KYB for merchant onboarding: what a PSP must verify

Key takeaways

• In acquiring, the merchant is your customer; for payment initiation services, the AMLR says so explicitly (Art. 19(6)(d)).

• Verify before the relationship starts (Art. 23(1)); an account may be opened earlier only if no transactions run until the customer and beneficial owners are verified (Art. 23(3)).

• Beneficial owners hold 25 % or more or control the merchant by other means (Arts. 51 to 53); consult the central register and report discrepancies (Arts. 22(7) and 24).

• Check sanctions, including ownership of more than 50 % by sanctioned persons (Art. 20(1)(d)).

• Understand the business model and expected volumes (Arts. 20(1)(c) and (e), 25).

• If you cannot complete due diligence, do not onboard, keep a record, and consider a report (Art. 21).

Who is the customer?

In merchant acquiring, the payment service provider contracts with the payee "to accept and process payment transactions, which results in a transfer of funds to the payee" (Directive (EU) 2015/2366, Art. 4(44)). The merchant is therefore the customer for anti-money-laundering purposes. For payment initiation services the AMLR states it directly: in relation to those services, the merchant is the customer (Art. 19(6)(d)).

Most merchants are legal entities, so merchant onboarding is KYB: customer due diligence applied to a company and the people behind it.

What to verify

1. The legal entity

Identify and verify the merchant (Art. 20(1)(a)). The minimum information is set by Art. 22(1)(b): legal form and name; registered office and, if different, principal place of business, and country of creation; the names of the legal representatives; where available, the registration number, tax identification number and Legal Entity Identifier; and anyone holding shares or a directorship as a nominee. When the relationship starts, collect valid proof of beneficial-ownership registration or a recent register excerpt (Art. 23(4)).

2. The people who act for it

Verify that anyone acting for the merchant — the person signing the contract or operating the account — is authorised to do so, and identify and verify them (Art. 20(1)(i)). Identity is verified with an identity document, passport or equivalent together with reliable and independent sources where relevant, or with electronic identification at eIDAS assurance level "substantial" or "high" (Art. 22(6)).

3. Beneficial owners and the control structure

Identify the beneficial owners and take reasonable measures to verify them, so that you understand the ownership and control structure (Art. 20(1)(b)). Ownership means 25 % or more, directly or indirectly, calculated by multiplying along each chain (Art. 52(1)); control by other means — voting agreements, board-appointment rights, vetoes, nominee arrangements — is examined in parallel (Arts. 51 and 53). Consult the central register as part of verification (Art. 22(7)) and report any discrepancy within 14 calendar days (Art. 24). See Beneficial-ownership verification in the EU.

4. Sanctions exposure

Check whether the merchant or its beneficial owners are subject to targeted financial sanctions, and whether sanctioned persons control the merchant or own more than 50 % of it, individually or collectively (Art. 20(1)(d)). A possible match is not a result: it needs identifiers to confirm or exclude it.

5. Politically exposed persons

Determine whether a beneficial owner is a politically exposed person, a family member or a close associate (Art. 20(1)(g)). If so, senior management must approve the relationship, the firm must take adequate measures to establish the source of wealth and source of funds, and monitoring is enhanced (Art. 42(1)).

6. What the business does, and what it will process

Understand the nature of the merchant's business (Art. 20(1)(e)) and the purpose and intended nature of the relationship (Art. 20(1)(c)). Art. 25 lists what to obtain where necessary: the purpose and economic rationale, the estimated amount of activity, the source and destination of funds, and the business activity. For e-money issuers distributing through merchants, EBA Guidelines EBA/GL/2021/02 (paragraph 10.9) add a useful test: understand the nature and purpose of the merchant's business, satisfy yourself that its goods and services are legitimate, and, for an online merchant, understand the type of customers it attracts and the expected volume and size of transactions.

