A step-by-step guide to the merchant onboarding process UK merchants go through before a payment service provider (PSP) lets them accept payments. It covers what PSPs check at each stage, why documents are required, and how to avoid delays for faster approval.
While onboarding can feel complex from the outside, the UK PSP merchant onboarding process follows a logical sequence of steps.
Each of the merchant onboarding steps answers a different question - and together, they help PSPs decide whether a business can safely and compliantly process payments.
In practice, the full process tends to include:
|
|
|
|
|
The merchant account application process starts when a business submits a merchant application to a payment service provider.
The information provided here shapes how the rest of the onboarding process unfolds - including what checks are required, how long approval may take, and whether additional review is needed later.
At this stage, PSPs typically collect:
|
|
|
|
|
|
|
PSPs use this information to understand what kind of business they're onboarding, how money will move through the payment platform, and whether there's any existing content that could affect risk assessment or compliance requirements.
A well-completed merchant application doesn't guarantee approval, but it gives the onboarding process a clear starting point - and that makes every step that follows smoother.
Once the merchant application, financial statements and other documents have been reviewed, the next step is business verification, often referred to as KYB (Know Your Business).
This stage is about confirming that the business behind the application legally exists and operates as described. It's less about risk judgement and more about establishing a reliable, factual baseline before the payment solution can be enabled.
During KYB checks, PSPs typically verify necessary documents such as:
|
|
|
|
|
Entity verification involves validating information against official sources such as Companies House, supported by documents like Certificates of Incorporation, where required. Because PSPs check the application against the public register, company names, numbers, and addresses need to match Companies House records exactly.
Much of this happens through automated checks, with manual review stepping in if anything doesn't line up.
Once the business is verified, the focus then moves to the individual behind it. This is where KYC (Know Your Customer) checks come into play.
At this stage, PSPs need to confirm the identity of the people who own, control, or are responsible for the merchant's payment activity and their business relationships. This isn't about ticking boxes - it's about understanding who ultimately benefits from the financial transactions being processed.
Beneficial owners are the individuals who ultimately own or control the business, generally anyone holding more than 25% of its shares or voting rights. PSPs need to identify them even when ownership runs through holding companies, which is why complex structures take longer to verify.
Typically, KYC compliance documentation includes:
|
|
|
The merchant onboarding process involves submitting identity documentation and ownership information to meet KYC compliance regulations.
From a merchant's perspective, this is often the hands-on part of onboarding. From a PSP's perspective, it's a critical step in meeting anti-money laundering obligations and ensuring accountability from day one.
Once identities have been verified, PSPs carry out anti-money laundering (AML) and sanctions screening.
This step goes far beyond simply checking the business's reputation. It checks whether the business or the people connected to it appear on any sanctions lists, watchlists, or databases linked to financial crime, money laundering, or terrorist financing.
At this stage, PSPs typically screen:
|
|
|
These background checks are largely automated and run against global sanction lists, including the UK Sanctions List, politically exposed persons (PEP) databases, and adverse media sources.
A PEP is someone who holds, or recently held, a prominent public role, along with their close family and associates. A PEP match does not mean rejection, but it does trigger enhanced due diligence under UK money laundering rules. If a potential match is flagged, the digital merchant onboarding application will need further review before onboarding can continue.
This is also the point where enhanced due diligence may be applied. Merchants operating in higher-risk industries, processing larger transaction volumes, or working across multiple regions may be asked for additional information to satisfy compliance requirements.
Once the core compliance checks are underway, PSPs take a closer look at how the merchant actually presents and operates its businesses. This is where the website and business model review comes in.
The goal here isn't design critique. It's about validating that what the merchant says they do, matches what customers will experience when they try to make a payment.
When underwriting merchant accounts, PSPs look at:
|
|
|
|
|
This step helps PSPs understand the full customer payment journey - from checkout through to settlement and customer satisfaction - and identify any issues that could lead to disputes, chargebacks, or compliance concerns later on.
When a merchant's website clearly reflects their business model and includes the right customer-facing information, this step is usually quick.
By this point, the PSP has a full picture of the merchant: who they are, how they operate, and how they plan to accept payments. The next step brings all of that information together into a formal risk assessment.
This part of the merchant onboarding process involves the assessment of the merchant's overall risk profile and assigning an industry classification, which helps determine how the account should be set up and monitored going forward.
In practice, industry classification means assigning a merchant category code (MCC), the four-digit code that card schemes such as Visa and Mastercard use to identify the type of business and apply their own rules to higher-risk sectors.
