Merchant onboarding: knowing the business and the person behind it
Merchant onboarding is about knowing a business and the real person behind it before bringing them into your payment flow. TruvaLI maps ownership structures, measures operational risk, and monitors post-onboarding behavior.
Merchant onboarding is the process by which a payment service provider assesses a business's identity, ownership, and operational risk before integrating it into its payment flow. Unlike individual customer onboarding, the risk is concentrated not in the business itself, but in the activities it performs and the people behind it.
Who is being onboarded?
Onboarding a business means onboarding the real person behind that business. The ownership structure is mapped layer by layer down to the ultimate beneficial owner (UBO), and every natural person identified in the chain undergoes sanctions and PEP screening. Authorized signatures and representation rights are also part of the onboarding decision.
Ownership structures can change over time, and these changes can invalidate the onboarding decision. This is why ownership mapping is not a one-time task. Learn more on the KYB and UBO identification page.
Why is the line of business decisive?
Most merchant risk stems from the line of business. The declared line of business and the products actually sold can diverge. A business registering under an approved category only to sell products in another is a well-known industry challenge.
| Risk item | What is asked |
|---|---|
| Activity category | Does the declared line of business match the products sold? |
| Geography | Target market and countries where payments are accepted |
| Payment model | Upfront, subscription, pre-order: the time between collection and delivery |
| Ownership history | Do the same individuals own a previously closed business? |
| Website and content | Does public information match the declaration? |
Models with pre-orders and long delivery times carry a distinct risk: if the business goes bankrupt, the chargebacks for undelivered orders fall on the payment institution.
What signals are read at onboarding?
Just like in individual onboarding, a lot can be inferred from limited data. The provider and structure of the email address used in the application, the nature of the IP address, and whether other applications connect from the same device or address are all factored in. A previously rejected application returning with minor modifications becomes visible through these connections.
What is monitored post-onboarding?
The real risk with a merchant emerges after onboarding: transaction volume deviating from what was declared, rising chargeback rates, or silent changes to product categories. These deviations are caught through monitoring and alter the risk classification. The ongoing monitoring page explains this side, while the chargeback and payment fraud page covers the dispute side.
Decision and record-keeping
The onboarding decision is recorded along with its justification: which documents were obtained, how the ownership chain was mapped, which screening was performed, what score was generated, and who approved it. Due to segregation of duties, the person reviewing the application and the person approving it may not be the same. Details are on the maker-checker, authorization, and audit trail page.
The industry framework is discussed on the payment institutions and marketplaces pages.
Common questions
- How does merchant onboarding differ from individual customer onboarding?
- The risk is concentrated not in the business itself, but in the activities it performs and the real person behind it. The ownership structure is mapped, and the line of business is evaluated separately.
- How is the ultimate beneficial owner (UBO) determined?
- The ownership structure is mapped layer by layer down to the natural person. Every natural person in the chain undergoes sanctions and PEP screening.
- What happens if the ownership structure changes later?
- Changes can invalidate the onboarding decision. This is why the structure is not mapped just once, but is continuously monitored.
- Why is the line of business so important?
- The declared line of business and the products actually sold can diverge. Registering under an approved category and selling in another is a well-known industry challenge.
- Why does the pre-order model carry a distinct risk?
- When the time between collection and delivery is long, if the business goes bankrupt, the chargebacks for undelivered orders fall on the payment institution.
- Is the return of a rejected application detected?
- Yes. Applications connecting with the same device, IP, email pattern, or identity credentials become visible through relationship networks.
- What is monitored post-onboarding?
- Deviations in transaction volume from what was declared, rising chargeback rates, and changes in product categories. These deviations alter the risk classification.
- How is the onboarding decision documented?
- Obtained documents, the mapped ownership chain, performed screenings, the resulting score, and the approver are recorded. Due to segregation of duties, the reviewer and the approver may not be the same person.