Merchant onboarding: how to verify a merchant and its owners
How ISOs, payment facilitators and marketplaces verify a merchant and its owners: business checks, beneficial owners, OFAC and MATCH screening, underwriting.
Merchant onboarding is the process an acquirer, independent sales organization (ISO), payment facilitator or marketplace uses to confirm that a business applying to accept card payments is real, lawful and run by the people it names — before it processes a single transaction. That means verifying the business, identifying and verifying its owners, screening both against sanctions and terminated-merchant lists, and underwriting the risk.
Below we walk through the process step by step, show where each requirement comes from — the sponsor bank’s anti-money laundering (AML) program, Treasury rules and card network rules — and finish with a checklist.
Who sets the rules for merchant verification
Three sets of rules apply.
- The acquiring bank’s AML program. The Financial Crimes Enforcement Network’s (FinCEN’s) customer due diligence (CDD) rule in the Code of Federal Regulations (CFR), 31 CFR 1010.230, requires covered financial institutions, such as the acquiring bank, to “establish and maintain written procedures that are reasonably designed to identify and verify beneficial owners of legal entity customers.” If you’re an ISO or payment facilitator, your agreement with that bank sets what you must collect for it, so ask for its procedures in writing and confirm the details with your compliance team or counsel.
- Card network rules. The Visa Core Rules and Visa Product and Service Rules (April 18, 2026 edition) say that “before contracting with a prospective Merchant or Sponsored Merchant, an Acquirer or a Payment Facilitator must conduct an adequate due diligence review, including a site visit to the business premises (if applicable) or suitable alternative.” Mastercard’s Security Rules and Procedures — Merchant Edition (August 4, 2026) has a chapter on screening and monitoring merchants and another on its Mastercard Alert To Control High-risk Merchants (MATCH) Pro system.
- Bank examiners’ guidance. The Federal Financial Institutions Examination Council (FFIEC) Bank Secrecy Act/AML manual section on third-party payment processors lists, among steps a bank may consider when assessing the risks of a payment processor customer, “verifying directly, or through the processor, that the merchant is operating a legitimate business.”
The merchant onboarding process, step by step
1. Collect complete application data
Visa’s rules list what an acquirer must provide to Visa for each merchant, including the “doing business as” (DBA) name, full legal name, outlet address, telephone number, and a business registration or tax identification number. In the U.S., that’s the federal Taxpayer Identification Number (TIN) and whether it’s an Employer Identification Number (EIN) or a Social Security number. U.S. acquirers must also report the merchant’s incorporation status and merchant category codes (MCCs). Add the website, expected volume, and every owner and officer.
2. Verify the business exists
Check the legal name, entity type and standing with the state where the company was formed. The National Association of Secretaries of State points to each state’s business registration pages and corporate name databases. Collect the formation documents (Articles of Organization or Incorporation) and the Internal Revenue Service (IRS) letter confirming the EIN.
An EIN letter shows a number was issued; it doesn’t prove the applicant controls the business. The IRS’s TIN Matching program checks name and TIN combinations, and the IRS says it is “only for payers and their authorized agents that submit information returns.” If you’re the entity that files Form 1099-K for your merchants, you may qualify: the IRS’s Form 1099-K FAQs say “verification of payee TINs is done through the Taxpayer Identification Number (TIN) Matching Program.”
3. Identify beneficial owners and control persons
Under the CDD rule, a beneficial owner is each individual who, directly or indirectly, “owns 25 percent or more of the equity interests” of a legal entity customer, plus “a single individual with significant responsibility to control, manage, or direct” it, such as a chief executive officer or managing member. The institution may rely on what the customer supplies, provided it has “no knowledge of facts that would reasonably call into question the reliability of such information.”
On February 13, 2026, FinCEN granted exceptive relief (FIN-2026-R001) from identifying and verifying beneficial owners at each new account opening. Covered institutions must still do it when a legal entity customer first opens an account, when facts call earlier information into question, and as their risk-based ongoing due diligence requires. Separately, FinCEN’s beneficial ownership information page says that under its August 2026 final rule, “U.S. companies are exempt from the Beneficial Ownership Information (BOI) reporting requirements.” Ownership details come from the merchant, and you verify them.
4. Verify each owner’s identity
The CDD rule says owner verification procedures must, at a minimum, contain the elements required for verifying the identity of individual customers. Remotely, one way is a government ID check plus a selfie with liveness for each owner and the control person.
5. Screen the business and its owners against sanctions lists
OFAC is the Treasury Department’s Office of Foreign Assets Control. Visa’s rules require each member to screen its merchants “against the OFAC Specially Designated Nationals and Blocked Persons List (SDN List), as well as all other applicable sanctions lists,” at onboarding “and on a regular, ongoing basis thereafter.”
Screen the owners, not just the company name. Under OFAC’s 50 Percent Rule guidance, “any entity owned in the aggregate, directly or indirectly, 50 percent or more by one or more blocked persons is itself considered to be a blocked person,” whether or not the entity appears on the SDN List. For example, if two blocked individuals each owned 25 percent of an applicant, the business would be blocked even though its own name matches nothing. Run sanctions screening on each owner’s verified name and date of birth, not just what was typed into a form.
