Merchant onboarding and KYB review for payments platforms

Sweat AI is an AI-native BPO for banks and fintechs. For payments companies, we start with merchant onboarding and fraud reviews. We review merchant and sub-merchant applications for payment facilitators, ISOs, acquirers and platforms 24/7, and hand each one back with the evidence, a recommendation and one list of what is still needed. You decide who boards.

Why merchant onboarding is its own kind of KYB

Business verification in payments has one question that plain KYB does not: what will this merchant actually sell through the account? A company can be real, correctly registered and owned by the people it names, and still be the wrong merchant for your portfolio. The risk sits in the business model, the goods and services, the website and the fit between what the merchant says and the code it will process under.

Card network rules make the chain of accountability explicit. Visa's Payment Facilitator and Marketplace Risk Guide says "the acquirer is responsible for the conduct of its sponsored payment facilitators and marketplaces", and that acquirers must perform due diligence and ongoing monitoring of them. When a PayFac or marketplace uses a third party to screen seller websites, "the accountability for compliance remains with the payment facilitator, marketplace, and acquirer" (Visa, April 2021). The Visa Rules themselves govern and change over time; check the current version with your acquirer.

That is the right model for working with us too. We do the review. The accountability stays with you and your sponsor.

What we review on a merchant application

The business and its owners

• The legal entity, its registration, status and formation date, against the application.
• Beneficial owners and control persons, traced through holding companies. US covered institutions apply the CDD rule's 25 percent ownership and single-control-person tests (31 CFR 1010.230); your sponsor's program may set its own thresholds, and we follow those.
• Screening of the business, owners and principals, with potential matches worked to a resolution.
• Principals connected to other businesses in the public record, where that is relevant to your policy.

The business model and MCC fit

• What the merchant sells, how it delivers it, who it sells to and how it takes payment, from the website, filings and public footprint.
• Whether the requested merchant category code describes the majority of the business. Visa's guide notes that marketplaces selling in a single line of business should be assigned the MCC that best describes the majority of their business, and that miscoding gambling transactions violates the Visa Rules.
• Whether the business falls into a category your program restricts or prohibits. Visa's guide, for example, says payment facilitators are prohibited from signing sponsored merchants in certain high-brand risk MCCs and points to the Visa Rules for details.
• Expected volume, average ticket and refund or chargeback exposure against what the business model suggests.

The website

• Whether the website exists, works and sells what the application says.
• Products or services that do not match the stated business or requested MCC.
• Signs of transaction laundering, which Visa describes as occurring "when an illicit business surreptitiously uses payment services through a front organization posing as a legitimate merchant." In practice that means looking for storefronts with no real inventory, checkout flows that lead somewhere else, and businesses whose web presence does not support the volumes claimed. See the transaction laundering glossary entry.
• Required policies and disclosures, such as refund terms, contact details and terms of service, where your program asks for them.

Documents

• Bank statements, processing history, formation documents and licenses checked for entity match, dates and consistency with each other and the application.
• Each document's limits recorded: a prior processing statement shows past volume with another provider; it does not show why that relationship ended.

What you get back

For each merchant: an evidence packet with each finding tied to its source excerpt and capture time, a recommended disposition (board, board with conditions such as limits or reserves for your decision, request documents, escalate or decline), and one consolidated list of what the merchant still needs to provide. The format is shown in the illustrative sample KYB review.

Where the queue backs up, and how we fit

Payments onboarding queues grow in predictable places:

• Platform launches and partner referrals, which bring a wave of sub-merchants at once.
• Evenings and weekends, when merchants sign up and expect to take payments the next morning. We work 24/7 so the queue is done when your team logs in; see 24/7 onboarding review.
• Merchants already processing under a provisional approval, where findings on a live account need action now. Those go to your escalation contact immediately.
• Exceptions from your automated flow: name mismatches, holding-company owners, websites that do not load, MCCs that do not fit.

After onboarding, the same team can work fraud and monitoring alerts on your merchant portfolio; see fraud and alert review.

What stays with you

Boarding decisions, MCC assignment, limits and reserves, network registrations, termination and any reporting to networks or regulators are your decisions, taken with your sponsor. We recommend; you decide.

Compared with the alternatives

If you are weighing an in-house underwriting team, an offshore BPO or more automation, the table on our KYB review page lays out the trade-offs, and Sweat AI vs an offshore KYC BPO goes further.

Talk to us about your merchant queue

Tell us how merchants reach you, where they stall and what your sponsor expects. We will show you how we would work your next batch and what your underwriters would receive.