Before you start
Every acquirer has its own application form, and high-risk acquirers ask for more than standard ones. The list below is the common core. Collect it once, in one place, and most acquirers' forms can be completed from it without going back to the merchant.
Tell the merchant up front how many documents you need and how recent they must be. Proof of address older than three months and bank letters older than six months are the most common reasons a file is returned.
1. Company information
- Legal entity and trading name. Exactly as registered, plus the brand the customer sees.
- Registration number, country and date of incorporation. These must match the certificate of incorporation.
- Registered business address. And the operating address if it is different.
- VAT number or tax ID. Where the company is registered for one.
- Website URLs and billing descriptors. Every site that will take payments, and the descriptor that will appear on card statements.
- Industry and MCC. A plain description of what is sold, and the merchant category code if known.
- Test credentials. If the site has a login or paywall, so the acquirer can review the customer journey.
2. Commercial and processing profile
- Projected monthly volume and average ticket. Plus the expected maximum single transaction.
- Card mix. The expected share of Visa and Mastercard.
- Chargeback and fraud ratios. For the last six months, if the merchant already processes.
- Delivery delay. How many days pass between payment and delivery of the product or service. Long delays mean more risk for the acquirer.
- Sales model. Subscription or straight sales, with the split if both.
- Target markets and traffic sources. Where customers are and how they arrive, with rough percentages.
- Current gateway, PSP and CRM. What the merchant uses today and what will need to integrate.
3. Director, owner and KYC documents
This is the section that takes longest. A typical online merchant file includes:
- Certificate of incorporation. And a recent business register extract.
- Memorandum and articles of association. The company's constitutional documents.
- Certificate of shareholders and certificate of directors. To show who owns and who runs the company.
- IDs of directors and ultimate beneficial owners. Passport or national ID for each director and every beneficial owner. Under EU anti-money-laundering rules, anyone owning more than 25% is a beneficial owner, and many acquirers set a lower threshold.
- Proof of address for directors and owners. Less than three months old.
- Bank account confirmation. A bank letter or statement, less than six months old.
- Processing history or business plan. Six months of processing statements, or a business plan for a new merchant.
- Financial statements. Recent and current accounts.
- Business licence. Where the activity is licensed, such as gambling or financial services.
- Proof of business address and VAT confirmation. Where applicable.
- Proof of domain ownership. For each website that will take payments.
- PCI DSS evidence. A self-assessment questionnaire or attestation of compliance, and ASV scan attestation where required.
4. Compliance declarations
Most acquirers ask the merchant to confirm, in writing, that:
- There is no prohibited or illegal activity. In any market where the merchant sells.
- No director or shareholder is sanctioned. And none is a politically exposed person, or that any such person is declared.
- The business is GDPR and PCI DSS compliant. Where these apply.
- The merchant is not on a card-scheme list. Not blacklisted by Visa or Mastercard, and not in a scheme monitoring programme such as Visa's VAMP. Any exception must be explained.
5. Website compliance checklist
Acquirers review the website before they approve it. Check these before the file is sent, because a missing page is the easiest thing to fix and the most annoying reason to be declined:
- Terms and conditions, privacy policy and cookie consent. Visible, specific to the business and matching the legal entity.
- Refund and delivery policies. Clear, findable from the checkout.
- Legal business information. Company name, registration number and address on the site.
- Transparent pricing. The full cost shown before checkout, including subscription terms.
- Age restrictions. Where the product requires them.
- Descriptor clarity. The billing descriptor should be recognisable from the brand, which reduces "I don't recognise this charge" chargebacks.
6. Declaration and submission
Finish with a signed declaration from an authorised person that the information is true and complete. Then review the file yourself before it goes anywhere: confirm the business identity behind the website, check the ownership chain and look for risk flags. A file that has been pre-reviewed gets a faster answer.
How to collect it without the email chase
The fastest onboarding teams give each merchant one private link with the whole application and document upload in one place, show the merchant how far they have got, and get an alert when documents arrive instead of checking an inbox. That is how merchant onboarding works in Merchant Scanner: every section and document is tracked, the team is emailed when the merchant opens the link, uploads or submits, and the finished file moves straight into identity review, risk assessment and acquirer matching.