A merchant onboarding checklist is the difference between activating a new seller in two days or two weeks. If you run a payment processor, marketplace, PayFac, or any platform that accepts a new merchant, the underwriting file has to be complete before you can turn on the account — and every missing document adds days of email chasing.
This article gives you the full merchant onboarding checklist: the base documents every merchant must submit, plus add-ons for sole proprietors, high-risk verticals, international merchants, and marketplace sellers. Copy the sections you need.
The core merchant onboarding checklist
Every new merchant, regardless of vertical or geography, needs the same backbone of documents before you can underwrite the account and open a merchant ID. The list below is the floor for a standard-risk US merchant.
| # | Document | What it proves | Refresh cadence |
|---|---|---|---|
| 1 | Signed merchant processing agreement | Legal terms of the relationship | Per contract term |
| 2 | Completed merchant application | Business details, volume estimates, MCC | At onboarding, update on change |
| 3 | Certificate of incorporation or DBA registration | The entity legally exists | On material change |
| 4 | EIN letter (SS-4) or W-9 | Tax identification for 1099-K reporting | On entity change |
| 5 | Government-issued ID for each signer and beneficial owner (25%+) | Identity verification (KYC) | Every 2 years |
| 6 | Proof of business address (utility bill, lease) | Where the business operates | Last 90 days |
| 7 | Voided check or bank verification letter | Funding account for settlements | On account change |
| 8 | Last 3 months of business bank statements | Cash flow and volume validation | At onboarding, refresh yearly |
| 9 | Last 3 months of prior processing statements | Historical volume, chargebacks, refunds | At onboarding |
| 10 | Business website URL and terms of service | Products sold, refund policy, disclosures | At onboarding, review yearly |
| 11 | Sanctions and PEP screening result | Confirms no prohibited counterparty | Every 6 months |
Get these eleven right and you have a merchant file that survives a card-brand audit. Everything below is a variation on top of this base.
Beneficial owners: the piece most teams get wrong
Under the FinCEN Customer Due Diligence rule and card-brand requirements, you have to identify every individual who owns 25% or more of the merchant entity, plus one control person (usually the CEO or managing member). For each beneficial owner, run a mini-KYC:
- Full legal name, date of birth, residential address
- Government-issued photo ID (driver’s license, passport)
- Social Security Number (or foreign equivalent for non-US owners)
- Ownership percentage and role
Miss a beneficial owner and your file is technically incomplete, even if the merchant is transacting. This is one of the top findings in card-brand audits, and it is entirely preventable with a workflow that requires each owner to submit their own documents through a portal instead of the merchant self-declaring.
For the underlying methodology — including the 25% threshold, the control-person concept, and the source documents you can actually accept — see our full KYB checklist. It goes deeper on the entity-verification side than what fits here.
Merchant onboarding by business structure
The base list changes depending on how the merchant is legally set up. The four common cases are below.
Sole proprietors and single-member LLCs
Sole proprietors have no separate legal entity, so several documents look different or drop off entirely.
| Add or replace | Document |
|---|---|
| Replace | SSN in place of EIN (if no EIN was obtained) |
| Replace | Personal tax return (last 2 years) in place of business bank statements when history is thin |
| Add | DBA / fictitious name registration if the merchant trades under a name other than the owner’s |
| Add | Personal address verification (utility bill in owner’s name) |
Sole proprietors are the merchants most likely to submit inconsistent legal names across documents (Bob’s Bakery on the application, Robert Smith on the ID, Bob Smith DBA Bob’s on the bank statement). Build name-match verification into your review step.
LLCs, LPs, and corporations
Multi-member entities need governance documents so you know who is authorized to sign for the business.
| Add | Document |
|---|---|
| Add | Articles of organization (LLC) or articles of incorporation (Corp) |
| Add | Operating agreement or bylaws showing signing authority |
| Add | Certificate of good standing from the state of registration (last 90 days) |
| Add | Beneficial ownership schedule listing every owner at 25%+ |
If the entity is owned by another entity (holding company, parent), you have to look through the corporate structure until you reach natural persons — and each of those still needs an ID.
Non-profits, associations, and government entities
These are lower-risk on paper but need different proof.
| Add | Document |
|---|---|
| Add | IRS determination letter (501(c)(3)) or state equivalent |
| Add | Board resolution authorizing merchant processing |
| Add | Latest Form 990 or annual budget |
Government entities usually skip beneficial-owner requirements but still need an authorized-signer letter.
International merchants
Cross-border merchants add a layer of country-specific documents on top of the base list.
- KBIS extract (France) or Handelsregister (Germany) or Companies House filing (UK) in place of the US certificate of incorporation
- VAT registration certificate in place of the W-9
- Passport instead of a driver’s license for owner ID
- SWIFT / IBAN details in place of ACH voided check
- Proof of local address if the local country requires a domiciliation
For French merchants specifically, Superdocu can pull the KBIS from the official INPI registry automatically — you just enter the SIRET. Same for URSSAF certificates and transport licenses. Cuts the underwriting cycle by days when you process a lot of European merchants.
