Who holds liability when it come to merchant processing?