Why the paperwork is so heavy
Payment providers are regulated financial businesses, and the checks they run on you are not optional internal bureaucracy. The international baseline comes from the Financial Action Task Force Recommendations, which require financial institutions to identify and verify customers, including the natural persons who ultimately own or control a legal entity, and to keep that information current. Local regulators then transpose this into national rules, and payment institutions that fail to apply it face licensing consequences. On top of that sits scheme-level risk policy and the provider's own appetite by country and industry. The result is that a slow onboarding is rarely caused by one impossible document. It is caused by small mismatches: a company name that differs from the registry, a shareholder below the threshold who was left out, a website with no refund policy, or a volume forecast that contradicts the business description. Precision beats speed here.
- Assume every document will be checked against an official registry rather than taken at face value.
- Match names, addresses and dates exactly across every file you submit.
- Answer the business description question in plain language, because a risk analyst reads it, not a bot.
- Expect repeat requests after onboarding, because ownership and risk profiles are reviewed periodically.
Company registration and proof you are in good standing
The first document is proof that the legal entity exists and is allowed to trade. That usually means a certificate of incorporation or an extract from the company registry showing the legal name, registration number, registered address, status and directors. Some jurisdictions require a recent extract rather than the original certificate, and several require it to be dated within a set number of months. Alongside it you will be asked for the constitutional documents, such as the memorandum and articles of association, and for a tax identification number. Why: the provider has to know which legal person it is contracting with, whether that person can enter into a contract, and whether it is in good standing rather than struck off or in liquidation. Prepare the extract, the constitutional documents and the tax certificate together, and keep digital originals rather than scans of scans.
- Download a fresh registry extract rather than reusing the certificate issued at incorporation.
- Check that the registered address on the extract matches the address on your application.
- Include the tax identification certificate, because several providers will not open an account without it.
- Keep digital originals in one folder, since repeated photocopying degrades documents enough to cause rejection.
Beneficial owners and control persons
This is where most applications stall. Providers must identify the natural persons who ultimately own or control the business, not just the entities on the share register. The common benchmark is twenty-five per cent of shares or voting rights, though some jurisdictions apply lower thresholds and some providers apply stricter internal ones regardless. Where a company sits in the chain, they will expect you to look through it to the individuals behind it. You will be asked for an ownership chart showing percentages, government-issued photo identification and proof of residential address for each person above the threshold, and often for directors and authorised signatories too. Each of those people will be screened against sanctions, politically exposed person and adverse media lists. If no individual meets the ownership test, expect to be asked who exercises effective control by other means, and to name a senior managing official as a fallback.
- Draw the ownership chart yourself, down to natural persons, before the provider asks for it.
- Confirm whether any jurisdiction in your structure uses a threshold below twenty-five per cent.
- Collect identification and address proof for every owner, director and authorised signatory in advance.
- Flag any politically exposed person early, because it adds review time rather than ending the application.
Proof of address and proof of the bank account
Two documents are frequently confused, so keep them separate. Proof of business address demonstrates where the entity operates: a utility bill, a lease, or a bank statement showing the address, usually dated within the last three months. Proof of the bank account demonstrates that the settlement destination belongs to you: a bank letter, an account confirmation, or a statement showing the account name, number and the entity's name. Why both: the first establishes jurisdiction and substance for risk purposes, and the second prevents a classic fraud pattern where an account in a third party's name is nominated for settlement. The practical failure mode is a mismatch, where the account name differs from the registered company name by one word, or the address on the bill differs from the registry. Resolve those before submission rather than explaining them afterwards.
- Use documents dated within the last three months, because older ones are routinely rejected.
- Make the bank account name match the registered legal name exactly, including punctuation.
- Keep business address proof and settlement account proof as separate files with clear names.
- If you trade under a brand name that differs from the legal name, say so explicitly in the application.
Your website, product and pricing will be reviewed
A risk analyst will open your site and read it, and what they are looking for is whether the business described in the application matches the business a customer would experience. That means a visible description of what you sell, prices in a stated currency, delivery or access terms, a refund and cancellation policy, contact details, and terms and conditions. Missing refund terms are one of the most common causes of delay, because they matter directly to dispute risk. If you sell digital goods, expect questions about how delivery is evidenced and how a customer cancels. If you sell on a marketplace or through social channels rather than your own site, be ready to show those instead. Screenshots of the actual checkout flow help, because they let the analyst see the payment step without creating a test order.
