Process family

Merchant onboarding and risk: four templates from application to monitoring

Four linked flowcharts for admitting and watching a merchant: onboarding, risk assessment, payment API integration and monitoring, plus institutional client onboarding, transaction risk assessment, fraud detection and incident response.

Admitting a merchant to a payment platform is a decision the platform keeps re-making as long as the merchant transacts. Four templates follow that arc: application through KYB and underwriting to a tested account, the risk assessment that sets tier and controls, the technical integration, and the monitoring that feeds back into the profile. The institutional variant and the transaction-level risk, fraud and incident templates sit alongside.

Merchant onboarding coordinates the commercial, due-diligence, underwriting and technical work from a complete application to an approved account with an owned monitoring plan. Inside it, merchant risk assessment turns current business and ownership facts into a documented disposition: fraud, dispute, financial and operational analysis, a tier, proportionate controls and a review date.

The merchant then builds against the platform in payment API integration, from non-production access through security design, contract and exception testing to a controlled launch. Once live, merchant monitoring converts transaction and performance signals into alert triage, outreach, restrictions or remediation and a refreshed risk profile. An issuer, processor or fintech implementing a payment service follows the institutional client onboarding template instead, which is explicitly not the retail merchant route.

Onboarding fails at the handovers: a merchant approved on stale ownership facts, an integration live before its risk controls were configured, alerts nobody triages because signal quality was never checked, a restriction with no remediation path. Risk assessment's completeness gate and scheduled review refresh the profile; onboarding's go-live handoff, which a named monitoring owner must acknowledge, keeps activation behind the controls; monitoring checks signal reliability before any threshold is applied and pairs a restriction with a remediation plan and an effectiveness test.

Per transaction, transaction risk assessment runs pre-authorization and returns a recommendation, not a decision; payment fraud detection correlates signals into deduplicated alerts; and payment processing incident covers the day the platform fails. Every transaction the admitted merchant processes runs through the card payment lifecycle, and its dispute ratio is one of the signals monitoring reads from disputes and chargebacks. The same structure of due diligence, tiering, approval and periodic review is what a company applies to its own suppliers under supplier quality.