7. Its public footprint

A merchant's website and public reporting are evidence about its business: whether what it sells matches what it declared, and whether the goods and services are legitimate. Many acquirers also review the website against their own acceptance policy. Adverse media is a reputation risk factor in EBA/GL/2021/02 (Guideline 2): firms should assess whether allegations of criminality are reliable and credible, noting that "the absence of criminal convictions alone may not be sufficient to dismiss allegations of wrongdoing".

8. The risk rating, and the level of due diligence

Set the extent of due diligence by an individual risk analysis (Art. 20(2)). Higher-risk indicators in AMLR Annex III include cash-intensive businesses, an unusual or excessively complex ownership structure, nominee shareholders or bearer shares, and entities without real economic activity in their jurisdiction. Higher risk requires enhanced measures (Art. 34); demonstrably lower risk may allow simplified ones (Art. 33).

Timing: before the first transaction

Verification of the customer and its beneficial owners takes place before the relationship is established (Art. 23(1)). It may be completed during establishment only where necessary not to interrupt normal business and where risk is low (Art. 23(2)). A credit or financial institution may open an account earlier only with safeguards ensuring that no transactions are carried out until the customer and beneficial owners are verified (Art. 23(3)).

When verification fails

If due diligence cannot be completed, the firm must refrain from establishing the relationship, terminate an existing one, and consider reporting to the financial intelligence unit (Art. 21(1)). How the merchant is told matters: disclosing that a report is being considered is prohibited (tipping-off, Art. 73).

What to keep as evidence

Keep a record of the due diligence actions, the decisions and their justifications — including refusals (Art. 21(3)) — for five years after the relationship ends or the refusal (Art. 77). In practice, each conclusion in the file should say what was checked, against which source, when, and with what result.

A worked example (fictional)

Kestrel Home Goods BV is a fictional online retailer of kitchenware applying for card acquiring.

• Entity: the company register excerpt confirms the name, legal form, registered office and two directors.

• Ownership: one director holds 60 % directly and is a beneficial owner, both through ownership and through control (more than 50 %, Art. 53(2)(c)). A holding company holds the other 40 %; it is owned in equal halves by two other persons, whose indirect interests are 40 % × 50 % = 20 % each — below the 25 % ownership threshold. The file must still check whether a shareholders' agreement gives the holding control of Kestrel by other means, such as relevant veto rights or the right to appoint or remove a majority of the board (Art. 53(3)). If it does, anyone holding 25 % or more of the holding is also a beneficial owner (Art. 54(b)) — here, both of its owners.

• Sanctions: a possible match on the second director's name is resolved by date of birth and nationality: not the listed person. The resolution and its identifiers go into the file.

• Business: the website sells kitchenware, with terms, a returns policy and contact details consistent with the register. Expected volume is consistent with the declared turnover.

• Outcome: standard due diligence; the officer approves with every conclusion and its source on file.

Change one fact — the holding sits in a jurisdiction with no accessible register and its owners cannot be established — and the same file leads to enhanced scrutiny and, if the owners behind the holding still cannot be established, to refusal and consideration of a report (Art. 21).

Frequently asked questions

Is a register excerpt enough to verify a merchant?

It is the usual starting point, and Art. 23(4) requires proof of beneficial-ownership registration or a recent excerpt. Whether it is enough depends on the risk. AMLA's regulatory technical standards under Art. 28(1)(d) will specify the reliable and independent sources that may be used; on AMLA's overview of 28 September 2026 they were still in draft.

Do we have to verify every director?

Art. 22(1)(b) requires the names of the legal representatives. Art. 20(1)(i) requires the identity of anyone acting for the merchant to be verified. Beneficial owners are verified under Art. 20(1)(b) and Art. 22(7). Your risk assessment decides how far to go beyond that.

What if no one owns 25 % or more?

Examine control by other means (Art. 53). If no beneficial owner can be identified after exhausting all means, record that fact and identify and verify the senior managing officials (Art. 22(2)).

How often must merchant files be refreshed?

At least every year for higher-risk customers under enhanced due diligence and every five years for others, and earlier when circumstances change (Art. 26(2) and (3)).