Merchant Onboarding Workflow

A merchant onboarding workflow is the process an acquiring bank, payment facilitator or payment service provider uses to accept a new business as a customer for card and other payment processing. It runs from the merchant's application through identity and business checks, risk assessment and contract, to the technical set-up of a merchant account and the start of ongoing monitoring. A well-designed workflow lets low-risk merchants start trading quickly while catching fraudulent or unsuitable applicants before they process payments. The overall process is called merchant onboarding.

Onboarding sits at the meeting point of sales, compliance and risk. It must satisfy anti-money laundering rules, card network rules and the provider's own risk appetite. The checks on the business itself are often called know your business, and the assessment of the merchant's financial and fraud risk is called underwriting. The outcome feeds the provider's merchant risk classification.

Think of a landlord renting out a shop. Before handing over the keys, the landlord checks who the tenant is, what they plan to sell, whether they can pay the rent and whether they have been evicted elsewhere. A small florist gets a quick check; a business selling fireworks gets a much closer look and may have to pay a bigger deposit.

A payment provider does the same before letting a business take card payments, because if the business cheats customers or disappears, the provider can end up paying the refunds.

1. Application. The merchant provides company details, owners, bank account, website, products, expected volumes and average transaction size, often through digital onboarding.
2. Identity and business verification. The provider verifies the company's registration, directors and ultimate beneficial owners, and screens them against sanctions lists, politically exposed person lists and adverse media.
3. Network database checks. The provider checks whether the merchant or its owners appear on terminated-merchant databases such as Mastercard's MATCH list.
4. Business review. Analysts review the website, refund and delivery policies and the goods or services offered, and assign the correct merchant category code.
5. Underwriting. The provider estimates exposure from refunds, chargebacks and future delivery, reviewing financial statements and processing history for larger or riskier merchants.
6. Decision and terms. The application is approved, declined, or approved with conditions such as processing limits, a rolling reserve or delayed settlement.
7. Set-up. The merchant signs the agreement, receives a merchant identification number and connects its terminals or online checkout.

Providers measure the workflow as well as its outcomes. Common metrics include the share of applications approved automatically without manual review, the average time from application to first transaction, the share of applicants who abandon the process, and the losses later incurred on merchants that were approved. A workflow that is too strict loses good customers to faster competitors; one that is too loose shows up months later as fraud and chargeback losses. Many providers therefore route applications by risk, sending simple, low-value merchants through an automated path and complex or high-risk ones to specialist underwriters.

In many jurisdictions acquirers are subject to anti-money laundering rules that require customer due diligence on merchants, including identifying beneficial owners; in the United States, FinCEN's customer due diligence rule sets a 25 per cent ownership threshold for identifying beneficial owners of legal entity customers. Card networks require acquirers to verify that merchants are legitimate, to register certain high-risk merchant types, and to keep records of their due diligence. Networks hold the acquirer responsible for its merchants, including those signed through agents, so the acquirer's workflow must cover partners such as independent sales organisations.

A payment facilitator onboards sub-merchants under its own master merchant account, which allows much faster sign-up, often within minutes, for small businesses. To make this possible, network rules allow lighter initial checks for small sub-merchants, with fuller review once processing volume grows past set thresholds. Many payfacs approve accounts instantly using automated data checks and then hold payouts until further verification is complete, shifting some of the risk review to after the first transactions.

Onboarding does not end at approval. Providers monitor transaction patterns, chargeback and refund ratios, and website changes, and periodically refresh KYB information. A sudden spike in volume, a change in products or a jump in disputes can trigger a review. Common failures include accepting merchants that misdescribe their business to obtain a lower-risk code, missing hidden owners behind nominee directors, and allowing "transaction laundering", where an approved merchant processes payments for an undisclosed business. Weak onboarding has been at the heart of several enforcement cases against acquirers and payment processors, which is why many providers now combine automated checks with human review for higher-risk applications. Fraud prevention teams often work alongside onboarding to share signals across the merchant portfolio.