Merchant Onboarding: KYB Checks Before Going Live

Merchant onboarding is how a payment provider vets a business, and the people behind it, before letting it accept payments. It checks the business, its owners, its website, and its bank account, then assigns a risk tier. Done well, it lets low-risk merchants go live quickly while stopping fraudsters, prohibited sellers, and money launderers at the door.

What Merchant Onboarding Is and Who Holds the Risk

First, every business that takes card or digital payments needs a provider to process them. Before that provider lets money flow, it must know who the merchant is and what it sells. That approval process is merchant onboarding, often called Know Your Merchant.

Who onboards	Role	Why they check merchants
Acquiring bank	Holds the merchant relationship with the card networks	Card network rules make it responsible for its merchants
Payment service provider (PSP)	Connects merchants to acquirers and payment methods	It carries fraud and chargeback losses too
Payment facilitator (PayFac)	Onboards many small sub-merchants under one master account	It vouches for every sub-merchant

So liability drives the whole process. When a merchant commits fraud or launders money, the provider that approved it can face chargebacks, fines, and scheme penalties. It is a close cousin of KYB verification, although the payment context adds website and settlement checks.

The Merchant Onboarding Process Step by Step

Onboarding runs as a sequence, and each step narrows the risk before the next. A clear flow also shows merchants what to expect, which reduces back-and-forth.

1. Collect business details. Legal name, registration number, address, and category.
2. Verify the business. Confirm the entity exists and is active in the official register.
3. Identify beneficial owners. Find who ultimately owns or controls the business.
4. Verify the owners. Check each owner’s identity document and match it to a live selfie.
5. Screen and review. Screen the business and owners, then review the website and model.
6. Tier and decide. Assign a risk tier, then approve, decline, or request more.

The Merchant Onboarding Checklist

Most providers check four areas, each guarding against a different kind of fraud.

Area	What to check	Can automate?
The business	Registration, status, address, licenses, and merchant category	Yes, via registry checks
Owners and directors	Every beneficial owner, identity checks, and screening	Yes, via OCR, face match, and screening
Website and products	Live site matching the business, clear terms, refund policy, legal products	Partly, review edge cases
Bank account	Settlement account in the business’s own name	Partly, depends on rails

The owner checks are where fraud hides, so they deserve the strongest controls. Trace owners through holding companies rather than stopping at the company name, since shell companies and nominee structures sit here.

Risk Tiering by Merchant Category

Not every merchant needs the same depth. A local bakery and an online forex broker carry very different risks, so providers tier them.

Tier	Typical merchants	Onboarding approach
Low	Local retail, restaurants, simple services	Automated checks, then fast approval
Medium	E-commerce, subscriptions, travel	Automated checks plus a website and refund policy review
High	Gambling where legal, crypto, adult content, nutraceuticals, forex	Manual review, license checks, and reserves or limits
Prohibited	Illegal goods, unlicensed financial services, sanctioned parties	Decline, then record the reason

The tier then sets both the onboarding bar and the ongoing watch level, so getting it right early saves effort later.

High-Risk and Prohibited Merchants

Still, high-risk does not mean forbidden. It means the merchant needs more evidence and closer watching, often because of high chargeback rates, heavy regulation, or links to fraud.

Card networks also keep lists of merchants that acquirers terminated for serious problems, such as the Mastercard MATCH list. Checking these lists stops a merchant with a bad history from simply moving to a new provider. An internal blacklist does the same job inside your own book, because it blocks owners you already cut off, while a face-based 1:N search catches an owner who returns under a new business name.

Watch, too, for merchants that hide what they really sell. One known scheme, often called transaction laundering, uses a clean front website to process payments for a hidden illegal business. So check whether volumes, prices, and customer locations make sense for the stated products.

Common Merchant Fraud Schemes Onboarding Must Stop

In fact, each check in the process exists because of a known scheme. The table maps the most common ones to the control that catches them.

Scheme	How it works	Control that catches it
Transaction laundering	An approved merchant processes payments for a hidden, often illegal, business	Website review, product checks, and ongoing traffic monitoring
Bust-out merchant	A merchant builds a clean history, then runs a burst of fraudulent sales and disappears	Velocity limits, reserves, and settlement monitoring
Shell or front merchant	A company with no real trade exists only to move money	Registry checks, beneficial owner tracing, and website review
Stolen or synthetic owner identity	Fraudsters apply using someone else’s identity or an invented one	ID check, face match, and liveness on every owner
Repeat offender	A merchant terminated elsewhere reapplies under a new company name	Industry match lists, internal blacklists, and face search across owners

The last row shows why owner-level checks matter so much. After all, companies are cheap to create, so a banned operator can return with a fresh entity, but not with a fresh face.

