KYC for Payment Service Providers and Merchant Checks

Table of Contents

KYC for payment service providers means two separate jobs. You identify and verify the merchant businesses you board, including their owners and directors, and you identify the consumers who hold a wallet or card with you. Most PSP compliance failures happen on the merchant side, because a merchant is a business with an ownership chain, a product and a settlement bank account, and each of those can hide something.

A PSP sits between a sponsor bank or scheme and thousands of small businesses. The bank cannot see those businesses. It relies on you to. That dependency is what drives the evidence standard your acquirer will hold you to, and it is usually stricter than the letter of the regulation.

This guide covers merchant onboarding, the consumer side, prohibited categories, transaction laundering, ongoing monitoring and the records an auditor will ask for.

Who this applies to and under what rules

The label matters less than the activity. A payment institution, an electronic money institution, a payment facilitator, an acquirer, a money services business and a payout platform all end up with similar obligations once they hold or move customer funds.

The frameworks behind those obligations are consistent. The Financial Action Task Force sets the international standards through its 40 Recommendations. The European Union implements them through its anti-money laundering directives and regulations, and has created a central supervisory authority for the bloc. The United States builds on the Bank Secrecy Act, with the Financial Crimes Enforcement Network administering registration and reporting. The United Kingdom works through money laundering regulations supervised by the Financial Conduct Authority. Singapore and Australia run their own equivalents through the Monetary Authority of Singapore and AUSTRAC.

Sitting on top of all that are the card scheme rules. Those are contractual, not statutory, and they are often the thing that actually bites. A scheme can fine an acquirer for a merchant’s behaviour, and the acquirer will pass that down the chain to you.

Merchant onboarding: what you collect

Boarding a merchant is a know your business exercise plus a know your customer exercise on the people behind it. Treat it as one file with two halves.

The entity half

Registered legal name, trading name and registration number, checked against the company registry rather than taken from the application form.
Registered address and the actual trading address.
Legal form and date of incorporation.
The website, and every domain the merchant will process under.
A description of what is sold, how it is delivered and when.
Refund, cancellation and delivery policies as published on the site.
Expected monthly processing volume, average ticket size and highest ticket size.
Settlement bank account in the merchant’s own legal name.
Processing history and chargeback data from any previous provider.

The people half

Every beneficial owner above the applicable threshold, which in many regimes is twenty five percent, identified and verified like a retail customer.
All directors or equivalent officers.
The signatory who accepts the merchant agreement, with evidence of authority.
Where ownership runs through another company, a trust or a nominee, the chain followed until natural persons are reached.

Two checks are specific to payments and are routinely skipped. First, the scheme run terminated merchant databases, which record merchants previously terminated for cause. Mastercard’s MATCH is the best known. A hit does not automatically bar a merchant, but it demands an explanation on file. Second, the merchant’s settlement account name must match the legal entity. A payout going to a director’s personal account, or to a third party, is a control failure waiting to be found.

Screen everyone you identify. The entity, the owners, the directors and the signatory all go through denied party screening before the merchant identifier is created, not after the first settlement. Our overview of who needs to do denied party screening sets out where the obligation comes from for financial and non-financial businesses alike.

Underwriting risk tiers and the evidence each one needs

A tiered model lets you board a low risk shop in minutes while holding a high risk merchant for manual review. The tier is driven by merchant category, expected volume, delivery model, geography and ownership complexity, not by the size of the deal.

Risk tier	Typical merchant profile	Evidence required	Approval and review
Low	Domestic retail, immediate delivery, small ticket, single owner	Registry lookup, owner identity verification, sanctions screening, website review	Automated decision. Review every three years or on trigger
Standard	Ecommerce with stock holding, moderate volume, simple corporate ownership	All of low, plus bank statements, processing history and chargeback ratios	Underwriter review. Annual or biennial refresh
High	Future delivery, subscriptions, travel, gaming, nutraceuticals, cross-border	All of standard, plus audited accounts, source of funds, supplier contracts, adverse media	Senior sign off. Reserve or rolling holdback. Annual review
Enhanced	PEP owner, high risk jurisdiction, opaque ownership, aggregation model	All of high, plus full ownership chain documents and source of wealth on owners	Committee or MLRO approval. Review at least annually
Prohibited	Sanctioned party or jurisdiction, banned category, undisclosed aggregation	No amount of evidence changes the outcome	Decline, and consider a suspicious activity report

Write the tier definitions down and apply them mechanically. If a salesperson can move a merchant from high to standard by asking nicely, the model is decorative.

