AML software for payment gateways

• The merchant is the risk: a business that looks like a shop can be a front for processing the proceeds of crime or fraud.
• Shell and front companies: newly incorporated companies with little real activity and owners who are hard to see.
• Ownership hidden behind layers: the people who control a merchant are often several companies away from the applicant.
• Sub-merchants and platforms: gateways that onboard platforms or payment facilitators inherit the risk of the businesses those platforms serve.
• Higher-risk categories: some merchant categories carry more fraud, chargeback and laundering risk and call for enhanced due diligence.
• Change after onboarding: a merchant's owners, directors and sanctions status can change long after the account was approved.

1. 1

   Pre-screen the application

   Checks on the business email domain, phone, IP, VAT number and submission velocity filter out fabricated applications before full review.

2. 2

   KYB the merchant

   Confirming the company exists, identifying its directors and beneficial owners, and understanding what the business actually sells.

3. 3

   Screen the merchant and its owners

   Sanctions, PEP and adverse media screening of the company, its directors and its beneficial owners, applying ownership rules where a designated person owns or controls it.

4. 4

   Monitor the merchant

   Re-screening the merchant book when lists change, and monitoring processing activity for volumes and patterns that do not fit the business.

5. 5

   Investigate and report

   Reviewing alerts, recording decisions, offboarding where needed, and reporting suspicious activity to the financial intelligence unit.

The FATF Recommendations require financial institutions to apply customer due diligence (Recommendation 10), which for a business customer includes identifying its beneficial owners and understanding its ownership and control structure. For an acquirer or gateway the merchant is that customer. Targeted financial sanctions (Recommendations 6 and 7) apply to the merchant and to the people behind it.

Acquiring payment transactions is a regulated payment service. In the UK, payment institutions are authorised by the FCA and are subject to the Money Laundering Regulations 2017. In the EU they are licensed under the national rules implementing the payment services directive and are subject to the EU anti-money laundering framework. Card scheme rules generally add their own expectations that acquirers know and monitor their merchants.

• Company lookup and ownership: KYB that reaches beneficial owners and applies ownership rules such as the OFAC 50 Percent Rule.
• Screening of people and companies together: the merchant, its directors and its owners screened in one flow, not three separate tools.
• Application fraud signals: business email, VAT, IP and velocity checks that stop fabricated merchants early.
• Batch re-screening: the whole merchant book re-checked when lists change, with alerts only on changes.
• Explainable matches: every alert shows why it fired, so underwriters can clear namesakes quickly.
• Evidence: a record of every check and decision, for card schemes, auditors and supervisors.