Onboarding Different Business Models

The checks stay similar. However, the setup changes with the model.

• Direct merchants. The provider onboards each business itself and holds the full relationship.
• Payment facilitators. The PayFac onboards many small sub-merchants quickly, so it relies heavily on automated checks and sets volume caps until each sub-merchant proves itself.
• Marketplaces. The platform onboards sellers, often individuals, so identity checks on people matter as much as business checks.
• Software platforms with embedded payments. The platform’s customers become merchants inside its product, so onboarding must fit into the platform’s own signup flow.

In every model, someone carries the liability. So the party that approves the merchant should run checks it can defend to the acquirer and the card schemes.

What Merchants Should Prepare

On the merchant side, approval comes faster when these items are ready before applying.

1. Company registration documents and tax number.
2. IDs for every owner above the ownership threshold and for directors.
3. A live website or app with clear product descriptions, prices, and contact details.
4. Published terms, a privacy policy, and a refund and delivery policy.
5. A business bank account in the company’s own name.
6. Licenses for regulated products, if any apply.

Missing items cause most delays. For that reason, providers that publish this list up front see fewer stalled applications.

Reducing Drop-Off Without Loosening Controls

Slow onboarding loses merchants to competitors, yet rushed onboarding brings fraud losses later. The answer is to spend effort where the risk is.

1. Automate the basics. Registry, ownership, identity, and screening checks should run in minutes.
2. Approve low-risk merchants straight through. When every check passes, no human review is needed.
3. Route exceptions to analysts. Only mismatches, high-risk categories, and screening hits need a person.
4. Start with limits. Let borderline merchants go live with caps, then raise them as history builds.

Take a PayFac onboarding hundreds of small online shops a week. With automated business, owner, and screening checks, most go live the same day, while the few with a screening hit wait for review. For Indonesian merchants, the Verihubs KYB API looks up a business by name or NIB and returns its licenses, ownership structure, and beneficial owners. Owners then pass face recognition against their ID, and a selfie-to-ID match confirms a real person stands behind the account. For the wider pattern, see how to make digital onboarding more effective.

Monitoring After Go-Live

Onboarding is a snapshot, not the end of the relationship. Merchants change products, owners, and behavior, so keep watching after approval.

• Track chargebacks, refunds, and volumes against what the merchant declared.
• Re-screen owners when sanctions and watchlists update.
• Review the website periodically, especially after sudden volume jumps.
• Re-run business checks when ownership or the business model changes.

Also, bulk search lets a provider re-screen its whole merchant base in one run. Together with the transaction-side controls that payment systems provide, this keeps the risk picture current rather than frozen on approval day.

Frequently Asked Questions

What is merchant onboarding?

Merchant onboarding is the process a payment provider uses to verify and approve a business before it can accept payments. It covers business verification, owner identity checks, screening, website review, and risk tiering.

What documents are mandatory for merchant onboarding?

Providers usually ask for business registration details, licenses where needed, identity documents for beneficial owners and the main signatory, and proof of a settlement account in the business’s name.

What is the difference between merchant onboarding and KYB?

KYB verifies that a business is real and identifies its owners. Merchant onboarding uses KYB as a core step but adds payment checks such as website review, risk tiering, and settlement setup.

What is a high-risk merchant?

A high-risk merchant operates in a category with elevated fraud, chargeback, or regulatory risk, such as gambling, adult content, or some crypto services. These merchants are allowed but need enhanced checks and closer monitoring.

How long does merchant onboarding take?

Low-risk merchants with complete documents can go live within minutes to a day through automated checks. High-risk categories often take several days, because they need manual review and extra documents.

What is transaction laundering?

Transaction laundering happens when an approved merchant processes payments on behalf of another, hidden business, often one selling illegal or prohibited goods.

How can merchant onboarding be faster without more risk?

Automate registry, owner, and screening checks in one flow, approve low-risk merchants straight through, and route only exceptions to analysts. Borderline merchants can start with limits that rise over time.

Merchant Onboarding Lives or Dies on the Owners Behind the Business

Merchant onboarding protects the provider, and its weakest point is the person behind the business. A registration can be real while its owner hides a terminated account or a sanctions hit, so verifying owners is where onboarding earns its keep. When owner identity, screening, and a blacklist work together, a bad actor cannot simply rebrand and return. The question is not whether the business looks legitimate on paper, but whether you truly know who you just approved.

Want to verify the owners behind every merchant before go-live? Book time with Verihubs to run KYB owner verification, face match, and screening in one flow.