Prohibited and restricted categories

Every PSP needs a published list of what it will and will not board. Some entries are legal prohibitions. Others are scheme rules, sponsor bank policy or your own appetite. Say which is which, because the answer changes whether an exception is even possible.

Categories commonly restricted or refused include unlicensed gambling, unlicensed financial services, unregistered virtual asset businesses, pharmaceuticals sold without prescription controls, weapons and ammunition, counterfeit or infringing goods, adult content, debt collection, essay writing services, multi-level marketing schemes, timeshare resale, and any merchant selling goods subject to export control without the licence to do so.

That last one matters more than PSPs expect. A merchant shipping controlled technology or dual-use items needs the right licence, and processing their payments does not insulate you from the underlying transaction. If you board merchants selling technical goods, read our primer on what export controls are so your underwriters recognise the pattern.

Consumer KYC: wallets, cards and payouts

Where you hold funds for individuals, you run consumer KYC as well. The core identification set is the same everywhere: full legal name, date of birth, residential address and a government identification number, verified against a document or an independent data source.

Many regimes allow simplified due diligence for low value, low functionality products, such as a non-reloadable prepaid card with a hard cap and no cash access. The conditions are specific and set locally. Do not assume a simplified product in one market is simplified in the next.

When to verify, as well as whether

Verification is usually framed as an onboarding event. In payments it is better framed as a set of trigger points. Verify or re-verify at:

Account registration, before any funds are held.
A top-up or load that crosses a stored value threshold.
A request to raise a transaction or balance limit.
The first withdrawal, and any change of withdrawal destination.
Adding or changing a linked bank account or card.
A change to name, date of birth, address or nationality on file.
A device or location change that does not fit the account history.

The withdrawal destination change is the one fraud teams care about most. An account taken over is worthless to the attacker until the payout route changes. Treat that field as a step-up trigger, always.

Transaction laundering and undisclosed aggregation

This is the risk that is specific to payment service providers, and the one general KYC guides leave out entirely.

Transaction laundering happens when a merchant you approved processes payments for a different business you never saw. The front site sells something innocuous. The real traffic comes from somewhere else, often a site selling something you would have declined. Your KYC file is accurate and useless, because the entity you verified is not the entity generating the transactions.

Signals worth building into monitoring:

Transaction volume far above the approved forecast, with no matching growth in the merchant’s visible business.
Average ticket size that does not match the price list on the merchant’s website.
Traffic arriving from referring domains unrelated to the approved site.
Currency or issuing country mix that does not fit the stated market.
Transactions clustered outside the trading hours of a business of that type.
Chargeback reason codes for goods the merchant does not sell.
A merchant whose registered site is a thin template with no working checkout of its own.

Two practical controls. Run periodic content scans of the approved domain, so you notice when the catalogue changes. And run test transactions on a sample of higher risk merchants to confirm the checkout you were shown is the checkout in use.

Undisclosed aggregation is the sibling problem. A merchant boards as one business and then quietly processes for a group of sub-merchants. If they are aggregating, they need their own underwriting of those sub-merchants, and you need to know about it. Many of the warning signs overlap with the wider pattern set out in our guide to red flags of sanctions evasion.

Ongoing monitoring and re-underwriting

A merchant file ages faster than a consumer file. Businesses change hands, pivot products and add markets, and none of that generates a notification to you.

Run two cycles in parallel. Periodic review on a schedule driven by the risk tier. Event driven review on a defined trigger list, which should include a change of beneficial owner or director, a change of trading name or website, a new settlement bank account, a new country of operation, a sustained breach of the approved volume or ticket size, a chargeback ratio crossing the scheme monitoring threshold, an adverse media hit, and a law enforcement or scheme enquiry.

