Merchant onboarding looks simple from the outside.

A business submits its details, uploads a few documents, completes verification and gets approved. But anyone who has managed merchant onboarding at scale knows that the real process is rarely this straightforward.

A merchant may have a valid GSTIN but questionable business details. A company may be legally registered but have inconsistencies in its ownership information. A bank account may exist, but not belong to the business being onboarded. And sometimes, everything looks legitimate during onboarding only for the risk to emerge several weeks later.

For fintechs and payment platforms, this creates a difficult balance.

Onboarding needs to be fast enough to keep legitimate merchants from dropping off, while being thorough enough to identify fraud, compliance risks and businesses that don’t meet the platform’s requirements.

A well-designed merchant onboarding checklist helps create that balance.

Instead of treating onboarding as a document collection exercise, businesses can use a structured process that verifies the merchant’s identity, business existence, ownership, financial information and risk profile before activation.

What is merchant onboarding?

Merchant onboarding is the process of collecting, verifying and assessing information about a business before allowing it to use a fintech, payment or financial service.

Depending on the business model, onboarding may involve:

• Business registration verification
• GST verification
• PAN verification
• KYC of business owners or authorised signatories
• Bank account verification
• Address verification
• Beneficial ownership checks
• Sanctions and watchlist screening
• Fraud and risk assessment
• Document verification
• Business activity assessment

The exact requirements vary by product, regulatory framework and risk appetite.

A small marketplace seller, for example, may require a different level of due diligence than a large enterprise accepting high-value payments.

That’s why a good onboarding process should be risk-based rather than identical for every merchant.

Merchant onboarding checklist: 10 checks to include

1. Collect the right merchant information

The first step is getting the basic information right.

At minimum, depending on the merchant type, this may include:

• Legal business name
• Trade name
• Business constitution
• PAN
• GSTIN, where applicable
• Registered address
• Business address
• Contact details
• Bank account details
• Business category
• Expected transaction volume

For companies and LLPs, additional information about directors, partners and authorised representatives may also be required.

The important point is to avoid collecting information simply because it has always been part of the form.

Every data field should serve a purpose in verification, risk assessment or compliance.

2. Verify that the business actually exists

A merchant’s application should not be accepted solely because it has submitted registration documents.

The business itself needs to be verified.

Depending on the merchant structure, this can include checking government or authoritative business records for company registration, LLP details, GST registration or other relevant registrations.

For Indian businesses, GSTIN verification can provide useful information such as the registered legal name, trade name, registration status and other available registration details.

The objective is straightforward:

Does the business information provided by the merchant correspond to a real and active business registration?

This is one of the foundational checks in any merchant onboarding process.

3. Verify PAN and GST details

Tax identifiers are useful identity signals, but they should not be treated as standalone proof of legitimacy.

Check whether the PAN belongs to the stated entity or individual and, where GST registration is applicable, verify the GSTIN.

More importantly, compare the results.

For example:

Merchant name ↔ PAN details

Merchant name ↔ GST legal name

GSTIN ↔ Registration status

Business address ↔ Available registration information

Small differences may be legitimate. A trade name can differ from a legal name, for example.

But unexplained discrepancies should trigger additional review before the merchant is activated.

4. Verify the people behind the business

A business is not just a registration number.

For companies, LLPs, partnerships and other structures, fintechs may need to understand who owns, controls or represents the business.

Depending on the applicable requirements, this can include verification of:

• Directors
• Partners
• Proprietors
• Beneficial owners
• Authorised signatories

Identity verification should be performed using appropriate and reliable sources.

This is particularly important because a legitimate business entity can still be used by individuals who present additional fraud or compliance risks.

Merchant KYB and individual KYC should therefore work together rather than operating as completely separate processes.

5. Verify the merchant’s bank account

Bank-account verification is another critical part of merchant onboarding, particularly for payment platforms where settlements will be made to the merchant.

The objective is not simply to confirm that the account exists.

You should establish whether the account is associated with the merchant or an authorised entity.

A mismatch between the business name and bank-account information doesn’t automatically mean fraud. Different account structures and legitimate naming differences can exist.

But unexplained mismatches should not be ignored.

For high-risk or high-value merchants, bank verification becomes even more important because settlement accounts can become a target for fraud and account takeover.

6. Check the merchant’s business activity

One of the most overlooked steps in merchant onboarding is understanding what the merchant actually does.

A merchant may be legally registered but operate in a category that presents unacceptable risk for a particular platform.

Ask:

• What does the business sell?
• Where does it operate?
• Who are its customers?
• What transaction volumes are expected?

