Merchant Onboarding Flow: Mermaid Flowchart

Merchant Onboarding Flow flowchart diagram

About Source

Merchant onboarding is the process a payment platform uses to verify a new merchant's identity, assess risk, and configure them to accept payments. For platforms acting as payment facilitators (PayFacs) — like Stripe Connect or Square — this process is governed by card network rules and financial regulations, particularly KYB (Know Your Business) requirements from anti-money-laundering (AML) regulations.

The onboarding flow begins when a business applies to accept payments. The merchant provides business information: legal entity name, registration number, business address, merchant category code (MCC), expected transaction volumes, and beneficial owner details (typically any individual owning more than 25%). This information is required by regulations in most jurisdictions.

The platform runs automated KYB checks: it verifies the business registration against government databases, checks the business and principals against sanctions lists (OFAC, EU sanctions), verifies that the stated MCC aligns with the business description, and runs adverse media screening. The beneficial owner's identity documents (passport, driver's license) are verified through a document verification service.

Based on the risk score from KYB checks and the business type, the platform assigns a risk tier that determines: payout schedule (instant, daily, weekly), rolling reserve requirements (a percentage of volume held as a buffer against chargebacks), and transaction velocity limits. High-risk MCCs (gambling, adult content, firearms) require additional manual review and may be declined entirely based on the platform's acceptable use policy.

Once approved, the merchant's payment configuration is created: acquirer account, settlement bank account, MCC, supported payment methods, and currency settings. For platforms supporting multiple currencies, see Multi Currency Processing. The merchant receives API credentials and can begin accepting live transactions.

Frequently asked questions

Merchant onboarding is the process a payment platform (or PayFac) uses to verify a new merchant's identity, assess risk, and configure them to accept payments. It involves KYB checks, sanctions screening, risk-tier assignment, and account provisioning.

The platform validates the business registration against government databases, screens principals and the entity against sanctions lists (OFAC, EU sanctions), verifies beneficial owner identity documents, and scores the application for risk. Automated checks run first; flagged cases are escalated to manual review.

Merchants in high-risk MCCs (gambling, adult content, firearms, crypto) should always receive manual review regardless of automated KYB scores. Elevated expected transaction volumes or beneficial owner flags from adverse media screening also warrant human review.

Common mistakes include not collecting beneficial ownership data for entities above the 25% ownership threshold, applying uniform risk tiers to all MCCs, failing to re-screen existing merchants when sanctions lists update, and not linking the risk tier to rolling reserve and velocity limit configuration.

mermaid

flowchart TD
    A([Merchant submits application]) --> B[Collect business details and beneficial owner info]
    B --> C[Run automated KYB checks]
    C --> D[Verify business registration in government database]
    D --> E[Screen against sanctions lists — OFAC, EU]
    E --> F[Verify beneficial owner identity documents]
    F --> G{KYB checks passed?}
    G -->|Fail — sanctions match or invalid docs| H[Reject application]
    H --> I([Notify merchant with reason])
    G -->|Pass| J[Assess merchant category code risk]
    J --> K{MCC risk level}
    K -->|High risk MCC| L[Manual underwriting review]
    L --> M{Underwriter decision}
    M -->|Decline| H
    M -->|Approve with conditions| N[Set elevated reserve and limits]
    K -->|Standard MCC| O[Assign standard risk tier]
    N --> P[Configure merchant account]
    O --> P
    P --> Q[Set payout schedule and reserve requirements]
    Q --> R[Configure supported payment methods and currencies]
    R --> S[Create acquirer account and settlement routing]
    S --> T[Issue API credentials to merchant]
    T --> U([Merchant active — can accept payments])