Risk is typically assessed across several factors, including:
|
|
|
|
|
Based on this assessment, merchants are usually categorised as low, medium, or high risk. This classification allows the acquiring bank, PSP or payment gateway to apply the right controls, transaction limits, and monitoring levels from day one.
A higher-risk classification doesn't automatically mean a merchant can't be onboarded. It does, however, mean that additional safeguards may be required, such as tighter fraud prevention measures or more frequent monitoring.
This risk-based approach reflects FCA expectations that payment firms apply proportionate controls based on the nature, scale, and complexity of a merchant’s activities.
Once the payment service provider has conducted the risk assessment, the focus shifts to the commercial and contractual side of the relationship.
This is where the practical details are agreed: how the merchant account will operate, what services are included, and the terms under which payments will be processed. It's also where expectations are set on both sides - before anything goes live.
At this stage, the following should be finalised:
|
|
|
|
|
The contractual side on onboarding is linked to the earlier risk assessment. A merchant's industry classification and expected transaction volumes directly influence how the account is configured and what safeguards are applied.
For merchants, this is where everything becomes tangible. You know what you're paying, how quickly funds will settle, and how the payment solution fits into your wider business operations.
Separately, from April 28, 2026, new UK rules introduce additional requirements around termination notices for certain payment services framework contracts, including providing clearer reasons for termination and longer notice periods in specific circumstances.
The next step is technical integration and testing. This is where the merchant complies and connects their systems to the PSP's payment platform, whether that's through APIs, hosted payment pages, plugins for an online store, or a combination of all three.
Integrating the payment solution into the merchant's existing sales channels only happens after approval, ensuring live payment processing is enabled in a controlled and compliant way.
The goal is to make sure that transaction processing is done reliably, securely, and exactly as expected before anything goes live.
At this step, integrating with a payment company involves:
|
|
|
|
|
Testing allows both the merchant and the PSP to confirm that the transactions are processed correctly, error handling works as it should, and customers' payments move smoothly from checkout through to settlement.
This step also helps to identify any areas that require technical support early, before they impact real customers or live transactions.
Once testing is complete and everything behaves as expected, the account is ready for final approval.
The final step in the process is approval and go-live. By this point, the business has passed compliance checks, commercial terms are in place, and technical integration has been tested. The PSP carries out a final review to confirm that everything aligns.
Go-live marks the point where a merchant begins accepting real customer payments, following successful testing in sandbox environments.
Reaching go-live is a big milestone for merchants - but it's also the start of an ongoing relationship with their PSP or payment gateway provider.
There's no single timeframe that applies to every business - and in the UK, that's largely because the merchant onboarding process is risk-based.
Straightforward, lower-risk businesses with clear documentation and a simple payment setup can look forward to a streamlined onboarding experience. Where automated checks are sufficient and minimal additional review is needed, approval and go-live happens relatively quickly - often in just a few working days.
For more complex businesses, onboarding naturally takes longer. PSPs are required to apply different levels of auditing depending on various business characteristics, and that additional scrutiny takes time.
What's consistent across the board is: onboarding moves fastest when information is accurate, complete, and provided upfront.
When merchant onboarding slows down, it's rarely cautious for the sake of it. In most cases, delays come down to a handful of avoidable issues that surface as checks progress.
Some of the most common causes include:
Missing fields, incorrect tax identification numbers, unclear business descriptions, or details that don't quite align across documents often trigger follow-up questions.
Each clarification adds time, especially once compliance reviews are already underway.
If it's not immediately obvious how a business makes money, how customers pay, or what the end customer experience looks like, the PSP or payment gateway provider will need more detail before moving forward.
Large forecast transaction volumes with little or no processing history aren't necessarily a problem - but they do require explanation.
Without context, PSPs may need additional review before approving an account.
Missing terms and conditions, refund policies, or customer contact information are a common stumbling block.
If a website doesn't clearly reflect the business described in the application, onboarding may pause until this is resolved.
Expired identity documents, outdated company records, or slow responses to follow-up requests can quickly extend timelines, even for otherwise straightforward applications.
Most of these issues are avoidable. Merchants who understand what PSPs are looking for - and why - tend to move through onboarding far more smoothly than those encountering the process for the first time.
Need a faster, clearer merchant onboarding experience?
DECTA combines regulated payment acquiring, smart risk management, and straightforward onboarding, so you can get approved, go live, and start accepting payments with minimal friction.
