KYC for Dropshipping Businesses: Suppliers and Buyers

KYC for dropshipping businesses works in two directions. Your payment provider, marketplace or bank runs KYC on you, and you are expected to run your own checks on the suppliers who ship in your name and on the customers you sell to. You never handle the goods, but you are still a party to the transaction. That is where most sellers get caught out.

The paperwork burden is smaller than a bank’s. The exposure is not. A parcel that moves from a factory in one country to a buyer in another, on your order and with your invoice inside, is an export. Someone is responsible for it.

Why dropshipping attracts extra scrutiny

Payment processors treat dropshipping as an elevated risk category. The reason is structural. In a normal retail sale the merchant holds stock and can ship the moment the card clears. In a dropshipping arrangement the merchant takes money first and depends on a third party to fulfil. Delivery times stretch. Refund rates climb. Chargebacks follow.

That pattern also suits transaction laundering, where a real storefront is used to push unrelated payments through an acquirer that never approved that business type. Acquirers know this, so the underwriting questions get pointed.

There is a second reason, and it gets less attention. A dropshipper sits between two parties it has never met. The supplier is often overseas. The buyer can be anywhere. If either is on a restricted party list, the seller is the link in the middle.

What a payment provider asks for when you onboard

Underwriting for a dropshipping merchant follows a fairly standard sequence. Expect to supply the following.

• Certificate of incorporation or business registration extract, with the registration number visible.
• Government issued photo ID for each director and each beneficial owner above the provider’s ownership threshold.
• Proof of business address, usually a utility bill or bank statement dated within the last three months.
• A bank account in the legal name of the business, not a personal account.
• Your website URL, product catalogue and category list.
• Supplier names, fulfilment locations and expected shipping times.
• Projected monthly volume and average transaction value.

The website matters more than new sellers expect. Reviewers open it. They look for product descriptions that match what you declared, a visible shipping policy with honest transit times, a refund and returns policy, terms of service, a privacy notice and a working contact route. A storefront with placeholder text or a fourteen day delivery promise on goods that take five weeks will fail review even if the company paperwork is clean.

The mismatches that cause rejections

Most declines are not fraud findings. They are inconsistencies. The bank account name differs from the registered company name. The director on the ID is not the director in the registry. The declared product category is homeware and the site sells vape accessories. Pull your own registry extract and read it against every field on the application form before you submit it.

Marketplace seller verification is now a legal duty

If you sell through a marketplace rather than your own site, the platform has statutory collection duties. These are not internal policy. They are law in the two largest consumer markets.

In the United States, the INFORM Consumers Act requires online marketplaces to collect and verify information from high volume third party sellers. A seller is high volume once it has made at least 200 separate sales of new or unused consumer products and taken at least 5,000 US dollars in gross revenue on that marketplace during any continuous twelve month period in the previous twenty four months. The marketplace must collect a bank account number or payee name, a tax identification number, and working contact details. Sellers must certify annually that the information is still current. Where a seller’s annual gross revenue on the platform reaches 20,000 US dollars, the marketplace must display the seller’s name, physical address and a direct contact route to shoppers. A seller who does not respond faces suspension after a ten day notice period.

In the European Union, Article 30 of the Digital Services Act places a traceability duty on platforms that let traders sell to EU consumers. The platform must obtain the trader’s name, address, telephone number and email, a copy of an identification document, payment account details, trade register number where one exists, and a self certification that the products offered comply with EU law. The platform must verify at least the contact details and the payment account against official databases or supporting documents, and make best efforts to check the rest against reliable independent sources. If the trader will not correct bad information, the platform must suspend it.

The practical effect is simple. Keep a folder with your registry extract, director IDs, tax number and a bank letter, all matching exactly. You will be asked for them more than once.

Know your supplier, not only your customer

Your supplier ships goods with your name on the label. If that supplier is a restricted party, or is owned by one, you have a problem that no refund policy will solve. Supplier vetting is the half of dropshipping KYC that most guides skip entirely.

