Onboarding by Design: How to Build a Scheme- and Regulator-Ready Merchant Onboarding Workflow
The short answer
Scheme-ready merchant onboarding proves five things before a merchant's first transaction: the business is real, it sells what it says, it carries the correct MCC, it is not on a sanctions or terminated list, and it has been screened by a registered monitoring provider. The fastest acquirers do this with risk-based journeys that auto-approve clean merchants in minutes and send only real exceptions to analysts.
Why onboarding is now the main control point
Onboarding used to be a sales hurdle. In 2026 it became the first line of scheme compliance.
- Mastercard's updated Merchant Monitoring Program expects new merchants to be screened by a registered MMSP before their first transaction, from 1 January 2026.
- Visa requires acquirers to register before contracting high-integrity-risk merchants under VIRP, with separate approval for each Tier 1 MCC category.
- Visa's merchant data standards state that acquirers must assign the correct MCC, and that online gambling must use MCC 7995 even when gambling is not the merchant's primary business.
- Regulators expect documented due diligence that can be shown on request.
A merchant you should never have boarded costs far more to remove than to decline.
What a scheme-ready file must prove
| Question | Checks that answer it |
|---|---|
| Is the business real and active? | Website status, domain age, company details, address and physical presence, review history |
| Does it sell what it declared? | Product and service detection, product-policy consistency, price ranges, prohibited and counterfeit product scan |
| Is the MCC correct? | MCC detected from site, reviews, maps and social content, compared with the declared MCC |
| Is it high-risk under scheme rules? | VIRP tier mapping, Mastercard specialty registration categories, prohibited MCC flags |
| Is it clean on AML and sanctions? | OFAC, UN, EU, HMT and local list screening, PEP and adverse media |
| Is it safe to connect? | TLS and HTTPS, exposed services, PCI DSS SAQ type |
| Is there anything hidden? | Redirects, alternate domains, unlisted social profiles, transaction laundering indicators |
One workflow, five merchant types
A single checklist does not fit every channel. The workflow should adapt to how the merchant sells.
| Merchant type | What matters most |
|---|---|
| E-commerce | Full site analysis: content, products, policies, MCC, traffic, cybersecurity and laundering risk |
| Physical POS | Proof of presence without a site visit: address checks, street view and signage, reviews |
| Pay-by-link and social sellers | Social profile age and activity, products shown, links to undisclosed sites |
| Marketplace sellers | Product variety, pricing, counterfeit signals and buyer reviews |
| Payment facilitator sub-merchants | Same depth as direct merchants, applied at scale, because scheme liability still reaches the acquirer |
The six-stage workflow
- Pre-check. Run a lightweight domain check (registration date, domain age) before spending effort on a full review. Very new domains deserve a closer look.
- Scan by type. Trigger the right scan for the merchant type, with credentials where content is gated.
- Screen people and entities. Sanctions, PEP and adverse media checks on the company and its owners.
- Decide by rule. Apply your risk policy automatically: Pass, Pass with Notes or Fail. Analysts review only the exceptions.
- Register where required. Complete VIRP and Mastercard registrations for high-risk categories before go-live.
- Hand over to monitoring. The approved merchant enters continuous monitoring with its onboarding risk score attached, so the first 90 days are watched more closely.
The local regulation layer
| Market | What shapes onboarding |
|---|---|
| United Arab Emirates | CBUAE Retail Payment Services and Card Schemes Regulation; Federal Decree-Law No. 10 of 2025 on AML with fines up to AED 100 million for legal entities; new Central Bank Law (Federal Decree-Law No. 6 of 2025) with a 15 September 2026 compliance deadline |
| Saudi Arabia | Law of Payments and Payment Services and its 2023 Implementing Regulations; SAMA requires KYC verification before POS devices are activated |
| Türkiye | Law No. 6493 and the CBRT regulation on payment services; MASAK obligations; data quality for the national merchant registry; recent license revocations tied to illegal betting flows |
| European Union | The AML Regulation applies from 10 July 2027, with the new EU AML Authority supervising selected entities directly from 2028; PSD3 and the Payment Services Regulation are expected to be published in late 2026 |
Scheme rules tell you what to check. Local rules tell you how to document it, who can be onboarded remotely and how long records must be kept. A good workflow carries both.
Speed and safety are not a trade-off
Risk-based design is what makes onboarding fast. Clean, low-risk merchants pass automatically. Medium-risk merchants get targeted review. High-risk merchants get enhanced due diligence and registration. Analysts stop re-checking what a machine already verified and spend their time on the cases that need judgment.
How Onlayer sets this up with you
The tools
- Merchant Onboarding Service with dynamic journeys by merchant type, risk level and MCC across e-commerce, physical POS, pay-by-link and marketplace sellers.
- Built-in BRAM, VIRP, PCI DSS and AML checks, including prohibited product detection across 16 categories.
- Automated Decision Engine for Pass, Pass with Notes or Fail outcomes aligned with your policy, with a full audit log.
- AML / Sanction Checks against OFAC, UN, HMT, EU and Interpol lists, with more than 95% fewer false positives.
- PCI DSS Management with a wizard that guides each merchant to the correct SAQ.
- Mastercard-certified MMSP coverage from the first transaction onward.
The setup, with our advisory team
- Policy-to-rules workshop. We translate your risk and credit policy, scheme obligations and local regulation into decision rules.
- Journey design. We build onboarding journeys per merchant type and channel, including payment facilitator models.
- Back-book test. We re-scan a sample of your existing portfolio to calibrate rules on real merchants before go-live.
- Go-live and handover. We connect onboarding to monitoring so every approved merchant is watched from day one.
Clients using this model reduce onboarding SLAs by 82%, cut time-to-decision by 85% and see 60% fewer early-stage chargebacks.
Key takeaways
- Onboarding is now the first line of scheme compliance, with screening expected before the first transaction.
- One workflow should adapt to five merchant types.
- Correct MCC assignment is a scheme obligation, not a data entry task.
- Local regulation in the UAE, Saudi Arabia, Türkiye and the EU shapes how due diligence must be documented.
- Risk-based automation makes onboarding both faster and safer.
Frequently asked questions
What checks should an acquirer run before onboarding a merchant?
Business existence, product and content review, MCC verification, high-risk category mapping, AML and sanctions screening, security and PCI scope, and hidden-channel checks.
Do merchants need a monitoring scan before going live?
Under Mastercard's updated Merchant Monitoring Program, newly boarded merchants are expected to be screened by a registered MMSP before their first transaction from 1 January 2026.
How does onboarding differ for physical POS merchants?
The focus is proof of presence: address verification, street view and signage, reviews and linked online channels, often without a site visit.
Can onboarding be fast and compliant at the same time?
Yes. Risk-based journeys auto-approve clean merchants and send only exceptions to analysts.
Which regulations shape onboarding in the UAE and Saudi Arabia?
In the UAE, the CBUAE Retail Payment Services and Card Schemes Regulation and the 2025 AML law; in Saudi Arabia, the Law of Payments and Payment Services and SAMA KYC requirements.
Want faster approvals without new scheme risk?
Ask Onlayer for an onboarding workflow assessment.
Book a demo
