High Risk Merchant Handbook

Merchant Account Underwriting, Explained

Visa's standards say what an acquirer must check before it approves you. Here is what to have ready, and what a conditional approval means.

Merchant account underwriting is the review that decides if an acquirer will let you take cards. It is not a processor being picky. Visa's standards say acquirers must develop a risk-based underwriting process for onboarding new merchants. The review that feels like friction is a Visa rule your acquirer has to follow.

What underwriting is and why it exists

FDIC guidance says payment processors pose greater fraud risk if they cannot verify their merchants.

Visa's standards say acquirers must establish a risk-based onboarding policy that segments merchants into risk categories. The same standards say the policy and process must be checked and brought up to date now and then. So the questions you answer today come from a rule book the acquirer keeps up to date.

The identity and business checks

Two acronyms drive the first stage. Visa's standards say KYB stands for Know Your Business. KYC stands for Know Your Customer. The acquirer checks both.

Visa's standards say underwriting must include verifying a seller's name, address, email, phone number, business registration and documents. The acquirer also gets facts on each owner or director. It wants their name, address, ID number, email, and phone number. Visa's standards say acquirers must conduct a background investigation to verify the principals' identities.

Visa's standards say these KYC and KYB checks must follow the laws that apply to the acquirer. Visa's standards say acquirers use Identity Verification Services to help check who you are. These tools check your details against many data sources.

Visa's standards also say acquirers must keep up AML due diligence over time. It screens names against sanction lists. It checks for politically exposed persons. It also scans for bad news. Expect your name to be checked against sanction lists and the news.

Extra checks for online sellers

E-commerce merchants get a second layer. Visa's standards say acquirers check more for online sellers. They collect a list of the URLs the merchant uses and verify it. The acquirer also checks that the merchant owns its domains and websites.

So before you apply, make sure your business is the registered owner of your domains. A site registered to an old partner is a problem you can fix. Fix it first, not after the acquirer asks.

Visa's standards say acquirers must conduct fraud checks when onboarding a merchant. They must also have systems to spot fraud linked to the merchant during onboarding. Visa's guide adds that the underwriting process should include checks of consumer complaint boards. If your business has angry posts on complaint sites, expect questions.

Visa's guide also warns that some firms that were turned down lie on their forms to get payment services. This is why the acquirer double-checks what you tell it. Answer truthfully.

Risk categories and the three decisions

Visa's standards say the policy sorts merchants into risk groups. Where you land in those categories shapes the review. Visa's standards say a merchant's history of terminations, excessive chargebacks, fraud or illegal activity can affect the underwriting decision.

Visa's standards say an application decision can be approval, decline or conditional approval with exposure mitigation strategies such as reserves or holds. With a conditional approval, you are in, but the acquirer wants a cushion. It is a yes with strings, not a no.

Some of this review runs on software. Visa's standards say automated underwriting often uses decision or risk models, which may include artificial intelligence. Visa's standards also say the acquirer may visit your business site. Visa's standards say other suitable checks can be used instead.

High-risk and specialty merchant types

Some business types carry their own registration step. Mastercard requires Customers to register certain merchant types using the Specialty Merchant Registration application within My Company Performance, available through Mastercard Connect.

Mastercard makes some business types register, most of them ones that do not sell face to face. Gambling merchants with MCCs 7801, 7802, and 7995 must register. So must adult content merchants with MCCs 5967 and 7841. Drug merchants with MCCs 5122 and 5912 must register too. Tobacco merchants with MCC 5993 are also on the list. Mastercard also makes crypto merchants with MCC 6051 register. The same goes for negative option billing merchants that sell physical goods with MCC 5968.

Visa's standards say MCC stands for Merchant Category Code. Your MCC decides which of these rules reaches you. Mastercard's manual says the registration information includes the names, addresses, and tax identification numbers of the principal owners.

Visa runs its own program for certain merchants. Visa's program says an Acquirer must conduct and attest to due diligence before onboarding High Integrity Risk Merchants. Visa's standards say high integrity risk merchants may need extra due diligence to check compliance with the VIRP requirements.

If you sell by phone, read our page on billing authorization.

What happens after approval

Approval is not the end of the review. Visa's standards say acquirers must adopt a risk management-focused monitoring strategy for their merchants from onboarding until partnership termination.

Visa's standards say acquirers conduct first- and third-party data verifications using web crawling, negative news scanning and beneficial owner research. Mastercard recommends that acquirers in the Europe Region perform checks on e-commerce merchants during onboarding and regular rescreening. So the checks that got you approved can run again later.

Visa's standards say underwriting confirms that merchants and TPAs operate within allowed jurisdictions and follow relevant regulations. Keep your filings up to date and your story the same as on the form.

How to prepare

Gather your business papers. Also get the ID number for every principal. List every URL you sell on, and confirm you own those domains. Write down a plain description of what you sell and how you deliver it.

Check your own name on complaint boards and news searches first. If something unfair shows up, write a short explanation now. Visa's guide says merchants should be underwritten on their merits, and reserves are not a reason to onboard unreasonably high-risk merchants. Your job is to make your merits easy to see.

To learn more, see why banks watch payment processors.

Sources