Before you place a first order, collect and check the following.

1. Legal name and registration number, confirmed against the registry of the country of incorporation rather than a copy of a certificate the supplier emailed you.
2. Physical factory or warehouse address, checked against the address on the registry filing and against satellite imagery.
3. Ownership. Ask who owns the company and at what percentage. Sanctions rules in several jurisdictions look through to owners, so a clean named entity can still be blocked by its parent.
4. Bank account details in the supplier’s own legal name. A request to pay a third party in a different country is a hard stop, not a quirk.
5. Product compliance evidence: test reports, certifications and, where relevant, declarations about labour conditions in the production chain.
6. A screening result. Run the company name, the trading name, the directors and the owners through a restricted party check and keep the output.

You can run a denied party screening check on a supplier in under a minute, and the result is the evidence that you looked. Do it before the first payment, not after the first dispute.

Where export rules reach a seller who never touches the goods

This is the gap in almost every dropshipping compliance article. Sellers assume that because the supplier arranges the shipment, the supplier carries the export duty. That assumption is wrong often enough to matter.

Sanctions rules bind the person doing business with the restricted party, whoever moves the box. If your customer is a named individual on a sanctions list, selling to them is a problem whether the parcel leaves Shenzhen or your own garage. The same applies to destinations under embargo. A drop shipped order to a blocked country is still a transaction with that country.

Product type raises the stakes. Most consumer goods are low concern. Drones, thermal optics, GPS units, radio equipment, certain chemicals, encryption hardware and high specification electronics are not. If you list any of those, read up on how export controls apply to ordinary commercial goods before you take the first order. The classification question is about the item, not about your business model.

There is also the customs side. When a parcel enters a country, someone is the importer of record and carries the duty, tax and declaration accuracy obligation. Many dropshipping suppliers declare low values or mark goods as gifts to speed clearance. That is a false declaration made in connection with your sale. Customs authorities pursue the party that benefited.

Who checks what: a working split

Party	What you collect	How you verify it	When you repeat it
Your own business (to the processor)	Registration extract, director IDs, ownership, bank letter, website, volume forecast	Provider verifies against registries and ID checks	On ownership change, volume jump or new product category
Supplier or fulfiller	Legal name, registration number, address, owners, bank account, compliance certificates	Registry lookup, address check, restricted party screening	Annually, and on any change of bank details
Consumer buyer	Name, ship to address, billing address, email, IP country	Address and card verification, sanctions list check on name and country	Every order, automatically
Business buyer or reseller	Company name, registration number, delivery site, stated end use	Registry lookup plus restricted party screening on company and principals	At onboarding and at each material order change
Freight forwarder or last mile carrier	Company name, licence or registration, countries served	Screening against restricted party lists	At appointment and annually

Screening buyers without wrecking checkout

Nobody wants a five field identity form in front of a forty dollar order. You do not need one. Consumer facing screening should run on data you already hold.

Set it up in layers. Layer one blocks orders to embargoed destinations at the address stage, before payment. Layer two uses a free denied party screening tool on the buyer name and company field after the order is placed and before it is released to the supplier. Layer three flags the patterns that need a person: a billing country that differs from the shipping country, a freight forwarder address as the delivery point, several orders to the same address under different names, or a bulk quantity of a single technical item bought by a consumer.

The third layer catches diversion. Small parcels routed through an intermediate country are a known workaround, and a consumer order that behaves like a wholesale order deserves a question.

What to do with a hit

Hold the order. Do not release it to the supplier, and do not tell the customer why it is held. Compare the secondary identifiers you have, such as the address, the country and any company name, against the list entry. Most hits on common names are false positives and clear in a couple of minutes. The method for working through one is set out in this guide to resolving a false positive. Write down the reason for your decision either way.

Records, and a realistic setup for a small seller

A screening you cannot evidence is a screening you did not do. That is the position every examiner takes.

