Best practices for merchant onboarding

As societies around the world increasingly move away from cash toward digital and card-based payments, payment service providers (PSPs) play a critical role in facilitating transactions across their networks. 

A key part of PSPs’ job is maintaining a healthy and safe payments ecosystem with as little fraud or financial crime as possible. While this is achieved in many ways, a robust merchant onboarding process is necessary for all payment service providers. 

Below, we take a closer look at what merchant onboarding is, why it’s so important, and who’s typically involved in the process. We also walk through the key steps and offer a few best practices as you consider the role that merchant onboarding plays in your payments business.  

What is merchant onboarding?

Merchant onboarding is a set of processes that a payment service provider undertakes to vet merchants that want access to its payment network. The goal of merchant onboarding is to verify that a business is legitimate and has the legal right to accept and manage payments via the network. 

It’s important to note that merchant onboarding is not the same as seller onboarding or seller verification. While they sound similar, seller verification is a process that online marketplaces undertake to comply with Know Your Seller (KYS) regulations (like the INFORM Consumers Act) and reduce the risk of fraudulent products making it onto their platforms. 

What businesses are involved in merchant onboarding?

Although we’ve talked almost exclusively about payment service providers and merchants so far, the truth is that merchant onboarding processes can touch a number of other types of businesses. Here’s a quick look at all of the key players:

• Merchants: When a merchant wants to accept and manage payments via a particular payment service provider, they must complete that PSP’s merchant onboarding process.
• Payment service providers: PSPs offer a variety of payment processing services to merchants, typically facilitating the authorization, clearance, and settlement of transactions. PSPs perform merchant onboarding to assess the potential risks of doing business with a given merchant. 
• Payment gateways: Payment gateways securely move sensitive financial data between a merchant’s internal payment systems (like their mobile app or point of sale system) and the PSP. 
• Acquiring banks: These banks partner with PSPs to help process and settle a merchant’s transactions. They’re also called merchant acquirers. 
• Issuing bank: This is the bank that issued a person’s payment card (credit, debit, etc.) used in a transaction. It authorizes transactions, determines whether a customer has the funds to cover a purchase, and transfers customer funds to the acquiring bank. 
• Card networks: Card networks maintain the networks that handle and process card-based transactions, facilitating communication between acquiring and issuing banks. 
• Regulatory bodies: Various regulatory bodies oversee payment processing. For example, the Payment Card Industry Security Standards Council (PCI SSC) is a key regulator in the US. 

What information is collected during merchant onboarding?

At its heart, merchant onboarding is all about helping PSPs manage various types of risk, including:

• Money laundering risk: In many jurisdictions, payment service providers are required to comply with Anti-Money Laundering laws and regulations to prevent criminals from laundering money using their networks. Merchant onboarding empowers PSPs to collect the information necessary to comply with these laws. 
• Fraud risk: Merchant onboarding isn’t just about preventing money laundering. It also helps PSPs evaluate merchants for other types of fraud risk. Through merchant onboarding, for example, a payment service provider might discover that a particular merchant authorizes an abnormally high number of fraudulent transactions, which would ultimately result in a chargeback and loss for the PSP. 
• Reputational risk: A PSP that is found to have facilitated money laundering, financing of terrorism, or other crimes may face significant reputational harm, making it difficult to attract new customers. Merchant onboarding can help mitigate this risk.

In order to assess how much risk a merchant might pose, PSPs need to collect various pieces of information and documentation. 

At a minimum, most PSPs design their merchant onboarding processes to comply with Anti-Money Laundering and Know Your Business (KYB) laws and regulations. Then, they often layer in additional requirements to account for their own risk tolerance. This often includes:

• Business registration documents, like a business’s certificates of formation or articles of incorporation, to help establish its legitimacy
• Tax identification numbers, like an employer identification number (EIN), to perform various types of verification
• Ownership information, including ownership structure and a list of ultimate beneficial owners (UBOs), to comply with KYB requirements
• Identity information for all UBOs and key stakeholders, to facilitate identity verification
• Financial statements such as income statements, cash flow statements, and balance sheets to assess the merchant’s financial health
• Bank account information, including the merchant’s account numbers, routing numbers, and the bank’s name and address
• Business licenses, permits, and certifications that prove the business is allowed to operate in its given industry
• Payment processing history that can offer insight into transaction volume, chargeback rates, and other metrics to help gauge the risk of fraud
• Business plan and revenue projections to show how the company intends to make money and its projected transaction volumes

As with many processes related to AML, merchant onboarding often follows a risk-based approach. This means that when a merchant is deemed riskier — for example, it operates in an industry considered a high risk for money laundering — it’s common for a PSP to conduct enhanced due diligence, which may involve asking the merchant for additional information or documentation. 

