Merchant account onboarding can be a difficult process, especially for high-risk merchants. Preparing the necessary information and documents ahead of time can streamline the process and helps to ensure compliance with regulatory requirements.
If you run an adult, CBD, dating or subscription business and want to accept cards, expect three separate reviews. Your payment provider checks your file first. Its acquiring bank then runs its own review. Finally, for most high-risk categories, the acquirer registers you with Visa and Mastercard.
This guide explains what each reviewer looks for, which documents to prepare, what your website must show, and what changed in 2026. Incomplete files cause more delays than the industry itself. So the work you do before applying decides how fast everything after it moves.
Merchant account onboarding in short 1. Gather your KYB documents: company registration, ownership and director records, ID and proof of address for owners above 25%, bank details and processing history. 2. Make your website review-ready: legal pages, card logos at checkout, a support contact and, for adult sites, age, consent and takedown controls. 3. Your provider reviews the file and the site, then sends it to an acquiring bank. 4. The acquirer approves and registers you with the card schemes where required. 5. You integrate, test and go live. Prepared merchants can start on some alternative payment methods within days; card approval usually takes weeks. |
How merchant account onboarding works
Merchant onboarding is how a payment provider verifies your business before you can take payments. For high-risk merchants, it means three reviews in sequence, and each one waits for the one before it.
Reviewer | What they check | What they may ask you for |
|---|---|---|
Payment provider (for example, Vendo) | Your company, owners, business model, website and processing history | Missing documents, website changes, written policies |
Acquiring bank | The same file, against its own risk appetite and the card-scheme rules it answers for | Further documents or site edits |
Visa and Mastercard (through the acquirer) | Registration in their high-risk programs: Visa’s Integrity Risk Program and Mastercard’s Specialty Merchant Registration Program | Usually nothing directly — the acquirer registers you and pays the fee |
The onboarding process, step by step
- Application and documents. You complete the application on Merchant Start and upload your KYB (know your business) documents.
- Discovery call. An account manager asks about your business model, markets, expected volumes, average ticket size and billing type — one-off, trial or subscription.
- Underwriting. The provider verifies the company and the people behind it. It screens owners and directors and checks industry lists of terminated merchants, such as Mastercard’s MATCH list.
- Website compliance review. The compliance team checks your site against the law and card-scheme rules. Your account manager then sends a list of required changes.
- Acquirer review. Once those changes are live, the file goes to the acquiring bank. The bank may request more documents or edits before it approves or declines.
- Card-scheme registration. For high-risk categories, the acquirer registers you with Visa and Mastercard. Adult content, for example, processes under merchant category code (MCC) 5967.
- Integration and go-live. You receive credentials and integration guides, run test transactions, and start processing.
Registration carries a cost, and acquirers often pass part of it on. Mastercard doubled its annual specialty merchant registration fee to $1,000 from 1 May 2026 and added per-transaction fees from 3 June 2026. Our breakdown of Mastercard’s specialty merchant fees shows what that means per sale.
Documents you need for a high-risk merchant account
Requirements vary by acquirer and country, but most high-risk providers ask for the same core set. Have it complete, current and consistent before you apply.
Category | What to prepare | Tips |
|---|---|---|
Company | Formation document: certificate of incorporation or registration. Many US LLCs file a Certificate of Formation or Articles of Organization instead. | If your entity type has no certificate, send the official formation filing. |
Company | Governing document: Memorandum and Articles of Association, bylaws, or an LLC operating agreement. | Send the current version, including amendments. |
Company | Register of directors and shareholders, or a certificate of incumbency. | It must show current officers and owners. |
Company | Proof of business address dated within the last three months. | A utility bill or bank statement in the company’s name. P.O. boxes are usually rejected. |
People | Passport or national ID for every owner above 25%, every director and every signatory. | Driver’s licences are usually not accepted. |
People | Personal proof of address dated within three months. | Same rules as the business document. |
People | Ownership chart if any owner is another company. | Trace ownership up to the natural persons at the top. |
Banking | Company bank details: beneficiary name, bank, IBAN or account and routing number, SWIFT/BIC. | The account must be in the company’s name. |
Trading | Six months of processing history: monthly transactions, refunds and chargebacks. | No history? Say you’re a startup and share what you have. |
Trading | All website URLs, plus test logins for paid or members-only areas. | Reviewers need to see what paying customers see. |
US companies | Voided check or bank reference letter; EIN; SSN for owners where requested; proof of domain ownership. | A registrar account screenshot usually proves ownership. |
Above $100,000/month | Business financial statements or two years of business tax returns; personal statements or two years of tax returns for principal owners. | Prepare these early. Accountants take time. |
Documents don’t need translating into English. If you already have a translation, send it alongside the original. Selling CBD? See our guide to getting a CBD merchant account for the extra documents that vertical needs.
The consistency test
Underwriters compare documents against each other. The company name on your bank statement should match your certificate of incorporation. The address in your website footer should match your proof of address. Projected volumes should fit your prices and traffic.
One small mismatch rarely sinks an application. Each one does trigger a question, though, and each question adds days.
