Table of Contents
If you sell across borders online, three separate parties will run KYC on you. The marketplace verifies you as a trader. Your payment provider runs customer due diligence on you as a merchant, and your bank does its own check when the money lands. Each wants different documents. On top of that, you carry your own duty to check who is buying, especially when the parcel is heading somewhere restricted.
Most articles on ecommerce KYC talk about verifying shoppers to stop chargebacks. That matters, but it is the smaller half of the problem for a seller. The part that freezes your payouts and closes your storefront is the verification pointed at you.
This covers all of it. What each party collects, what the legal basis is, what your own screening obligation looks like, and what to have ready before you register anywhere.
Three KYC obligations land on the same seller
They arrive from different directions and people conflate them constantly.
Marketplace verification comes from consumer protection and platform regulation. The platform has to know which trader is behind a listing, and in some cases publish that identity to shoppers. This is trader traceability, not anti money laundering.
Payment provider verification comes from anti money laundering law. A payment institution or acquirer is a regulated entity. You are its customer. It applies customer due diligence to you, identifies your beneficial owners, and monitors your transaction flow afterwards.
Your own screening obligation comes from sanctions and export control law. It applies to you directly, whatever the platform does. Turnover does not change that, which is why denied party screening for small businesses exists as a distinct topic.
What the marketplace verifies, and under what law
United States: the INFORM Consumers Act
US online marketplaces must collect and verify information from high-volume third party sellers. A seller counts as high-volume after 200 or more separate sales of new or unused consumer products and 5,000 US dollars or more in gross revenue, in any continuous twelve month period during the previous twenty four months, through that marketplace with payment processed by it.
Once you cross that line, the marketplace collects a bank account number or the name of the payee, a business or taxpayer identification number, and contact details. For an individual seller that includes a valid government issued identity document. You get 10 days to respond to a request.
Two follow-on duties catch sellers out. You must certify annually that the information has not changed, or supply the update. And once your gross revenue on that marketplace reaches 20,000 US dollars a year, the platform must display your name, physical address and a direct contact method on the listing. Sellers working from home can ask for a limited disclosure instead.
The verification standard on the platform is worth reading, because it explains why scans get rejected. The marketplace has to reliably determine that the documents are valid, correspond to the seller, and are neither misappropriated nor falsified.
European Union: Article 30 of the Digital Services Act
The EU approach is broader. Article 30 of the Digital Services Act requires an online platform allowing distance contracts with consumers to obtain trader information before letting the trader sell.
- Name, address, telephone number and email address.
- A copy of an identity document, or electronic identification under the EU electronic identification regulation.
- Bank or payment account details.
- Trade register name and registration number where the trader is registered.
- A self-certification that the goods or services offered comply with EU law.
The platform must make best efforts to assess whether that information is reliable and complete, using freely accessible official databases or documents from a reliable source. If the platform suspects the information is inaccurate, incomplete or out of date, it asks you to correct it without delay. If you do not, it suspends your service until you do.
That suspension power is the practical point. A missing registration number is not a warning letter. It is a stopped storefront.
What the payment provider verifies
Payment service providers, acquirers and merchant account banks apply full customer due diligence because they are regulated financial institutions and you are their customer. The frame is the FATF Recommendations, translated into national law and, in the EU, into the AML package.
For a company seller the file usually contains the certificate of incorporation, the registered address, the director list, the ownership structure, identity documents for each beneficial owner above the threshold, and evidence of the business model. That last item surprises people. Providers ask for supplier invoices, a product catalogue and expected monthly volume, because underwriting risk depends on what you sell and to whom.
Screening runs across all of it, against sanctions designations, politically exposed person data and adverse media. Ownership matters here too. A company can be treated as sanctioned because designated persons own enough of it, without appearing on any list itself.
Monitoring continues after approval. A sudden change in average order value, a new destination mix, or a spike in refunds can trigger a review and a rolling reserve on your payouts.
| Who checks you | What they collect | What triggers it | If you fail |
|---|---|---|---|
| US marketplace | Bank account or payee name, tax ID, contact details, government ID for individuals | 200 sales and 5,000 US dollars gross revenue in a rolling twelve months | Account suspended after the 10 day response window |
| EU online platform | Name, address, phone, email, ID copy, payment account, trade register number, self-certification | Any trader offering distance contracts to EU consumers | Service suspended until the information is corrected |
| Payment provider or acquirer | Incorporation documents, ownership chart, beneficial owner IDs, business model evidence | Account opening, then periodic review and event-driven triggers | Payouts held, rolling reserve applied, or the account closed |
| Carrier or forwarder | Shipper details, commodity description, consignee identity data for certain destinations | Booking, and customs requirements at destination | Shipment refused or held at the border |
| You, on your buyers | Buyer and consignee names, addresses, destination country, end use where relevant | Every order, before despatch | Sanctions or export control liability sitting with your business |
Your own duty on the buyer
This is the part the platform does not do for you, and the part most seller guides skip entirely.
Sanctions prohibitions apply to the person making the shipment. If a designated party orders from your store, the marketplace’s trader verification is irrelevant. You shipped it. The same logic applies to export controls: the exporter of record carries the obligation, and a consumer listing does not change that.
So screen. Before despatch, run the buyer name, the consignee name if different, and the delivery address through the government lists. A free denied party screening tool handles this in seconds, and it is the highest value control a small seller can add. There is no exemption for sole traders or for hobby sellers who have grown into a business.
Destination matters more than order value
A 40 dollar order to an embargoed country is a bigger problem than a 4,000 dollar order to a friendly one. Build a blocked destination list into your checkout rather than relying on manual review. Watch for the obvious workarounds too. A billing address in one country with a delivery address in another is worth a second look, as is a freight forwarder address standing in for the real destination.
