Merchant KYC, formerly known as Know Your Business (KYB), verifies your company’s legal identity and the people who own or control it. Provide business registration documents, EIN, beneficial owner IDs, and 3 to 6 months of processing history, and you can usually clear standard onboarding or land in a defined risk tier with clear pricing and reserve terms. High-risk categories should expect deeper review, not automatic denial.

TL;DR:

  • Providing complete and consistent documentation upfront reduces onboarding delays and improves your risk tier.
  • Automated verification tools handle routine checks quickly, but manual review remains necessary for high-risk or complex cases.
  • Clear alignment between your application, website, and bank records lowers the chance of flagged mismatches and prolonged review.
  • Merchants in regulated or high-risk industries benefit from specialists with industry-specific compliance knowledge to speed approval.
  • Regular re-screening against sanctions lists and your own prior processing history can impact your ongoing account status and review timeline.
Davincipay
Build a Stronger Merchant Application
DavinciPay.ai helps complex ecommerce businesses navigate acquiring relationships, payment gateways, fraud prevention, and underwriting support.
Explore payment solutions

Table of Contents

What KYC for Merchants Actually Covers (And How It Differs From Consumer KYC)

Consumer KYC checks one person: a name, a birthdate, a government ID, maybe a selfie. Merchant KYC, or KYB, checks an entity and every person who owns a significant percentage of it, plus anyone who controls day-to-day operations. Stripe’s own onboarding compliance guide draws that line clearly: KYC verifies a person, KYB verifies a business and its structure.

Illustration of merchant entity ownership structure

The regulatory backbone is the Bank Secrecy Act and its anti-money-laundering framework, enforced through card network rules and bank-level customer identification programs. eCFR §1010.230 spells out exactly what financial institutions must verify for beneficial owners of legal entity customers, including limited exemptions for certain regulated entities. That regulation is why your acquirer asks for the same documents every time, regardless of which processor you apply through.

The practical outcome is risk tiering. Your entity type, industry, processing history, and ownership transparency all feed into a tier that determines:

  • Your transaction and monthly fees
  • Whether you carry a rolling reserve
  • Your initial processing volume cap
  • How often your account gets re-reviewed

Merchants who show up with clean documentation almost always land in a better tier than merchants who make underwriters chase paperwork.

How Does the Merchant Onboarding Process Work?

Onboarding runs in five stages, and each one can stall your application if you skip a step.

  1. Pre-screening. The processor checks whether your business category is even eligible. Prohibited or restricted categories (certain adult content, unlicensed pharmaceuticals, some gambling products) get flagged immediately.
  2. Identity and entity verification. Underwriters confirm your business exists through Secretary of State registry lookups, validate your EIN, and verify the identity of every beneficial owner named on your application.
  3. Processing history review. If you’ve processed before, underwriters pull your chargeback ratios, prior statements, and check the MATCH/TMF list for terminations tied to your business or its owners.
  4. Enhanced due diligence. Mismatches between your stated business model and your website, unusually high average tickets, or a history in a high-risk vertical trigger a manual underwriting queue instead of automated approval.
  5. Continuous monitoring. Approval isn’t the finish line. Processors track transaction patterns, refund rates, and dispute volume on an ongoing basis and re-review accounts when activity shifts.

Pro Tip: Pull your own MATCH/TMF status before you apply. If a prior processor listed you, you want to know why and have an explanation ready, not discover it mid review.

What Documents Do You Need for Merchant KYC?

Underwriters move faster when documents arrive complete and consistent the first time. Missing paperwork is the single biggest cause of onboarding delays.

  • Articles of incorporation, business licenses, and any DBA filings
  • EIN confirmation letter from the IRS
  • Government-issued ID and proof of address for every beneficial owner
  • Three to six months of bank statements
  • Three to six months of prior processing statements, if you’ve processed before
  • Website artifacts: terms of service, refund policy, and any product-specific licenses or supplier invoices

Established merchants in regulated verticals, like supplements or telehealth, sometimes need to go further. Audited financials, lab certificates of analysis, or medical licensing come into play when your category carries added regulatory weight. A bookkeeping service built for ecommerce can help keep your statements and financial reporting clean enough to hand over on request, which matters more than most merchants expect.

How Do Sanctions Screening and MATCH/TMF Checks Work?

Every applicant gets screened against OFAC’s sanctions lists and similar watch lists before an account moves forward. A confirmed match against a sanctioned individual or entity is disqualifying, full stop. A partial match, which happens often with common names, doesn’t kill your application. It just triggers a request for additional identity documents to rule out a false positive.

MATCH/TMF (the Mastercard and Visa terminated merchant lists) work differently. Landing on either list follows a prior account termination, usually tied to excessive chargebacks, fraud, or an undisclosed high-risk business model. A MATCH listing doesn’t automatically block you from every processor, but it does mean underwriters look harder and often ask you to explain the circumstances directly.

Screening isn’t a one-time event, either:

  • Sanctions lists get re-checked periodically for existing merchants, not just at signup
  • A change in ownership or business structure triggers re-screening
  • A processing volume spike outside your stated projections can trigger a manual re-review
  • Documentation showing the context behind a partial match speeds resolution significantly

Partial matches are common enough that most experienced underwriters treat them as routine, not alarming, provided you respond with documentation quickly.