What your website needs before compliance review
Compliance teams review your live site the way a customer, a regulator and a card scheme would. Every merchant needs these basics, whatever the vertical.
Where | What must be there |
|---|---|
Footer | Your legal company name and registered address, visible on every page. |
Checkout | Visa and Mastercard logos, downloaded from the official Mastercard Brand Center and Visa brand guidelines. |
Terms and conditions | Company name and address; what you sell and how pricing works, including trials and renewals; governing law and jurisdiction; how to cancel and request a refund. |
Privacy policy | What personal data you collect and how; which cookies you use and why; for EU and UK users, how people exercise their GDPR rights. Companies must answer those requests within one month. |
Contact page | At least one working support channel: email, phone or a contact form. |
Shipping policy (physical goods) | Delivery times, fees and destination countries. The country list must match the countries available at checkout. |
Comments and chats | Active monitoring for content that breaks the law or card-scheme rules. |
Subscription businesses face extra scrutiny on pricing. If a trial converts into a paid plan, show the price, the billing interval and the cancellation route before the customer pays — not only in the T&C. Unclear renewal terms turn into disputes, and card schemes watch dispute ratios closely.
Extra requirements for adult websites
Visa and Mastercard hold acquirers responsible for what adult merchants publish, so reviews go further. At a high level, your provider will want to see five things working on your site:
- Verified creators and depicted persons. Age, identity and consent for everyone who uploads or appears in your content.
- Content moderation. Review before publication, including livestreams and AI-generated content.
- A complaints and takedown process. An easy way to report content, and fast removal of anything illegal.
- Viewer age verification. A method that meets the law where your viewers are. A simple “I’m over 18” popup no longer satisfies the UK’s Online Safety Act or a growing number of US states.
- Written policies. Content moderation, age verification, complaints and anti-trafficking — plus an 18 U.S.C. § 2257 record-keeping statement where that US law applies.
New in 2026: the TAKE IT DOWN Act Since 19 May 2026, covered US platforms must remove non-consensual intimate imagery, including AI deepfakes, within 48 hours of a valid request. The FTC enforces the law, with civil penalties of up to $53,088 per violation. |
Vendo shares its full adult website requirements with merchants during onboarding. See our adult payment processing page for how we work with adult and creator platforms.
What slows onboarding down
- Expired documents. A proof of address from four months ago means resubmitting.
- Ownership gaps. Holding structures need documents for every layer, up to the people who own more than 25%.
- A website that isn’t ready. Missing legal pages or a placeholder site delay the compliance review.
- Numbers that don’t add up. Volumes or ticket sizes that don’t fit your business model prompt questions.
- Unexplained history. A previous account closure is easier to explain upfront than after the acquirer finds it.
- No single owner on your side. A file moves at the speed of its slowest reply.
One adult creator platform we onboarded in 2026 went from signed contract to first live transaction in seven days. It started on SEPA and Pay by Bank, where Vendo is the only reviewer. It answered document requests within a day or two, and one person owned the file. Read the full case study.
There was a trade-off. Those rails don’t yet support recurring billing, so cards remained the long-term goal for subscriptions. Our Pay by Bank guide covers when that route fits.
Compliance continues after approval
Approval starts an ongoing review. Your provider and acquirer keep checking your website, your dispute and fraud ratios and, for adult merchants, your monthly reports.
Tell your provider before you add a domain, a new market or a new content type such as livestreaming or AI generation. Those changes may need review before launch. When your provider flags an issue, fix it quickly. Acquirers and card schemes set remediation deadlines, and missed ones count against you. Our merchant protection tools help you track the ratios that matter.
Frequently asked questions
How long does high-risk merchant onboarding take?
It depends on how complete your file is and how many parties review it. On alternative payment methods where the provider is the only reviewer, a prepared merchant can go live within days. Card processing adds the acquirer review and scheme registration, so it typically takes several weeks.
Can a startup with no processing history get approved?
Yes. Say you’re a startup on the application and share whatever history you have. Expect closer review and possibly lower starting limits. Some merchants begin on SEPA or Pay by Bank while the card application runs in parallel.
Do my documents need to be in English?
No. Send originals, and include a translation if you already have one.
Why was my merchant account application declined?
The usual reasons are incomplete or inconsistent documents, a non-compliant website, prohibited products or content, a listing on a terminated-merchant database such as MATCH, or a business model outside the acquirer’s risk appetite. Ask your provider which one applied; some issues can be fixed and resubmitted.
Does an age-verification popup count for adult sites?
Not where the law requires more. The UK, a growing list of US states and several EU countries require stronger checks, and card schemes expect you to follow the law wherever your viewers are.
Ready to apply?
If your documents and website match the checklist, start your application on Merchant Start. Not sure where you stand? Talk to our team — we’ll tell you which payment methods fit your stage of business and what to prepare first.
About Vendo: Vendo offers comprehensive payment processing services to e-commerce merchants, including those in high-risk industries. Our innovative, AI-powered tools offer merchants simple, secure, and seamless payment solutions, along with expert customer support from integration to end-user concerns. Our expert team works 24/7 to shape your vision into reality.