your typical settlement gap in days. That number is your in-transit exposure: the amount of your money that lives inside the processor at any given moment.
A store doing 15,000 AUD a day with a five-day settlement gap has 75,000 AUD in transit. If that store also carries a 10 per cent rolling reserve on a 90-day release, add another 135,000 AUD of deferred cash. Suddenly a business that feels comfortable is running with more than 200,000 AUD it cannot touch.
Your freeze float target is the cash you need to cover fixed commitments for the length of a realistic hold. Merchants are currently reporting holds running three weeks to six weeks, so plan for 30 days minimum. Fixed commitments means rent, wages, superannuation, BAS instalments, software subscriptions and any supplier deposit already promised.
- Keep it in a separate account. Not the trading account. Money in the trading account gets spent on ad tests.
- Fund it from a fixed percentage. Two to three per cent of revenue swept weekly builds a 30-day float faster than most founders expect.
- Do not count an overdraft or a card as the float. Credit facilities are frequently reviewed at exactly the same moment a processor gets nervous.
- Rebuild it after use. Treat it like an insurance excess, not a slush fund.
If you have never modelled cash properly, pair this with the 8-week rolling forecast. The float sizing falls out of that model in about twenty minutes.
The First 72 Hours: What To Do When the Hold Lands
The layers above are prevention. This is the response. Speed and format matter more than tone.
- Hour 0 to 2. Diagnose the type. Check the notification wording and your payout schedule page. Review hold, reserve, or suspension? Do not send a single message until you know which one you are dealing with.
- Hour 2 to 4. Switch the rail. Activate the backup gateway as primary in Shopify. Confirm a live order processes end to end. Revenue keeps arriving while everything else is negotiated.
- Hour 4 to 8. Send the pack, unprompted. Reply to the risk notice with the full evidence pack attached in one message, clearly labelled. Do not send documents in a trickle across five emails. One complete submission gets one review cycle. Five partial ones get five.
- Day 1. Write the one-page narrative. Explain what changed in the business, why the metric moved, what you have already fixed, and what the numbers look like now. If a viral post tripled volume, say so and attach the analytics screenshot.
- Day 2. Protect the downstream. Call your key suppliers and your 3PL before you miss a payment, not after. A supplier told in advance almost always grants terms. A supplier told late starts asking for prepayment.
- Day 3. Fix the trigger. Pause the campaign, tighten the fraud filters, shorten the dispatch window, whatever the driver was. Reviewers check whether the underlying behaviour continued during the review. It is the single strongest signal available to them.
Escalate through email and the risk portal, not live chat. Front-line chat cannot release holds and the transcript rarely reaches the team that can.
The Payout Freeze Readiness Checklist
Print this. Score yourself honestly. Anything unticked is exposure.
- I know my average order-to-bank gap in days, measured not guessed.
- I check chargeback ratio, refund rate, fulfilment lag and volume velocity every Monday.
- My chargeback ratio has stayed under 0.9 per cent for three consecutive months.
- My Shopify Payments legal entity, address and bank details match my ASIC record exactly.
- My evidence pack exists, is complete, and was refreshed in the last 90 days.
- A second gateway is approved, integrated and processing at least 5 per cent of volume.
- I have tested a full switch-over, including a refund, in the last six months.
- I hold 30 days of fixed costs in a separate account, outside any processor.
- I have calculated my in-transit exposure and I know the number.
- My key suppliers know who to call and I know their terms flexibility before I need it.
Eight or more ticks and a freeze is a bad week. Four or fewer and a freeze is a business-ending event.
Why These Five Layers Compound
Run any one of these layers alone and you get a partial answer. Run them together and something more useful happens.
The ratio surveillance in Layer 2 means you catch a rising dispute rate at 0.6 per cent instead of finding out at 1.4 per cent. That extra runway is what lets you fix the fulfilment lag before a reviewer ever looks at your account, which means Layer 3 gets used less often. When it is used, a complete pack turns a fourteen-day review into a four-day one.
The second gateway from Layer 4 changes the negotiation entirely. A founder who cannot trade is desperate and takes whatever terms are offered. A founder still processing orders can wait out a review, decline an unreasonable reserve, and move volume permanently if the relationship is not worth keeping. The float in Layer 5 buys the same thing with cash instead of infrastructure.
Together they convert your processor from a single point of failure into one supplier among several. That is the actual goal here. Not avoiding holds forever, because periodic reviews are part of the deal and every growing brand eventually gets one. The goal is making sure the answer to “what happens if this money stops for a month” is a shrug rather than a panic.
Most Aussie founders build this after the freeze. The ones who build it before never find out how close they came. Worth pairing with the disaster recovery and continuity playbook, because payment rails are rarely the only single point of failure in a store.
Inside eCommerce Circle, processor risk is one of the core pillars we work on with every member. If you want a second opinion on yours, let’s talk.
