What is Know Your Customer?
Also: KYC, KYB
Regulated identity-verification of the merchant (KYB) and, where relevant, the merchant's customers (KYC).
Know Your Customer (KYC) is the mandatory regulatory process used by financial institutions, including acquirers and payment providers, to verify the identity, suitability, and risks involved with maintaining a business relationship.
In the context of merchant acquiring, the process is more accurately termed Know Your Business (KYB), where the acquirer performs due diligence on the merchant entity itself.
This involves verifying the company's legal status, operational address, and corporate structure using official documentation like a Certificate of Incorporation and registry extracts.
A critical part of KYB is identifying and verifying the Ultimate Beneficial Owners (UBOs), typically individuals who own or control over 25% of the company, and any Politically Exposed Persons (PEPs).
This is a strict requirement under Anti-money laundering frameworks like the EU's 6th Anti-Money Laundering Directive (6AMLD) and the UK's Money Laundering Regulations 2017.
A common misunderstanding is that KYC/KYB is a one-time check at onboarding. In reality, regulated entities must perform ongoing monitoring, which includes periodic reviews of the merchant's information and real-time transaction monitoring to detect activity that is inconsistent with the business's expected profile.
If a merchant operates in a high-risk sector such as iGaming or financial services, they are also obligated by card scheme rules and local laws to perform KYC on their own end customers.
This ensures the merchant is not facilitating transactions for sanctioned individuals or those from prohibited jurisdictions.
The depth of due diligence, from Simplified (SDD) to Enhanced (EDD), is determined by the risk profile of the merchant's industry, jurisdiction, and transaction patterns, directly influencing their approval for a merchant account (MID) and the commercial terms offered.
Worked example
A new UK-based e-learning company selling courses on financial trading applies for a merchant account with Cardflo. The KYB process begins.
The company submits its Companies House registration number, VAT number, and a corporate bank statement. For its two directors, each holding 50% equity (making them both UBOs), they must provide government-issued photo ID (passports) and proof of address (a recent utility bill).
Cardflo's compliance team uses electronic verification systems to check these against databases, a process taking approximately 48 hours.
However, one director is flagged as a former low-level government official from another country, classifying them as a PEP. This automatically triggers Enhanced Due Diligence (EDD).
The acquirer now requests further evidence, including a detailed CV and information on the director's source of wealth. This adds three working days to the onboarding process, bringing the total time to five working days.
The acquirer's costs for the EDD check, approximately £150, are absorbed into the overall account setup and pricing structure. Successful completion results in MID activation; failure would lead to rejection.
Scheme notes
While specific KYC identity verification requirements are dictated by national and regional laws (e. g. , AMLD6 in the EU), card schemes like Visa and Mastercard mandate that their acquiring partners comply with all such regulations.
Scheme rules like Mastercard's Business Risk Assessment and Mitigation (BRAM) and Visa's Global Brand Protection Program hold acquirers financially liable for onboarding merchants engaged in illegal activities or actions that damage the scheme's brand. Fines for non-compliance can exceed $100,000 per merchant.
The schemes do not specify which documents to collect but require acquirers to have a robust Customer Due Diligence programme capable of accurately risk-assessing merchants, particularly those in high-risk MCCs like 5967 (Direct Marketing) or 7995 (Betting/Gaming).
Failure to do so can jeopardise an acquirer's licence to operate as a Principal member.
Why it matters for merchants
For a merchant, an inefficient KYB process directly translates to delayed revenue, as they cannot begin processing payments until a MID is approved and live. Providing incomplete or inconsistent documentation is a primary cause of onboarding delays, pushing go-live dates back by weeks.
For businesses deemed higher risk, a thorough KYB process is a prerequisite for being accepted by specialist acquirers. At Cardflo, our streamlined KYB onboarding, which utilises electronic verification and a dedicated compliance team, is designed to accelerate this process.
This allows merchants to activate MIDs across our global acquirer network faster, reducing the time-to-market and administrative burden, which is particularly critical for businesses scaling internationally.
Frequently asked
What documentation is typically required for merchant-level KYC?
Acquirers generally require government-issued identification for all significant shareholders, proof of corporate registration, and evidence of a physical operating address. Financial statements or bank letters may also be requested to assess the risk of insolvency and potential chargeback liability before issuing a MID.
How does KYC impact transaction monitoring and risk management?
The data collected during KYC establishes a baseline for expected transaction volumes and typical consumer profiles.
If a merchant's processing patterns deviate significantly from the verified business model, the acquirer’s risk systems may flag the activity for manual review or trigger a request for updated KYC documentation to justify the change in risk profile.
What is the difference between CDD, EDD, and SDD in the KYB process?
Customer Due Diligence (CDD) is the standard verification process for all merchants. Enhanced Due Diligence (EDD) is triggered for high-risk profiles, such as merchants in high-risk industries, those with complex ownership structures, or when a Politically Exposed Person (PEP) is involved.
It requires more in-depth investigation into the source of wealth and funds. Simplified Due Diligence (SDD) may be applied in very low-risk scenarios, such as for publicly listed companies in reputable jurisdictions, although this is becoming less common.
How often is ongoing monitoring performed after my account is approved?
Ongoing monitoring is continuous. Automated systems analyse transaction patterns 24/7 for anomalies.
Additionally, periodic reviews of your business information are typically conducted on a risk-basis, usually annually for low-risk merchants and more frequently for high-risk ones. A significant change in your transaction volume, average ticket size, or chargeback ratio can also trigger an ad-hoc review.
Why does my acquirer need to identify Ultimate Beneficial Owners (UBOs) with over 25% ownership?
The 25% threshold is a standard legal requirement set by international Anti-money laundering regulations, including the EU's 4th and 5th AML Directives. It defines a level of ownership or control that is considered significant enough to warrant identity verification.
This is to prevent anonymous individuals from using corporate structures to launder money or finance illicit activities. Some acquirers may adopt a lower threshold, such as 10%, for very high-risk industries.
What happens if a Politically Exposed Person (PEP) is identified in my company's structure?
The identification of a PEP does not mean an automatic rejection. However, it mandates that the acquirer perform Enhanced Due Diligence (EDD) as required by law.
This involves collecting additional information to understand the person's source of wealth and funds and assessing any potential risk of corruption or bribery. The merchant account will be subject to closer and more frequent ongoing monitoring if approved.
I was asked to provide a business plan during KYB. Why is this necessary?
A business plan helps the acquirer's underwriting team understand your business model, marketing methods, and expected transaction patterns, including volume, ticket size, and geographical spread. This information is used to set appropriate risk monitoring parameters for your merchant account.
For new businesses or those in high-risk verticals like subscriptions or travel, a convincing business plan is crucial for demonstrating legitimacy and mitigating the acquirer's risk, which could otherwise lead to rejection or a high reserve requirement.
See how Know Your Customer plays out in practice
Industries and regions where this term drives real acquiring, routing, or dispute decisions.
Related terms
The regulatory regime that obligates payment institutions to detect and report suspicious activity.
The licensed bank or financial institution that holds the merchant's MID and settles card transactions on the merchant's behalf.
Onboarding due diligence on a legal entity: incorporation, licences, UBOs, sanctions, and business model, mandated for acquirers under AML rules.
A unique identifier issued by an acquirer that ties transactions to a specific merchant account.
Related guides.
Ready to improve your payments setup?
Tell us about your business. We'll match you with the right acquiring partners and the right route, typically inside a week.