Merchant Account Application: What Underwriting Needs

The ownership questions come from federal rule, not the processor

31 CFR 1010.230 requires covered financial institutions to establish and maintain written procedures reasonably designed to identify and verify the beneficial owners of legal entity customers, as part of the anti-money laundering compliance program required under 31 U.S.C. 5318(h). The institution must identify the beneficial owners at the time a new account is opened, either by obtaining a certification in the form of the rule's appendix A from the individual opening the account, or by obtaining the same information another way provided that individual certifies its accuracy to the best of their knowledge. That is why the form asks for a signature under a certification rather than just a list of names, and why an unsigned ownership page stops an application dead.

Who counts as a beneficial owner

The rule defines two prongs. The ownership prong is each individual who, directly or indirectly, through any contract, arrangement, understanding, relationship or otherwise, owns 25 percent or more of the equity interests of the legal entity customer. The control prong is a single individual with significant responsibility to control, manage or direct the entity, and the rule gives examples: a chief executive officer, chief financial officer, chief operating officer, managing member, general partner, president, vice president or treasurer, or any other individual who regularly performs similar functions. The rule's own note says up to four individuals may need to be identified under the ownership prong, and only one under the control prong, and that the same person may satisfy both. If a trust owns 25 percent or more, the beneficial owner for the ownership prong is the trustee. A legal entity customer means a corporation, limited liability company or other entity created by filing a public document with a Secretary of State or similar office, a general partnership, or a similar entity formed under foreign law; regulated financial institutions and SEC registrants are among the entities excluded.

The four identifying fields for each person

Verification has to meet at least the elements required for verifying individual customers under the banks' customer identification program rule. That rule requires, at a minimum, name; date of birth for an individual; address; and an identification number, which for a US person is a taxpayer identification number, and for a non-US person is a taxpayer identification number, or a passport number and country of issuance, or an alien identification card number, or the number and country of issuance of another government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard. Collect all four for every person you expect to name before you open the form, including any owner who is not involved day to day. Chasing a passport number from a silent 30 percent shareholder is the classic week-long delay.

What Visa requires the acquirer to get right

The acquirer must have a merchant agreement with each of its merchants, and must only accept transactions from an entity with which it has a valid merchant agreement. The agreement must include language requiring you to perform your obligations in compliance with applicable laws and regulations, to comply with the Visa Rules on use of the Visa-owned marks, acceptance, risk management and transaction processing, and not to knowingly submit any transaction that is illegal or that you should have known was illegal; and it must include Visa's right to limit or terminate the acquirer's agreement with you. Separately, unless otherwise required by law, the acquirer must assign to a merchant outlet the MCC that most accurately describes its business. That is why the business-description field is not a formality: it becomes your MCC, and your MCC follows you into interchange qualification and risk monitoring.

Your name, your website and your descriptor

Visa requires the name used to identify a merchant to be the name it primarily uses to identify itself to its customers, displayed at each merchant outlet or on the merchant's website or application, and used consistently including spelling on the transaction receipt, the authorization request, the clearing record and dispute records. The acquirer must correct non-compliant names or those causing cardholder confusion. So the doing-business-as name on the application should be the name a customer would recognise on a statement, not the holding company. For an e-commerce application, the practical consequence is that the site has to be live and consistent with the form before approval: the same business name, a working contact route and the policy pages that let a cardholder resolve a complaint without calling their bank.

The two numbers underwriting actually watches

Monthly volume, average ticket and maximum ticket come from the acquirer's own underwriting, not from the card rules, and your merchant agreement is where the consequences live. Understating them is not a harmless rounding: a sale well above a declared maximum is the kind of exception that triggers a review, and reviews hold funds. If your business has a genuine spread, say a normal ticket of a few hundred dollars and an occasional five-figure job, say so on the form rather than averaging it away, and tell the provider before an unusually large sale rather than after. Ask what happens operationally when a transaction exceeds the declared maximum, and get the answer in writing.

Why they verify rather than take your word

Underwriting scepticism has a public record behind it. On September 8, 2026 the FTC announced a $12 million order against Humboldt Merchant Services, alleging it opened and processed payments for merchants it knew, or consciously avoided knowing, were shell companies used by undisclosed third parties engaged in fraud, that it did so despite red flags, and that false or misleading information about merchants appeared in merchant account applications. The order permanently bans it from processing for straw companies, merchants on fraud watchlists, entities subject to law enforcement action, and e-commerce businesses using mailbox-only addresses without an established processing history. Two of those categories are things a legitimate business can trip over by accident, so if you use a mail-forwarding address or have no processing history, expect extra questions and have an explanation ready.

Documents and record retention

Alongside the ownership certification, assemble: the legal entity registration showing the exact legal name, the tax identification number, a void cheque or bank letter for the settlement account in that same legal name, and three months of processing or bank statements. A mismatch between the registered name and the bank account name is the most avoidable rejection on the list. Expect the file to outlive the relationship: Visa requires an acquirer or payment facilitator to keep a complete, well-documented file of merchant records, including anything connected to an investigation, for at least 2 years after the merchant agreement terminates. Keep your own copy of everything you submit, dated, for the same reason.