TL;DR: KYB solutions for payment processors have to underwrite the merchant, the people who control it, and the activity that actually clears. In the Merchant Risk Council's 2026 survey of 1,278 merchants, the share of accepted orders that later proved fraudulent rose from 3.0% to 3.5%. A file that is complete on approval day and never reopened misses the change in owners, goods, or volume that creates the loss.
What the Underwriting File Has to Hold
A processor buys a KYB tool because someone has to decide who may clear cards or move funds on the processor's books, or on a sponsor bank's books. The legal name on a state filing is one input. The file also has to say what the business sells, who can direct it, where settlement lands, and whether another acquirer already cut off the same principals. A full KYB program covers the entity. Merchant underwriting is that program plus a scheme decision and a credit decision.
Four checks have to agree. The application states the legal name, the category, the expected volume, and the owners. A registry source confirms the entity is active. Screening covers sanctions, politically exposed persons, and adverse media. A scheme and credit pass covers terminated-merchant history and whether settlement lands in the merchant's name. Visa's Acceptance Risk Standards, in the October 2024 Ecosystem Risk Programs guide, also expect beneficial-owner research, domicile, and negative-news scanning at onboarding. When those checks live in separate portals, the approver becomes the integration, and the workbook goes stale the day the website changes.
Three parties can share a vendor and still need different files.
Before an acquirer signs, Visa requires a check of internal terminated and declined lists and of the Terminated Merchant File, including the Visa Merchant Screening Service, using the legal entity, contacts, and owner details. On a possible match, the acquirer confirms it is the same party, asks the listing acquirer why the name is there, and decides with credit reports and registries alongside the rest of the file.
A payment facilitator boards sub-merchants under its own master merchant. Visa treats the acts and omissions of a sponsored merchant as those of the facilitator, and the facilitator's acts as those of the acquirer. The facilitator must contract with each sponsored merchant and be able to name the principals and their country of domicile.
The sponsor bank sits one layer above both. FinCEN's customer due diligence rule binds covered financial institutions, including federally regulated banks. Most processors sit outside that rule's own text. They still collect owner information because the bank's program reaches the merchants they board. A processor that also transmits funds can pick up a separate set of duties, the ones described in MSB AML compliance requirements, on top of the card-network file.
The Loss Shows Up After Approval
The Merchant Risk Council, with Visa Acceptance Solutions and Verifi, fielded its 2026 Global eCommerce Payments and Fraud Report from November to December 2025. Among 1,278 merchant professionals, the fraud rate by order rose from 3.0% to 3.5%. Ninety-eight percent reported at least one fraud attack in the prior twelve months. Sixty-four percent reported increasing first-party misuse. For a processor, that is loss on live volume, after the application is already approved.
Visa puts monitoring on the same clock as boarding. Acquirers must watch the portfolio from the day the merchant goes live until the relationship ends: transaction velocity, sudden contact-detail changes, authorization spikes, sales-volume shifts, a change in the card-present mix, and cross-border discrepancies. The standard asks for a baseline of normal daily activity, kept current, and a comparison of the latest day against that baseline. Sanctions screening, politically exposed person checks, derogatory media, and license monitoring sit in the same control.
Banks already run a version of that baseline. FinCEN's CDD FAQs say the nature and purpose of the relationship, gathered when the account opens, is the line later activity is judged against. If wires, deposits, or volume move away from what the customer described, risk-based monitoring can require an update to customer information, including who owns the entity. On February 13, 2026, FinCEN granted exceptive relief so a covered institution can limit a fresh ownership check to the first account, to any later moment when facts call the earlier information into question, and to whatever its own ongoing due diligence requires.
Ownership is where a one-time check goes stale first. 31 CFR 1010.230 treats each individual who directly or indirectly owns 25% or more of the equity as a beneficial owner, and requires one individual with significant responsibility to control, manage, or direct the entity. Walking that through holding companies is the actual work. A merchant that applied as a single-member LLC can be majority-owned by a new holding company six months later, with the original applicant left as a manager on the paperwork.
The goods drift the same way. Visa expects acquirers to review URLs, products, delivery methods, and links that send cardholders elsewhere. A supplement site that later clears for an undisclosed pharmacy will not show up in a secretary-of-state feed, and a screenshot taken once will not catch it.
Volume can force a change in the legal relationship itself. An acquirer that sponsors a payment facilitator must put a direct merchant agreement in place with any sponsored merchant whose annual transaction volume exceeds $1 million. The duty covers a new application already over the line, and an existing sponsored merchant at renewal or within two years of crossing it, with further exceptions by category and tenure in the Visa rules. A KYB system that cannot see volume against that line will leave the contract on the wrong party.
Sponsor banks read the same file with a different question. Oversight of a processor or fintech partner turns on whether the firm can show who was approved, on what evidence, and what happened when the business changed. A score without the registry extract, the ownership path, and the alert that reopened the case is a thin exhibit in an exam.
FATF Recommendation 10, in the standards updated through February 2025, asks financial institutions to identify the customer and the beneficial owner, understand the purpose of the relationship, and keep due diligence current so later transactions still match that knowledge. Each country writes that standard into its own rules, with its own threshold and its own refresh trigger.
What to Test Before the Next Cohort
Judge a KYB solution by the file an examiner, a sponsor bank, and a scheme review can replay six months later. A tool that cannot reopen the case is a boarding form with an API.
Where Sphinx Fits
Sphinx sits on the review that starts once registry data, scheme results, and monitoring alerts are already in hand. Agents assemble the entity, the owners, the screening hits, and the change in activity into one case, with the evidence attached, so analysts spend time on mismatches. Teams using Sphinx have seen 87% fewer false positives and resolve 98% of cases the same day.
Frequently Asked Questions
Does a payment facilitator have to verify every sub-merchant?
Visa's Acceptance Risk Standards treat the acts and omissions of a sponsored merchant as those of the payment facilitator, and the facilitator's acts as those of the acquirer. The facilitator has to contract with each sponsored merchant and be able to name the principals. Once a sponsored merchant's annual transaction volume exceeds $1 million, the acquirer must hold a direct merchant agreement with that merchant, subject to the category and tenure exceptions in the Visa rules.
Is beneficial ownership collected at onboarding enough?
FinCEN's CDD rule binds the sponsor bank, and it requires risk-based ongoing monitoring plus updates when activity no longer matches the stated purpose of the relationship. The February 13, 2026 exceptive relief lets a covered institution skip a fresh ownership check at every later account opening. The same order still requires a refresh when facts call the old information into question, or when the institution's own ongoing due diligence says the file needs it.
What ownership line applies to a US merchant entity?
Under 31 CFR 1010.230, a covered institution identifies each individual who owns 25% or more of the equity, directly or indirectly, and one individual with significant responsibility to control, manage, or direct the entity. A processor can set a stricter line in its own policy, and card-network underwriting still asks for those principals by name so the scheme file and the bank file describe the same people.
What should reopen a merchant file after go-live?
Visa requires acquirers to watch sales volume, contact details, the mix of card-present and card-absent sales, and cross-border activity, and to compare that activity with a baseline. A URL change, a new product line, or a spike the original application never described is a reason to reopen ownership, sanctions, and the description of the business. A calendar review with no trigger will miss the merchant that changed quietly between cycles.
How is underwriting different from a registry KYB check?
A registry match and a sanctions screen confirm that an entity exists and is not listed. Underwriting also asks whether the goods on the website match the merchant category, whether the principals appear on a terminated-merchant file, and whether settlement instructions belong to that entity. A solution that stops at the registry leaves the scheme and credit decision in a second system, which is where the file goes stale.
.png)