Keep the supplier file, including the registry extract and the screening output with its date. Keep the order record with the buyer details, the ship to address and the screening result attached. Keep the commercial invoice and any declared value the supplier used. Keep the record of each held order and what you decided. Retention periods vary by jurisdiction and by whether the record is a customs, sanctions or tax record, so check the rule where you are established. The EU traceability obligation makes platforms hold trader information for six months after a relationship ends, which is a floor and not a ceiling. Practical guidance on structuring this sits in the article on record keeping for denied party screening.

What the setup looks like in practice

You do not need an enterprise compliance platform. A small operation can cover the ground with a supplier onboarding pack, an order hold rule in the store platform, a screening step before release, and a folder structure that keeps evidence by counterparty and by order.

Write the policy down, even if it runs to two pages. It should say who screens, what triggers a hold, who can release a held order, and what happens on a confirmed match. Processors and marketplaces ask for exactly this document during review, and most small sellers do not have one. There is more in the guide to denied party screening for small businesses, and you can start with Globalior’s free screening tool without a contract.

Key takeaways

• Dropshipping KYC runs in both directions: the processor verifies you, and you verify suppliers and buyers.
• Payment providers reject most applications for mismatched details, so align the registry, bank and ID records before applying.
• The INFORM Consumers Act makes US marketplaces collect bank, tax and contact data from sellers above 200 sales and 5,000 US dollars in a twelve month window, with annual recertification.
• Article 30 of the EU Digital Services Act requires platforms to verify trader contact and payment details against official databases and to suspend traders who will not correct bad data.
• Sanctions obligations follow the transaction, not the warehouse, so a seller who never handles goods is still exposed on both the supplier and buyer side.
• Undervalued or gift marked customs declarations made by a supplier on your sale can become your customs problem as the party that benefited.
• Screening evidence with a date and a documented decision is what turns a check into a defence.

Frequently asked questions

Do I need KYC if I only dropship domestically?

Yes, though the scope narrows. Your payment provider will still run full onboarding checks on your business and its owners. Sanctions lists include domestic residents, so buyer screening still applies. What falls away is most of the export and customs exposure, provided the supplier is genuinely in the same country and not shipping in from abroad on your behalf.

Is the supplier or the dropshipper responsible for export compliance?

It depends on who is named as the exporter and who arranges the shipment, and both can carry duties at once. Sanctions rules bind anyone dealing with a restricted party, so a seller who directs a shipment to a blocked buyer is exposed regardless of the label on the airway bill. Set the allocation out in your supplier contract rather than assuming it.

How long does payment processor verification usually take?

Timelines vary by provider and by risk category, and dropshipping usually sits in a slower queue than standard retail. Clean applications with matching documents move fastest. The delay is nearly always caused by a document request the applicant answers slowly, or by a mismatch that forces a second review round. Prepare the full pack before you apply.

What happens if my supplier turns out to be on a restricted party list?

Stop payments and stop new orders immediately. Confirm the match is genuine by comparing address, registration number and ownership against the list entry. If it is genuine, you may have reporting or blocking obligations depending on the list and your jurisdiction, and continuing to trade would compound the problem. Take advice before you contact the supplier about it.

Can I screen customers without adding friction at checkout?

Yes. Run the check after the order is submitted and before you release it to the supplier. The buyer sees a normal confirmation. Only flagged orders pause, and most clear within minutes. Blocking embargoed destinations at the address field is the one check worth doing before payment, because it avoids taking money you then have to refund.

Do marketplace rules replace my own KYC obligations?

No. Platform verification confirms who you are to the platform. It says nothing about your suppliers, your buyers or the destinations you ship to. Those remain your responsibility under sanctions, export and customs law, and a marketplace will not defend you on them.

If you want a second opinion on how your supplier and buyer checks are set up, or help writing the short policy your processor keeps asking for, get in touch with the Globalior team.