Key steps in merchant onboarding

While each PSP is free to design the merchant onboarding process that works for its business, onboarding often includes the following steps:

1. Prescreening

During prescreening, the PSP establishes a relationship with the merchant seeking its services. In addition to initial communications, the PSP collects the information and documentation needed to conduct the verifications and assessments below. Ideally, prescreening will allow the PSP to quickly rule out businesses that it obviously should not be doing business with, such as scammers, fraudsters, and businesses that do not actually exist.  

2. Know Your Business (KYB) verification

During KYB verification, a payment service provider typically seeks to answer three key questions:

• Is the merchant a real, legal business that actually exists? Answering this question typically involves collecting the merchant’s business registration documents, tax identification number, and any relevant licenses, permits, or certificates. Other methods may involve database verification or looking up the business’s Secretary of State (SOS) filing. 
• Who owns and makes decisions for the merchant? This requires information about the merchant’s business ownership structure, including all ultimate beneficial owners. 
• Are the merchant’s owners and stakeholders involved in wrongdoing, such as money laundering or financial terrorism? To determine this, the PSP must perform due diligence on each UBO, including identity verification (IDV). 

3. Merchant financial history check

Another way PSPs evaluate merchants is by conducting a financial history check. During this step, the PSP typically:

• Conducts credit checks on the business as well as all UBOs and key stakeholders
• Reviews the merchant’s payment processing history to get a sense of its typical transaction volumes and chargeback rates — and determine whether they are appropriate or suspicious 
• Analyzes the merchant’s financial statements to determine whether the business is on solid footing or at risk of failure — and to identify potential liabilities

4. Risk assessment

Once the payment service provider has established that a merchant is legitimate, the focus shifts toward broader risk assessment, which can include:

• Analyzing the merchant’s business plan to understand how it makes money, including the industry it operates in, the jurisdictions it serves, and the products or services it sells
• Analyzing the merchant’s operational model to determine what internal processes (security policies, third-party audits, etc.) the merchant has in place to prevent financial fraud like money laundering and embezzlement
• Conducting a variety of other checks and screenings — like adverse media screenings, PEP checks, watchlist and sanctions screenings, and more — to develop a fuller risk profile of the merchant’s business

5. Ongoing monitoring

Just because a merchant has been deemed safe to do business with now doesn’t mean  will remain that way. Payment service providers should continually monitor merchants to keep their risk profile up to date and ensure no new risks have been introduced to the business relationship. 

At a minimum, this should include monitoring transactions for signs of suspicious activity — as well as unusual spikes in chargebacks. Other options include periodically scanning merchants and their owners against watchlists, sanctions lists, PEP databases, etc. to quickly identify changes.   

‍

Best practices for merchant onboarding

Are you currently in the middle of establishing or rethinking your merchant onboarding processes? Keep the following best practices in mind:

Leverage multiple types of verification

When designing your KYB and KYC processes, it’s usually a good idea to leverage multiple types of verification — for example, a combination of document verification, database verification, and government ID verification. This will surface more risk signals to help you determine whether you should do business with a merchant. You should even verify data points about the business, like its financial history,  line of business, and online presence to get a full sense of the business. 

Deploy automation where it makes sense

Most PSPs benefit by leveraging strategic automation throughout their merchant onboarding processes. That’s because it’s incredibly difficult to manually perform all of the steps discussed above at scale. Consider where it might be most valuable to automate a process or step — and where a human touch might still make sense. In all likelihood, a large portion of your KYB/KYC, risk assessment, and ongoing monitoring processes can be automated at least partially. 

Involve other teams

Your merchant onboarding process should not be designed in a silo. Base your decisions around conversations with your organization’s key stakeholders, such as members from product, marketing, trust and safety, legal, and compliance, to ensure you’re not overlooking important perspectives. 

How Persona can help

When designing their merchant onboarding processes, many payment service providers find themselves in the unenviable position of trying to cobble together multiple solutions from different providers. This can be challenging, complicated, and costly. 

The good news? With Persona, you get much of the functionality you need within a single platform. Use Persona to:

• Collect merchant information and documentation during prescreening
• Conduct KYB verification on merchants via document verification and Secretary of State checks
• Complete KYC verification on all UBOs using a variety of verification methods, including government ID verification, database verification, and selfie verification
• Assess merchant risk via a variety of reports, such as adverse media reports, sanctions checks, watchlist checks, and PEP checks

Best of all, you can automate as much or as little of the process as makes sense for your business while leveraging additional features — like our link analysis tool, Graph — to better understand the risk of fraud each new merchant might pose.  

Ready to learn more about how Persona can help you get merchant onboarding right? Request a demo today to get started!