Here is a list of the most common documents acquiring banks require to open a merchant account. Please have in mind that this list is for directional purpose and each acquiring bank has their own rules and list of documents they might request. We at CatalystPay will support you during the entire onboarding process and make sure it is a smooth and fast as possible.
Common Onboarding Documents required by Acquiring Banks1) Processing history / Business plan
The first thing to take into account is that acquiring banks require a processing history for the last 6 months and/ or a business plan (for start-ups). The banks generally require this information to analyze your performance as a merchant and to decide whether or not they can support your business.
Additionally, this processing history gives banks a better picture of the business, and it also allows us at CatalystPay, as the payment service provider, to negotiate better conditions for you as a merchant (such as lower prices, better settlement terms, etc.).
If your business doesn’t have a ready business plan, we can provide you with a template that serves as a guideline for the information that the acquiring banks would need (if you need this template, please contact us for assistance).
The main information needed by the bank is:
- Target markets of the business (percentage split per country);
- Minimum/ Average/ Maximum transaction values that could be paid through the website;
- Processing volume/ Forecast;
- Test credentials (if available).
If you can provide a processing history (for the applying entity or other owned company), you need to make sure it includes:
- Logo of the provider/ bank, which is needed to prove that the statement/screenshot is authentic;
- Company name;
- Website;
- Count of transactions;
- Processed gross volume for the last six months;
- Count of refund;
- Count of chargebacks (per month).
Pro tip: Avoid sending excel and csv exports, pdfs or screenshots are preferred. 2) Company documents / Extract (KYB):During this step, acquirers review and understand your company’s structure. For this to happen, you have to provide us with the company documents(s) or extract(s) that identify the following information:
- your company’s name, registration number and date of incorporation;
- legal representatives – directors, shareholders, UBOs (utility bills);
- the registered address (which is the principal place of doing business).
Some countries’ trade registers are open, which means that acquirers can search the records on their own. The general rule is that your company documents shouldn’t be older than six months, so in case some have already expired, acquirers can download new ones if needed. If this info is not easily accessed and free of charge, they would request new document (KYB) packs from the client. It is particularly important for you as a merchant to stick to the 6-month rule in order to avoid delays in the onboarding if the bank decides to request new copies.
Depending on the jurisdiction where the client is incorporated, the company document(s) might have a different name or requirement for certification (apostille, notary certification or non). If there’s a complex structure, a company structure diagram that identifies the involved parties and their roles in the company might be needed .
If there are trusts or other people representing your company, the Acquirer would need a Declaration of Trust or a Power or Attorney. It is important to note that some acquirers require to have their own declarations completed.
3) Company bank letter
In order for you to receive your settlements once you have started processing, you need to provide a company bank letter.
The best way to do it is to send the account confirmation as soon as possible, since a given acquirer might not be working with the bank in question or might not be supporting the currency of the account. This way, by sending it earlier in the process you could get a new bank account while moving forward with the onboarding procedure at the same time.
The bank letter should have the following information on it:
- Your legal name as a merchant and the registered address or incorporation number;
- IBAN/Account number for UK companies, SWIFT/BIC;
- Account currency;
- Date of document issuing;
- Bank name and address.
Pro tip: Avoid sending excel and csv exports, pdfs or screenshots are preferred. 4) Personal documents (KYC)As a merchant, you need to provide personal documents for the directors and UBOs who have more than 25% of ownership in the company. These usually involve:
- Passport or ID card (Driving licenses are not accepted);
- Utility bill (UB) for a person’s current address – issued within the last three months. Those UBs need to be for a landline service – gas, water, taxes, electricity, etc. Some acquiring banks do not accept bills for mobile phones, internet or bank statements as these services could be used even if the person is not residing on the mentioned address;
- CV – requested only in specific cases when there’s a need to prove an expertise in the industry in which the person is working;
- Personal email and phone number – needed for verification and e-signing purposes.
5) PCI DSS – Self-Assessment Questionnaire (SAQ)PCI Security Standards are technical and operational requirements set by the PCI Security Standards Council (PCI SSC) to protect cardholder data and sensitive authentication data.
