How payment processors review a merchant

When you apply to take card payments, the payment processor reviews your business before and after it agrees to support you. This is often called underwriting. The processor is deciding whether it can support what you sell, how much risk your business carries, and on what terms. The review is not a single gate you pass once. Processors keep reviewing accounts while they process for them.

This page explains what is usually reviewed, in plain terms, using Stripe's published support pages and Visa's public rules. Every processor has its own process and makes its own decisions.

Why processors review merchants at all

Card payments pass through a chain of institutions. The card networks set rules for the banks that take part, and those banks pass obligations on to the merchants they support, directly or through a processor.

Visa's public rules give a sense of what is expected. Before contracting with a merchant, an acquirer or payment facilitator must carry out an adequate due diligence review to make sure it submits only legal transactions. Visa's merchant qualification standards also say a prospective merchant must be financially responsible, not engaged in activity that could harm the Visa system or brand, operating within an allowed jurisdiction and not misrepresenting its location.

Stripe summarizes its own checks in three parts: business identification and bank account information, the supportability of what you sell, and the overall risk level of your business. Stripe says these checks are intended to prevent abuse of the financial system, among other aims.

Identity and ownership

The processor needs to know who you are. Stripe lists business identification, including your address and website ownership, and bank account information among the first things it verifies. In practice that means your legal business name, registration details, address, website and bank account.

If a processor cannot verify your business automatically, it may ask for documents. Stripe's guidance says business documents must show the business name, address and a company registration or VAT number, and those details must match your account. Documents should be current, legible and uploaded through the Dashboard rather than sent by email. The page on responding to a processor information request covers this in more detail.

Business model and what you sell

Supportability is about what you actually sell and to whom. A reviewer wants to understand:

• Your products, described accurately and in full.
• Your buyers: consumers, businesses, research institutions or a mix.
• How you sell: your own site, marketplaces, invoices, wholesale.
• How funds flow, and whether any third parties are involved in fulfillment.
• Where you ship from and to.

Describe this exactly as it is. The processor will compare your description with your website and your transactions. Card networks also rely on an accurate description: Visa's rules require an acquirer to assign the merchant category code that most accurately describes the merchant's business. The page on what a merchant category code is explains how those codes are used.

Your website

For an online business, the website is the main evidence of what the business does. Reviewers read it the way a customer would, and they read the parts customers skip. Expect them to look at:

• Product pages, including descriptions, images, claims and reviews.
• Blog posts, FAQs and any linked content.
• Policies: terms, refunds and returns, shipping and privacy.
• Contact details and the business identity shown on the site.
• Checkout text and what it asks the buyer to confirm.

Visa's rules set some baseline requirements for e-commerce merchant websites, including customer service contact details, the merchant's country shown during checkout, an address for cardholder correspondence and a policy for delivery of multiple shipments.

For research-use-only suppliers, the core question is whether the site reads as laboratory supply for qualified buyers, consistently, on every page. The guide to preparing your storefront for a processor review walks through the main areas.

Financial health and processing history

Processors also assess credit risk: the chance that they will have to cover refunds or disputes your business cannot pay. Stripe's credit review guidance says it may ask for:

• Updated financial information, such as bank balances, transaction history, financial statements and management accounts.
• Details of your business model, funds flow and vendor relationships.
• Information on how operations are managed and your recent processing history.
• Evidence of clear customer information, including contact details and refund, cancellation and delivery policies.

Ongoing monitoring

Stripe states that it reviews accounts continuously, with the frequency depending on risk signals in day-to-day activity. The signals it lists include elevated dispute activity, elevated refund rates, longer delivery windows, long billing periods and sharp increases in volume. On dispute activity, Stripe's guidance says accounts above a 0.75% dispute rate are considered high risk.

A review can end with no change. It can also lead to different terms. Stripe's guidance says higher-risk businesses may have a portion of each transaction held in reserve, and that in rare cases it may close an account. See reserves and payout holds, explained.

Verification is not a one-time step either. Stripe's guidance says that if it cannot confirm at any point that a business meets its requirements, it may ask for more information or ask the business to fix the problem. Treat a page you add next month as something a reviewer may read, just like the pages that existed when you applied.

What you control, and what you do not

You control the accuracy of what you tell the processor, the consistency between your description and your website, how quickly and completely you answer questions, and how well your controls work in practice. You do not control the decision. A processor may decline to support a business even when every answer is accurate and complete. If that happens, the right response is to accept it and not to reapply under a different description or entity.

Claddr is compliance software, not a processor, and it does not take part in a processor's review. It records controls such as buyer checks, signed attestations and order holds, and lets a merchant export that record for a date range if a processor asks how the controls work.

Questions to ask yourself before a review

• Would a stranger reading your site understand who you sell to and what you sell?
• Does your application describe the business exactly as your site does?
• Do your policies say what your checkout and fulfillment actually do?
• Can you show records of the controls you say you run?
• Do you know who in your business answers processor questions, and how fast?

If you are unsure whether your business model raises legal questions, speak to a qualified lawyer about your business before you apply.