6. Check MATCH and terminated-merchant databases
Mastercard’s MATCH Pro documentation calls MATCH Pro “a mandatory system for Mastercard Acquirers.” Acquirers query it with the merchant’s and principal owners’ details before executing a merchant agreement. It searches records other acquirers added “during the past five years” for exact or phonetic matches. Acquirers add a merchant within five days of deciding to terminate it for one of the MATCH Pro reason codes.
Visa’s April 2026 rules also require acquirers to “query a common terminated Merchant database before entering into a Merchant Agreement with a prospective Merchant” and to use Terminated Merchant File data “only as an informational tool in the decision-making process.” Visa’s rules define the Terminated Merchant File as a file “currently known as ‘MATCH’” maintained by Mastercard. On a possible match, the acquirer must confirm it’s the same merchant and contact the member that listed it.
7. Review the website and business model
Check that what the merchant sells matches its application and MCC, that the website shows real contact details and refund terms, and that nothing falls on your sponsor bank’s prohibited list. Visa classifies some merchants as “High-Integrity Risk” based on MCCs listed in its Visa Integrity Risk Program Guide; before submitting their transactions, an acquirer must, among other things, register those merchants with Visa, with limited exceptions. Visa also bars acquirers from allowing their payment facilitators to provide payment services to outbound telemarketers.
8. Merchant underwriting
Merchant underwriting decides whether to approve and on what terms. Depending on your sponsor bank’s credit policy, the file may include business bank statements, prior processing statements showing volume, refunds and chargebacks, a voided check for the settlement account, and financial statements for larger volumes. Compare them with the application. For example, a merchant claiming $20,000 a month in card sales should show roughly that in its processing statements.
Ongoing monitoring and re-verification
Visa’s rules require sanctions screening on a regular, ongoing basis, and for high-integrity risk merchants they require acquirers to establish each merchant’s normal daily activity and begin daily monitoring on the 31st calendar day from the first deposit. Mastercard’s MATCH Pro emails an alert if another acquirer later adds a possible match to a merchant you inquired about.
Re-verify when something material changes: new owners, a new website or products, a different MCC, a volume spike, or rising chargebacks. Under FinCEN’s 2026 relief, covered institutions must still identify and verify beneficial owners again when facts call the earlier information into question.
On September 8, 2026, the Federal Trade Commission (FTC) announced that payment processor Humboldt Merchant Services agreed to pay $12 million under a proposed stipulated order. The FTC alleged that “Humboldt processed payments for more than 1,000 merchants that were shell entities,” and that they “typically incurred chargebacks at rates that were almost 10 times higher than what credit card brands view as excessive.” Among other things, the proposed order bans Humboldt from processing for straw companies and for merchants on the MATCH list for reasons including excessive chargebacks.
Merchant onboarding checklist
- Application complete: legal name, DBA, address, phone, TIN and type, entity type, MCC, website, volume, owners and officers.
- Business confirmed with the state registry; formation documents and EIN letter on file.
- Beneficial owners (25 percent or more) and one control person identified and certified.
- Each owner and the control person verified with ID, selfie and liveness.
- Business and every owner screened against OFAC lists; 50 Percent Rule checked.
- Terminated-merchant databases, including MATCH Pro, queried; possible matches investigated and documented.
- Website, business model and MCC reviewed against sponsor bank and network category rules.
- Bank statements, processing statements and voided check reviewed.
- Decision, reasons and reviewer recorded; monitoring and re-verification triggers set.
What to look for in merchant onboarding software
Merchant onboarding software should keep each application as one case — documents, owner verifications, screening results and the decision — with an audit trail your sponsor bank can follow, and verify every owner, not just the applicant. Securely Verify’s business verification (on Growth and higher plans), for example, collects formation, tax and banking documents, sends an ID, selfie and liveness check to each owner and officer, and records each person’s role and ownership percentage; document collection links can gather underwriting files such as bank statements and voided checks. Documents are organized for your reviewers, not automatically verified, and it doesn’t pull Secretary of State records or check EINs against IRS records, so you’d run those steps separately.
If you want to try owner verification on your next merchant application, start a 7-day free trial — 20 verifications, no card required.
Related guides
Sources: 31 CFR 1010.230, Beneficial ownership requirements for legal entity customers (eCFR, up to date as of October 14, 2026); Exceptive Relief from Requirement to Identify and Verify Beneficial Owners at Each Account Opening, FIN-2026-R001 (FinCEN, February 13, 2026); Beneficial Ownership Information Reporting (FinCEN, alert updated August 11, 2026); Revised Guidance on Entities Owned by Persons Whose Property and Interests in Property Are Blocked (OFAC, August 13, 2014); Visa Core Rules and Visa Product and Service Rules (Visa, April 18, 2026); Security Rules and Procedures — Merchant Edition (Mastercard, August 4, 2026); MATCH Pro documentation (Mastercard, accessed October 16, 2026); Third-Party Payment Processors — Overview, BSA/AML Examination Manual (FFIEC, accessed October 16, 2026); Corporate Registration (National Association of Secretaries of State, accessed October 16, 2026); Employer Identification Number (IRS, updated July 17, 2026); Taxpayer Identification Number (TIN) Matching (IRS, updated August 10, 2026); Form 1099-K FAQs: Third party filers of Form 1099-K (IRS, updated May 18, 2026); FTC Takes Action Against Payment Processor Humboldt Merchant Services for Knowingly Facilitating Payment Processing for Sham Merchants (FTC, September 8, 2026). This article is general information, not legal or compliance advice.