- Publish a refund and cancellation policy before you apply, not after approval.
- Show prices with a currency, and state where you ship to or which markets you serve.
- Include real contact details, because an unreachable merchant is a risk flag.
- Prepare screenshots of the live checkout showing the payment methods and the policy links.
Processing history, volume forecast and industry licences
Providers ask for numbers because they price and risk-assess on them. Expect to state expected monthly volume, average order value, maximum single transaction, the main customer geographies, and the split across payment methods. If you already process elsewhere, three to six months of statements are persuasive, particularly your dispute and refund rates. Be realistic rather than ambitious: a forecast that is wildly above your current volumes invites a lower cap and a reserve, and a forecast that is wildly below what you then process triggers a review. Alongside this, some industries need their own permissions. Financial services, gambling, gaming with chance-based mechanics, travel, ticketing, pharmaceuticals, precious metals and anything involving virtual assets or adult content typically draw additional questions or fall outside a provider's accepted categories entirely. Declare your category honestly at the start, because a mismatch discovered later is much more expensive.
- Base the forecast on realistic traffic and conversion assumptions, and be ready to explain them.
- Bring three to six months of processing statements if you have them, including dispute and refund rates.
- Declare your exact category up front rather than describing it in the friendliest possible terms.
- Ask for written confirmation that your category is accepted before any engineering work starts.
How to assemble one pack you can reuse
Providers ask for the same things in different orders, so build the pack once and keep it current. Create a folder with clearly named files: registry extract, constitutional documents, tax certificate, ownership chart, identification and address proof for each owner and director, business address proof, bank account confirmation, website screenshots including the checkout, the refund policy as published, and a one-page business description with the volume forecast. Keep everything as a digital original in PDF where possible, and record the date you obtained each document. Refresh the date-sensitive items every three months. When you apply to a second provider, you will be filling in forms rather than chasing files, which typically removes more time from the process than any negotiation with an account manager. Treat it as a living compliance asset, because providers re-review periodically and ownership changes trigger fresh checks.
- Build the pack once with clear file names, then reuse it for every provider application.
- Record the date each document was obtained, and refresh date-sensitive items quarterly.
- Keep a one-page business description and volume forecast that you can paste into any application.
- Update the pack immediately when ownership, directorship or registered address changes.
Questions merchants ask
Why does a payment provider need my beneficial owners' passport copies?
Because anti-money-laundering standards require financial institutions to identify the natural persons who ultimately own or control a business, not just the registered entity. The common benchmark is twenty-five per cent of shares or voting rights, though some jurisdictions and providers use lower thresholds. Each person is then screened against sanctions and other watchlists.
How long does payment onboarding usually take?
It depends on your structure, your industry and how complete your submission is. Simple single-entity applications move fastest, while multi-jurisdiction ownership, regulated categories or missing documents add weeks. The biggest avoidable delay is an incomplete first submission, so preparing one complete pack before applying usually matters more than anything else. Multi-jurisdiction ownership structures and regulated categories add the most time.
What is proof of address and why do they want it?
It is a recent utility bill, lease or bank statement showing where the business operates, usually dated within three months. It establishes jurisdiction and substance for risk assessment. It is separate from proof of your settlement bank account, which shows that the account receiving your money belongs to your legal entity. Keep both documents current, because expired or mismatched files are a common cause of delay.
Do I need a local company to accept local payments?
Not always. Many providers contract with foreign-registered entities for local payment methods, while direct local acquiring often requires a local entity and bank account. It varies by country, method, industry and provider. Ask which legal entity will contract with you and which will settle to you, and get it in writing. The answer can differ for each payment method you want, so check them one at a time.
Why was my application rejected or delayed?
The common causes are mundane: names or addresses that do not match the registry, missing beneficial owners below the threshold, no published refund policy, an unclear business description, or a volume forecast that contradicts the website. Ask the provider for the specific reason in writing, fix the root cause, and resubmit rather than applying elsewhere with the same pack.
Will I be asked for these documents again after approval?
Yes, periodically. Providers are required to keep customer information accurate and current, so expect scheduled refreshes, and expect fresh checks whenever ownership, directorship or your registered address changes. Sanctions and watchlist screening also runs continuously. Keeping one well maintained document pack turns any of those reviews into a formality rather than a scramble for files.