Where Automation Fits Into Merchant KYC

Automated tools now handle the repetitive verification work that used to eat days of manual review. Identity verification services confirm government IDs and match selfies in seconds. Business registry lookups confirm your entity status against state filings almost instantly. Beneficial ownership screening tools cross-reference sanctions lists automatically for every owner named on your application.

What automation cannot do is judgment calls. A system can confirm your EIN is valid; it can’t decide whether your health claims on a supplement landing page cross a regulatory line, or whether your average ticket size makes sense for your stated business model. That’s where manual underwriting takes over.

  • Automated checks clear routine, low-risk applications in hours
  • Registry and sanctions screening tools flag discrepancies for human review rather than resolving them
  • High-risk categories almost always route to manual review regardless of how clean the automated results look
  • Submitting consistent business details across your application, website, and bank records reduces false-positive flags before they start

Pro Tip: Make sure the business name, address, and stated industry match exactly across your application, your website footer, and your bank statements. Automated systems flag mismatches even when they’re clerical, not fraudulent.

What Do Underwriters Actually Look For?

Underwriters spend real time on your website before they spend time on your financials. MerRisk’s underwriting overview confirms what practitioners see constantly: reviewers check your product claims, refund policy, contact information, and whether your site matches the business description on your application.

Common red flags include:

  • Health or efficacy claims on the website that go beyond what your product category can legally support
  • A stated business model that doesn’t match the products actually for sale
  • Average ticket size or volume projections wildly out of line with your processing history
  • Missing or inconsistent contact information and refund terms

Merchants who reduce reserve demands are the ones who hand over clean financials and prior processing statements before they’re asked twice. Staging your documents ahead of time, entity paperwork, owner IDs, statements, and a website that matches your application word for word, pre-empts most of the questions that stall a file. Reviewing DavinciPay’s underwriting and onboarding process beforehand gives you a sense of what a specialist reviewer actually checks line by line.

Pro Tip: Print your own website before you apply. Read it as if you were the underwriter looking for a reason to say no.

How Long Does Merchant Onboarding Take?

Automated approval for low-risk merchants with clean documentation can happen in a day or two. Manual underwriting for high-risk categories typically runs one to two weeks, longer if documents are missing. Your risk tier drives your fees, whether you carry a rolling reserve, and your initial volume cap. Complete documentation and consistent processing history are the two levers you actually control to shorten that timeline.

What Merchants Get Wrong About Onboarding

The biggest mistake merchants make isn’t hiding information. It’s disorganization. One supplement brand we’ve seen in this space delayed approval three weeks not because of red flags, but because owner IDs, EIN documentation, and bank statements arrived across six separate emails over two weeks instead of one complete package. The fix was simple: assemble everything before applying, not during. When your history is genuinely complicated, don’t fight a generalist underwriter for a month. Escalate straight to a processor that specializes in your vertical.

— Peter

Faster Onboarding Starts With the Right Underwriting Partner

Generic processors treat high-risk merchants like exceptions to manage. Specialist providers treat high-risk merchants as their entire business. Some payment solution providers specialize in high-risk and complex ecommerce, working with merchants in telehealth, nutraceuticals, supplements, subscription billing, and other regulated categories where a standard underwriter might default to denial or an inflated reserve out of unfamiliarity.

Davincipay

That specialization changes outcomes. Underwriters who already understand your vertical’s compliance requirements ask sharper questions and reach decisions faster, because they’re not learning your industry from scratch on your file. Such providers may pair vertical expertise with a network of domestic and international acquiring relationships, fraud prevention tools, chargeback mitigation, and underwriting support designed for merchants that generalist processors tend to overlook. If you’re in telehealth, industry-specific payment processing accounts for the compliance layers your business already carries. Supplement and nutraceutical brands can review dedicated processing support built around the documentation those categories require. Ready to see where you’d land? Start an application and get a real answer on your risk tier instead of guessing.

Where to Verify Merchant KYC Requirements Yourself

For primary sourcing beyond this guide, start with FinCEN’s BOI reporting resource for current beneficial ownership obligations, and eCFR §1010.230 for the underlying verification regulation. Stripe’s merchant onboarding breakdown and the PCI Security Standards Council round out the practical and technical standards worth bookmarking.

Sources

FAQ

What Are the KYC Requirements for Businesses?

Businesses applying for a merchant account need entity documentation (articles of incorporation, EIN), identification for every beneficial owner holding 25% or more of the company, and processing history if applicable. eCFR §1010.230 sets the verification standard financial institutions must follow when collecting this information.

Is KYC Mandatory in the USA?

Yes, KYC and KYB are mandatory for merchant accounts in the United States under Bank Secrecy Act anti-money-laundering requirements. Note that as of August 2026, U.S. companies and U.S. persons are no longer required to report beneficial ownership directly to FinCEN, though banks and processors still must verify beneficial ownership internally under eCFR §1010.230.

What Are the 5 Stages of KYC?

Merchant KYC typically runs through pre-screening, identity and entity verification, processing history review, enhanced due diligence for flagged applications, and continuous monitoring after approval. Each stage can introduce delays if documentation is incomplete or inconsistent with your application.

How Do I Get KYC Approval for My Merchant Account?

Gather your entity documents, EIN, owner IDs, and recent bank and processing statements before you apply, and make sure your website matches your stated business model exactly. Merchants in regulated or high-risk categories often move faster with a specialist provider like Davincipay that already understands the compliance layers those industries carry.