Merchant Underwriting and Onboarding: Frequently Asked Questions

Merchant underwriting and onboarding is the process by which payment service providers vet and verify a business before allowing it to process payments on their network. It’s important because it protects the payments ecosystem from fraud, money laundering, and other types of bad actors. A strong onboarding process ensures a merchant is legitimate, financially stable, and compliant with all regulations before you start processing transactions for them. In short, it’s the gateway to maintaining a safe and profitable merchant portfolio.

Merchant underwriting looks at several risk areas: financial risk (will the merchant stay solvent and cover chargebacks?), fraud risk (are they likely to engage in or suffer from fraudulent activity?), compliance/AML risk (could they be laundering money or violating regulations?), and reputational risk (might their business activity damage our brand?). By evaluating these, an underwriter decides if bringing on the merchant could lead to losses, legal issues, or reputation damage down the line.

KYB stands for Know Your Business. It refers to verifying the identity and legitimacy of a business entity. In merchant onboarding, KYB means checking that the merchant is a real, registered business (e.g., reviewing incorporation documents, business licenses, tax IDs) and understanding who the ultimate owners are. It’s analogous to KYC (Know Your Customer) but focused on companies rather than individuals. KYB helps ensure you’re not doing business with shell companies or fronts for illegal activity.

Artificial intelligence (AI) can dramatically speed up and enhance merchant onboarding. AI can automatically scan merchant websites, analyze application data, cross-check dozens of risk databases, and even learn patterns of fraudulent behavior — all in a fraction of the time a manual review would take. By using AI, companies can make faster decisions (onboarding good merchants in minutes) while actually improving accuracy in catching bad actors. AI models can also adapt over time, meaning the system gets smarter with each merchant it processes. The result is an underwriting and onboarding process that is both efficient and more effective at managing risk.

Yes, it’s important to know the merchant category code (MCC) during underwriting. MCCs are more complex than they appear and play a pivotal role in managing payments risk. Too often, merchant applications lack an MCC or are miscoded with the wrong MCC, either inadvertently or on purpose. Industry experts estimate that transactions totaling $36 billion are processed via the wrong MCC each year. Card networks and acquirers depend on this data point for activity tracking and need it to remain updated, especially as a merchant’s business evolves. With LegitScript MCC Detection, you can detect the correct merchant category code in real time and prevent miscoding, helping you avoid excess transaction fees to compliance issues and potential penalties.

Approving a merchant is not the end of risk management — it’s the beginning of a new phase. Ongoing merchant monitoring is crucial because a merchant’s risk profile can change over time. They might start selling new products, enter new markets, or experience a surge in fraud or chargebacks. Continuous monitoring (through transaction monitoring, periodic rescans of their website, repeated database checks, etc.) will catch these changes. It allows you to react to new risks — for example, by requiring a security deposit, suspending processing, or investigating suspicious activity — before it causes major damage. Essentially, onboarding gives you a risk baseline, and monitoring alerts you if the risk grows beyond what you signed up for.

To underwrite and onboard merchants faster without cutting corners, leverage automation and risk-based prioritization. Use automated tools to gather and verify documents, run credit and compliance checks instantly, and employ risk scoring to triage applications. Low-risk merchants can be auto-approved quickly, while higher-risk ones get the manual attention. Also, collect only the information you need — over-collecting data can slow things down and frustrate the merchant. By streamlining workflows (e.g., parallel processing of checks) and integrating smart tools, you can often achieve compliance checks in seconds or minutes. The key is to let technology handle the heavy lifting and have your compliance team focus on decisions and edge cases, not data collection.

Some best practices include: adopting a risk-based approach (spend resources where risk is higher), layering verifications (document database checks to catch discrepancies), automating repetitive tasks (to reduce errors and speed up processing), keeping compliance checks up-to-date (e.g., using the latest sanction lists, updating your criteria with new regulations), and collaborating across departments (ensure Sales, Risk, Compliance, and Tech are aligned on the onboarding requirements and process). It’s also critical to document your decisions and have an audit trail for regulators, and to continuously refine the process with lessons learned (for example, adding a new rule if you encounter a novel fraud scheme). Following the checklist in this chapter is a good starting point for implementing these best practices.

By following these guidelines and being proactive, onboarding teams can ensure they bring on merchants who will drive growth, not risk. This protects the payment provider while enabling legitimate businesses to start transacting quickly.