Add-ons for high-risk verticals
Card brands and acquiring banks apply extra scrutiny to certain MCCs — CBD, firearms, adult, nutraceuticals, gambling, travel, crypto, high-ticket coaching, subscription boxes with high refund rates. If your merchant sits in one of these buckets, plan for extra documents.
| # | Add for high-risk | Why |
|---|---|---|
| 1 | Product catalog or sample inventory list | Prove what is actually being sold |
| 2 | Fulfillment agreement (if drop-shipping) | Confirm goods actually ship |
| 3 | Refund and chargeback policy | Understand exposure |
| 4 | Rolling reserve agreement | Card-brand requirement |
| 5 | State license (dispensary, firearms dealer, gambling operator) | Sector-specific compliance |
| 6 | Age-gate implementation proof (adult, alcohol) | Regulatory requirement |
| 7 | Personal guarantee from principals | Financial recourse |
| 8 | Prior processor closure letter (if terminated by another processor) | Understand why the relationship ended |
The rule of thumb: if a merchant was previously placed on the MATCH list (Member Alert to Control High-Risk), you need a full explanation and mitigation plan before you consider boarding them.
Marketplace seller onboarding
If you run a marketplace with third-party sellers (Amazon-style, Etsy-style, Uber-style), you technically have two onboarding flows: the platform onboards you (the marketplace) once, and then you onboard each seller. The seller flow is a slimmed-down merchant onboarding:
- W-9 (US) or W-8 (non-US) for 1099-K reporting
- Government-issued ID for each seller
- Bank account details for payouts
- Signed marketplace seller agreement
- Product category and prohibited-items acknowledgment
- Tax residency and any state sales-tax registrations
Superdocu is a good fit for this workflow because you can reuse the same vendor onboarding checklist template across every seller, and repeatable workflows handle re-verification each year without you rebuilding the file.
Ongoing merchant maintenance
Onboarding is not a one-time event. Cards brands and regulators expect you to refresh the file on a schedule, and to react when something changes.
| Trigger | Refresh action |
|---|---|
| 12 months elapsed | Update sanctions screening, request refreshed IDs if expired |
| 24 months elapsed | Full KYB/KYC refresh |
| Volume shifts more than 30% from application estimate | Re-underwrite, request updated financials |
| Ownership change of 10%+ | Re-collect beneficial-owner IDs and updated ownership schedule |
| New product line or MCC added | Update merchant application and website review |
| Chargeback ratio exceeds 0.9% | Request remediation plan and updated policies |
Set expiration dates on every ID and license at onboarding. If you’re not tracking document expiration automatically, you’re one audit away from a finding.
Common mistakes in merchant onboarding
- Accepting a self-declared beneficial-owner list without collecting IDs for each owner. Card-brand audits catch this immediately.
- Not verifying the bank account matches the entity name. Fraudsters often submit a bank account owned by a shell or a different person.
- Skipping the website review because the merchant “already has a URL.” A blank site, missing refund policy, or products different from what was declared is a red flag.
- Approving pre-underwriting. Turning on the merchant ID before the file is complete leaves you with all the exposure and no ability to hold funds.
- Chasing documents over email instead of a portal. Every email round-trip is 24 hours of latency; a portal cuts that to minutes.
How Superdocu handles merchant onboarding
Superdocu is a document collection platform used by fintechs, marketplaces, and payment platforms to run merchant onboarding without the email chase.
- Build a merchant application as a step-by-step workflow with document requests, forms, and e-signature blocks — no code
- Each merchant gets a branded portal (your logo, your colors, your subdomain) where they upload documents and see what’s missing
- Beneficial owners each get their own magic-link invite to submit their ID and info without the merchant having to relay it
- Automatic KBIS, URSSAF, and transport-license verification for French merchants
- Expiration tracking on every ID, license, and insurance certificate, with automatic renewal reminders
- Webhooks and Zapier triggers to push approved merchants into your underwriting system or ledger
- Repeatable workflows for annual refresh cycles so re-verification isn’t a from-scratch build
Compared to running merchant onboarding in email plus a shared drive, teams typically cut their onboarding cycle from 8-10 days down to 2-3, and their document-related audit findings to near zero.
Frequently asked questions
What is a merchant onboarding checklist?
A merchant onboarding checklist is the list of documents a payment processor, marketplace, or platform requires from a new merchant before opening a merchant account and activating processing. It usually covers legal entity documents, beneficial owner IDs, financial statements, bank verification, and signed agreements.
How long does merchant onboarding take?
For a standard-risk US merchant with clean documents, 1-3 business days is realistic when the onboarding file is complete on submission. High-risk verticals and international merchants take 5-10 days because of additional underwriting and document review. The main delay in most programs is chasing missing documents — a document-collection portal typically cuts cycle time by 40-60%.
What is the difference between KYC and merchant onboarding?
KYC (Know Your Customer) is the identity verification piece — checking who the individual owners and signers are. Merchant onboarding is the wider process that includes KYC plus KYB (entity verification), financial underwriting, bank verification, and the signed processing agreement. See our KYC document checklist for the individual-verification side.
Do sole proprietors need beneficial owner documents?
No. The beneficial owner rule only applies to legal entities (LLCs, corporations, partnerships). A sole proprietor is the beneficial owner by definition — you collect their ID and SSN as the primary applicant instead of a separate BO schedule.
How often should merchant documents be refreshed?
Sanctions screening every 6 months, full KYB/KYC refresh every 24 months (or sooner for high-risk), and any time there is a material change — ownership shift of 10% or more, new product line, volume swing over 30% from the application, or a chargeback ratio above 0.9%. Automating this with document expiration tracking prevents stale files.
Run your merchant onboarding through Superdocu
Give every new merchant a branded portal with a step-by-step workflow, automatic reminders, and expiration tracking on every document. Start a free trial — no credit card required.