Drop shipping does not transfer the obligation
If your supplier ships directly to your customer and your name is on the commercial documents, you are still in the chain. Know who your supplier is and where they ship from, then screen the end customer yourself. The mechanics of drop shipping put you further from the goods without putting you further from the liability.
KYC on your buyer at the destination border
Several countries will not clear an inbound parcel until the carrier holds identity details for the consignee. Brazil is the best known case, where a personal or company tax number is required for customs clearance. India applies identity requirements to courier imports as well. Requirements vary by country and change, so check with your carrier for each destination you open.
Two practical consequences. First, if you sell on delivered duty paid terms, you may be acting as the importer of record, which carries customs obligations of its own. Second, collecting a buyer’s tax number at checkout is usually easier than chasing it while the parcel sits in a bonded warehouse and the buyer opens a dispute.
Documents to prepare before you register anywhere
- Certificate of incorporation and any trade register extract, dated recently.
- Proof of registered address, and proof of the operating address if they differ.
- Passport or national ID for every director and beneficial owner, plus a proof of address for each.
- An ownership chart if any shareholder is itself a company.
- A bank statement in the business name showing the account you want paid into.
- Tax or VAT registration numbers for each country where you are registered.
- A short description of what you sell, who you sell to, and your expected monthly volume.
Scan quality causes more rejections than anything else. Full page, all four corners visible, no glare, no cropping, colour rather than greyscale. Names must match exactly across documents. A middle name on the passport that is missing from the bank statement is enough to stall an application.
Why payouts get held, and what to do
Holds usually come from one of a few causes. Verification documents expired or never completed. A name mismatch between the store, the bank account and the registry. A screening alert on a director or shareholder. A change in trading pattern that the provider’s monitoring flagged.
Screening alerts are often false positives. Common surnames and transliterated names generate them constantly. Answer with evidence, not with argument: date of birth, nationality, registry extract, anything that distinguishes your director from the listed person. Knowing how to resolve a false positive in denied party screening shortens these exchanges considerably.
Respond inside the stated window. Platform and provider deadlines are short, and automated suspension does not wait for your reply.
A seller-side routine that holds up
- Keep one folder of current corporate and identity documents, refreshed when anything expires.
- Use the exact same legal name and address across the store, the bank and every registry filing.
- Screen every order before despatch, buyer and consignee both.
- Maintain a blocked destination list in the storefront, not in someone’s head.
- Record the screening result against the order number, including clear results.
- Re-run screening if an order is shipped more than a few days after it was placed.
- Diarise the annual marketplace certification so it does not arrive as a surprise.
- Review the whole setup when you open a new country or add a new product category.
Step five is the one sellers drop. A clear screening result you did not save is the same as no screening at all when someone asks a year later. Sound record keeping for denied party screening costs almost nothing if you build it in from the start.
Key takeaways
- A cross-border seller faces marketplace trader verification, payment provider customer due diligence, and its own screening duty on buyers.
- Under the INFORM Consumers Act, a high-volume seller is one with 200 or more separate sales of new or unused consumer products and 5,000 US dollars or more in gross revenue in a continuous twelve month period within the previous twenty four months.
- US marketplaces must also display seller name, address and contact details on listings once annual gross revenue on that marketplace reaches 20,000 US dollars.
- Article 30 of the Digital Services Act requires traders to give EU platforms contact details, an ID copy, payment account details, a trade register number and a compliance self-certification.
- An EU platform must suspend a trader who does not correct inaccurate or incomplete information.
- Sanctions and export control obligations sit with the party shipping the goods, so screening buyers is the seller’s job, not the platform’s.
- Some destinations require consignee identity data before customs release, with Brazil’s tax number requirement the most commonly encountered.
Frequently asked questions
Do I need KYC if I only sell small consumer items?
Yes, in two directions. Your payment provider will verify you regardless of order size, because it is a regulated institution. Sanctions prohibitions also have no minimum value. Low unit price reduces your commercial risk. It does not reduce the legal obligation to avoid shipping to a designated party or a prohibited destination.
Does the marketplace screen my buyers for me?
Assume not, unless your seller agreement says so in writing. Large platforms run controls on their own behalf, covering their own regulatory exposure. That is separate from your position as the party shipping the goods. Where the marketplace is not the exporter, the obligation stays with you. Check your contract and keep your own screening records.
Why does my payment provider want my supplier invoices?
To confirm the business is real and matches the stated model. Providers underwrite fraud and chargeback exposure, and both depend on what you actually sell. Supplier invoices, a product catalogue and expected volumes let them size that risk. Vague answers here are a common reason an application stalls or a reserve is imposed.
How long does seller verification usually take?
It varies by provider and by how clean your documents are. Automated identity checks can complete in minutes. Business verification with an ownership chain behind it takes longer, and every follow-up request restarts the clock. Submitting complete, legible, consistent documents the first time is the only part of the timeline you control.
What happens if a buyer’s name matches a sanctions list?
Stop the shipment and do not refund immediately. Compare the identifiers you hold, such as country, address and any date of birth, against the list entry. If it is clearly a different person, document the reasoning and proceed. If you cannot rule out a match, take advice before releasing goods or funds, because handling the payment can itself be a problem.
Do I need to screen repeat customers every time?
Screen each order. Lists are updated frequently, and a customer who was clear last quarter may not be clear today. Automated screening at checkout makes the frequency question disappear. If you screen manually, at minimum re-check any customer whose details have changed or who has not ordered for several months.
You can screen buyers, consignees and suppliers with Globalior’s free screening tool, and run a denied party screening check on an order in under a minute. For help fitting this into your order process, contact the Globalior team.