Every merchant answers the same seventeen questions before a single payment is taken, and keeps answering eleven of them for as long as the account stays open.
All seventeen, for every merchant, before a single payment. No step is waivable. A step that cannot be completed is recorded incomplete and the merchant is not boarded.
Full legal name, any DBA name, the state registration number and the federal tax identification number — each matched against the register of the state of formation, and the register page stored as it read on the day it was read.
Found: Registered in Utah, status active. DBA name matches the filing.
Visa Acceptance Risk Standards, Oct 2024Name, home address, government identification number, email and telephone for each principal and director. The identification document is matched to the address of record. The identification number is stored encrypted and only the last four digits are ever shown.
Found: Two principals identified, both documents matched to address.
Visa Acceptance Risk Standards, Oct 2024Anyone holding 25 percent or more is named. One person with significant responsibility to control the business is named. A holding company in the chain is followed through to a real person.
Found: 60 / 40 split, both named. No holding company in the chain.
Visa Acceptance Risk Standards, Oct 2024 · 31 CFR 1010.230The business licence, certificate of existence or registration certificate.
Found: Certificate of existence obtained and stored.
Visa Acceptance Risk Standards, Oct 2024The business, every named owner and the named control person are screened against the Specially Designated Nationals list and the other lists administered by the Office of Foreign Assets Control. Re-screened at every file refresh and on any change of ownership. A possible match is cleared by a named person, never by software.
Found: No matches.
31 CFR Ch. V (OFAC)Credit history and financial statements are read, and the conclusion and the documents relied on are recorded. A business with no operating history is recorded as such and given the matching risk tier — it is not declined for that reason alone.
Found: Four years in business. Statements reviewed.
Visa Acceptance Risk Standards, Oct 2024 · OCC Bulletin 2006-39A limit per single payment, per day and per month, sized to the expected activity recorded at step 14 and the financial condition at step 6. Limits are enforced before a payment instruction is sent, not after.
Set: $2,500 per payment · $20,000 per day · $180,000 per month.
Nacha 2.2.3The business plan, every customer-facing address, the goods offered, how they are delivered and the refund policy. We confirm the site shows a refund policy, delivery terms, a customer service contact and the business name — and store the site as it read that day.
Found: All four present. Site stored.
Visa Acceptance Risk Standards, Oct 2024Each business address must be a real place of business — not a mail drop and not a commercial mail receiving agency. Confirmed against the state filing and one independent source.
Found: Warehouse and retail counter confirmed at the filed address.
Visa Acceptance Risk Standards, Oct 2024The code is assigned, then tested against the published high-integrity-risk codes — 5122, 5912, 5966, 5967, 5993, 7273 and 7995 for card-absent transactions. On a card rail those require the acquirer to be registered and approved before submitting any transaction. A code is never inferred from what a business sounds like.
Found: 5941, sporting goods. Not on the high-integrity-risk list.
Visa Merchant Data Standards Manual, Apr 2026 · Visa Core Rules 1.9.5.1Our list is held no wider than the sponsoring institution's own list, so no merchant is ever boarded in a segment that institution would not board directly.
Found: No line of business on either list.
Nacha risk guidanceInternal lists and the external terminated merchant databases, including MATCH, are searched before any agreement is signed — on the legal name, the DBA name, each owner and each owner identification number. A hit goes to the compliance officer and the listing acquirer is contacted before any decision is made.
Found: No listing on any name searched.
Visa Acceptance Risk Standards, Oct 2024 · Mastercard SPME §7.1.1News, state and federal enforcement notices, court dockets and other public sources, for the business and for related parties. What was searched, when, and what was found is recorded.
Found: One small-claims matter, closed 2023. Read and recorded.
FinCEN FIN-2014-G001Expected monthly payment count, average and maximum value, buyer geography, seasonality and product mix — written down. Every later alert is measured against this. A file without a baseline cannot be approved.
Recorded: ~900 payments a month, $140 average, $2,400 maximum, US only, autumn peak.
FinCEN FIN-2014-G001Standard, Elevated or High. The tier sets how often the file is refreshed, how often the website is re-read, the exposure limits, and how often any licence is verified.
Assigned: Standard — file refreshed annually, website re-read by an agent bi-monthly; any modifications adding risks are assessed, recorded.
Visa Acceptance Risk Standards · FFIEC BSA/AMLSigned before any payment is processed, and it must carry: compliance with law and with the payment rules; a bar on submitting transactions for anyone other than the merchant itself; a bar on illegal transactions; our right to obtain records and evidence of authorisation on demand; the right to suspend on a licence lapse; and the notification duties.
Executed: All seven mandatory terms present.
Visa Acceptance Risk Standards · Nacha 2.2.2.2A written declaration of whether the merchant transmits payment instructions on behalf of anybody else. Any such arrangement must be disclosed to the sponsoring institution before a single entry is transmitted, and an undisclosed one is a termination event.
Declared: No. Sells only its own goods.
Nacha 2.17.3Boarding is not the end of it. These eleven terms sit in the merchant agreement, so a breach has a consequence rather than a conversation.
| The merchant must | What a breach does | Class |
|---|---|---|
| Keep return rates within the published thresholds | A written reduction plan within 30 days, then 180 days of monitoring. Continued breach goes to the rules enforcement panel, which may fine and may direct suspension. | Stop |
| Keep card dispute and fraud ratios within the published thresholds | Monthly assessments begin and escalate. Getting out requires three consecutive months below the threshold. Excessive chargebacks and excessive fraud are each their own termination-database reason code. | Stop |
| Submit no transactions on behalf of any other party | Immediate termination for transaction laundering, and a database listing within five days of the decision. The listing sits for five years, then purges automatically. | Out |
| Sell only what it declared | An undeclared product line raises the tier and triggers re-underwriting. A prohibited one is a termination event and a listing. | Watch |
| Stay within its exposure limits | Payments above a limit are refused before an instruction is sent. Repeatedly approaching a limit triggers re-underwriting — not an automatic increase. | Watch |
| Disclose any nested arrangement in advance | Transmission stops until it is disclosed. One discovered rather than declared is a termination event. | Stop |
| Notify changes of ownership | A new 25 percent holder who has not been identified cannot be sanctions-screened. Until they are, the tier is raised and limits are cut. | Watch |
| Stay clear of adverse information | Press or complaint material raises the tier and requires a documented human read. An enforcement action or a criminal charge against the business or a principal is a termination event. | Watch |
| Produce evidence of authorisation within 10 banking days | Otherwise the return must be accepted. An authorisation whose name does not match the account holder is treated as no authorisation at all. | Stop |
| Keep consumer complaints within expectation | A rising rate raises the tier and pulls the next review forward. A repeating pattern is treated as a defect in the merchant's practices, not as noise. | Watch |
| Not offer collateral instead of fixing a return rate | Security is never accepted as a remedy for a return rate. Only the rate coming down is. | Watch |
| How often | What |
|---|---|
| Every payment | Confirm the account can cover the payment before an instruction is sent. This is the control that removes the need for a cash reserve. |
| Every payment | Screen the payment against the baseline recorded at boarding. |
| Continuous | Risk-based fraud monitoring procedures, reviewed and re-dated at least annually. |
| Continuous | Re-search the terminated merchant databases against merchants already boarded. |
| Continuous | Survey public complaint sources and log what is found. |
| Monthly | Re-read each merchant website against its boarding file — monthly, quarterly or annually by tier. |
| Monthly | Measure return and dispute ratios against the published thresholds, and measure how much of each exposure limit is being used. |
| Annually | Our own ACH rules compliance audit. It cannot be inherited from anyone else. Proof retained six years. |