Screening has its own rhythm, separate from review. Lists update constantly, and a merchant clean at boarding can be designated the following week. Rescreen the whole merchant and owner population against refreshed list data rather than waiting for the annual review. Our note on how often to run denied party screening covers how to set the frequency. If you want to test name matching quality before choosing a vendor, Globalior’s free screening tool will run a name against live list data.

Screening at onboarding deserves its own written procedure, covering who is screened, against what, and what happens on a hit. Our walkthrough of sanctions screening in customer onboarding gives a sequence you can adapt for merchant boarding.

Records, evidence and what an auditor tests

Auditors and sponsor bank reviewers do not read policies first. They pick a sample of merchants and ask you to prove what was done. Your file has to answer the sample without anyone reconstructing anything.

For each merchant, keep the application as submitted, the registry evidence retrieved and its retrieval date, identity evidence for each owner and director, the screening record, the underwriting decision with the tier assigned and the reason, the approved volume and category, the signed agreement, and every subsequent review with its outcome.

The screening record is the part most often thin. It must show the exact name submitted, the lists searched, the date, the matching threshold, every hit returned, and the documented reason each hit was cleared or escalated. A system that shows only the current status fails this test. Our explainer on what an audit trail is covers the difference between a status field and real evidence.

One point on outsourcing. You can delegate the work of verification to a vendor or to a partner further down the chain. You cannot delegate the responsibility. Keep the evidence in your own systems, or at minimum keep a contractual right to retrieve it on demand and test that right before you need it.

Key takeaways

PSP KYC has two tracks: know your business on merchants, and consumer identification on wallet or card holders.
Merchant files must follow the ownership chain to natural persons and screen the entity, owners, directors and the agreement signatory.
The settlement bank account should match the merchant’s legal name, and a mismatch needs a documented explanation before boarding.
Scheme terminated merchant databases are a standard boarding check and a hit requires a recorded rationale.
Transaction laundering defeats an accurate KYC file, so monitor for volume, ticket size, referrer and currency patterns that contradict the approved profile.
Sanctions screening runs on its own frequency, independent of the periodic review cycle, because lists change between reviews.
Verification responsibility stays with the PSP even when the work is outsourced to a vendor or partner.

Frequently asked questions

What is the difference between KYC and KYB for a payment provider?

KYC identifies a natural person. KYB identifies a business and the people who own or control it. A PSP boarding a merchant does both: registry verification and ownership mapping on the company, then full identity verification on each beneficial owner, director and authorised signatory. Consumer wallet holders get KYC alone.

How long should merchant onboarding take?

A low risk domestic merchant with a single owner and clean registry data can be boarded the same day, often within an hour where registry and identity checks are automated. Standard tier merchants typically take a few days. High and enhanced tiers run to weeks, because financial statements, ownership chain documents and source of funds evidence have to be gathered and reviewed.

Do we need to screen merchants again after boarding?

Yes. Designations are added continuously, so a merchant or owner who was clear at boarding can appear on a list at any point afterwards. Rescreen the full merchant and owner population against updated list data on a set cycle, and again whenever a trigger event changes the file, such as a new beneficial owner.

Can a PSP rely on the sponsor bank’s KYC?

No, and the dependency runs the other way. The sponsor bank relies on the PSP, because the PSP holds the merchant relationship. Some regimes permit reliance on a regulated third party’s due diligence under conditions, but the obligation and the liability stay with you. Expect the bank to audit your files, not the reverse.

What are the signs of transaction laundering?

Volume well above the approved forecast, ticket sizes that do not match the published price list, traffic from unrelated referring domains, an issuing country mix that contradicts the stated market, and chargeback reason codes describing goods the merchant does not sell. A merchant website with no functioning checkout of its own is a strong indicator.

What records should we keep and for how long?

Keep the application, registry evidence, identity documents, screening records, underwriting rationale, the signed agreement and every review outcome. Retention periods are set by your regulator and commonly run for several years after the relationship ends, not after the last transaction. Scheme rules and sponsor bank contracts may require longer.

If you are designing a merchant boarding flow or tightening an existing one, contact the Globalior team for a view on the screening layer. You can also test merchant and owner names now using the free denied party screening tool.