Useful: PCI DSS is the global data security standard adopted by the payment card brands for all entities that process, store or transmit cardholder data and/or sensitive authentication data and it consists of steps to ensure best security practices.The Self-Assessment Questionnaire (SAQ) is a validation tool for eligible organizations who self-assess their PCI DSS compliance and who are not required to submit a Report on Compliance (ROC). Different questionnaires are available for various business environments. To determine whether you should complete a SAQ:
- SAQ A means that you don't store any information regarding your clients and their cards. All this information is being stored and taken care of by 3rd party providers;
- If you store this information without using 3rd party services as a merchant, this means you should be the one filling out SAQ D. For SAQ D, a scan is required at this point. The scan can be obtained by contacting an Approved Scanning Vendor (ASV) who will issue a report on any website vulnerabilities.
Whether you need a blank questionnaire to fill out, assistance with the required information or a list of vendors that could be contacted for the production of an ASV (scan) report, you can contact us at any time.
6) Domain ownershipAs a merchant, you need to provide what is called ‘proof of ownership of the domain name’. This can come either in the form of an invoice or a screenshot, but you need to make sure it includes the company name, the website and the validity period.
Some acquirers allow domain ownership to be in the name of the director, but most of the time the domain ownership has to be in the name of the company. In case the domain is owned by another company, acquiring banks would require a document or declaration that is justifying the connection between the two entities.
7) Proof of addressTo prove you are operating from your registered (or operational address), you are required to provide proof for the company address. This needs to be a valid rental agreement, invoice for paid rent or utility bill (UB) – issued within the last three months for a landline service – gas, water, taxes, electricity, etc. Note, that bank statements are not allowed.
Note: While undergoing the revision of a merchant, the acquirer might find information that the registered address is listed with the card schemes for violations or is a virtual address. In case of a listed address, the acquirer would require the merchant to change the registered address and outline the change in the official trade register. If they believe the registered address is a virtual one, they might request a utility bill or rental agreement for an alternative (operational) address.8) PoliciesSome business models such as crypto, gambling, etc, have to have AML/CFT/Monitoring/Onboarding policies in place. Acquirers request a copy of the internal policies and procedures. Once received, the documents are forwarded to the compliance team so they can review and make sure that your business complies with the international regulations and standards. The bank might request some amendments to the policies, as well as information on the MLRO that is conducting the procedures.
9) LicenseSome industries require a business license to operate. The best practice here is to present a copy of it initially, so that the acquirer can review it and advise if it is sufficient, or whether any additional document might be needed.
10) Manufacturing/ Reseller/ Franchise/ Service AgreementThese types of documents are usually required for clients that offer physical goods. The reason to request such information is for the bank to identify the origin of the products and make sure that they are not fake and can be sold on the different markets.
For physical goods, acquirers usually ask for a manufacturing or reseller agreement, as well as information about how they are being stored (location of the warehouse). If you’ve got any famous brands on the list, they might also require a document that proves the products’ originality and that you have the right to sell it.
Note: For cosmetic products and for products that are being ingested or inhaled, there are additional documents required to prove that you, as a merchant, can legally sell them and that they’re safe for public use. The documents below are what the merchant as usually asked for but the list not exhaustive, because of the different acquirer requirements:Nutraceuticals:
- Laboratory tests;
- Copy of the Ingredients label – sent as a copy and visible for each product on the website.
Cosmetic products:
- Laboratory tests;
- Copy of the ingredients label – sent as a copy and visible for each product on the website.
Vapes and CBD products:
- Laboratory tests that prove that the THC level is below 0.2%;
- Certificates of Analysis (COAs) - A COA is a document that shows the results of a lab test for a specific batch of CBD products. It confirms the potency and purity of the CBD and ensures that the product is safe for consumption;
- No buds are allowed;
- Legal opinion or link to source of information provided by the official authority for each target market confirming that CBD is legally sold;
- Information on how the merchant ensures that they are compliant with the constantly changing EU regulations for smoking products.