I'm unsure of the specifics of your business, but we (Braintree) posted above about risk assessment generally. http://news.ycombinator.com/item?id=1494102