Does its website or digital presence match the business activity declared during onboarding?

A mismatch between the stated business activity and the merchant’s actual online presence can be an important risk signal.

For digital-first businesses, checking the website, product catalogue or publicly available business information can provide valuable context before approval.

7. Screen for fraud and compliance risks

Verification establishes whether information is genuine.

Risk screening helps determine whether the merchant should be onboarded.

Depending on the platform and applicable regulations, screening may include sanctions, watchlists, adverse media, politically exposed person checks and other relevant risk databases.

Fraud signals should also be considered.

For example:

• Multiple merchant applications linked to the same contact information
• Repeated use of the same bank account
• Multiple businesses connected to the same device
• Unusual application velocity
• Inconsistent addresses
• Suspicious ownership patterns

No single signal should automatically determine the outcome in every case.

The strength comes from looking at multiple signals together.

8. Assign a risk category

Not every merchant presents the same level of risk.

A useful merchant onboarding process should therefore classify merchants based on factors such as:

Risk factor	What to consider
Business type	Industry and products/services offered
Ownership	Complexity and beneficial ownership
Geography	Countries or regions involved
Transaction profile	Expected value and volume
Identity	Verification results and inconsistencies
Compliance	Screening and regulatory indicators
Fraud	Behavioural and network-level signals

This can lead to a simple risk-based model:

Low risk: Standard onboarding

Medium risk: Additional verification or review

High risk: Enhanced due diligence or rejection

This approach helps compliance and operations teams focus their attention where it matters most.

9. Keep an audit trail

Merchant onboarding doesn’t end with an approval decision.

Fintechs should maintain a record of what information was submitted, which checks were performed, when they were performed and what decision was made.

This creates an audit trail that can be valuable during:

• Internal reviews
• Compliance audits
• Merchant disputes
• Fraud investigations
• Regulatory enquiries
• Account reviews

It also prevents teams from having to reconstruct the reasoning behind an onboarding decision months later.

10. Don’t stop verification after onboarding

This is perhaps the most important point in the entire merchant onboarding checklist.

A merchant that was legitimate at onboarding may not remain low-risk forever.

Business ownership can change. Bank accounts can change. Transaction behaviour can shift. A merchant may begin operating in a different category or geography.

That’s why merchant risk should be monitored throughout the relationship.

Periodic checks can include re-verification of business registration, GST status, key individuals, bank details and other relevant information.

Transaction monitoring and behavioural analysis can add another layer of protection by identifying changes that wouldn’t be visible through periodic document checks alone.

How to make merchant onboarding faster without making it weaker

The natural reaction to onboarding risk is often to add more checks.

But more checks don’t automatically mean better onboarding.

If every merchant is subjected to the same lengthy process, legitimate businesses may abandon the application before completing it.

A better approach is to combine automation with risk-based decisioning.

Basic information can be collected digitally. Business registrations and tax identifiers can be verified through APIs. Identity and bank-account checks can be automated. Risk signals can be evaluated automatically, while only exceptions are routed to manual review.

This creates a more efficient model:

Low-risk merchant → automated verification → faster approval

Potential risk → additional checks → manual review

High-risk merchant → enhanced due diligence or rejection

The result is not simply faster onboarding.

It is a better allocation of operational resources.

Final merchant onboarding checklist

Before activating a merchant, fintechs and payment platforms should be able to answer:

• Is the business legally registered?
• Does the GSTIN and PAN information match the merchant’s details?
• Is the registration currently valid where applicable?
• Have the relevant owners, directors or authorised representatives been verified?
• Does the settlement bank account correspond to the merchant?
• Does the merchant’s actual business activity match what was declared?
• Have relevant sanctions, watchlists and risk databases been checked?
• Are there unusual identity, device, contact or application patterns?
• Has a risk category been assigned?
• Is there a clear audit trail of the onboarding decision?
• Is there a process for ongoing merchant monitoring?

If several of these questions cannot be answered confidently, the merchant onboarding process probably has a gap.

The goal isn’t just to onboard merchants. It’s to onboard the right merchants.

For fintechs and payment platforms, merchant onboarding sits at the intersection of growth, compliance and fraud prevention.

Make the process too restrictive, and legitimate merchants struggle to get started.

Make it too relaxed, and the platform can inherit significant financial, operational and reputational risk.

The strongest onboarding systems don’t rely on a single document or verification check. They bring together business identity, individual identity, tax information, bank details, ownership, behavioural signals and risk intelligence to build a more complete picture of the merchant.

That is what a good merchant onboarding checklist should ultimately achieve.

Not more paperwork.

More confidence in every merchant you approve.