Merchant underwriting is the risk review a bank or payment processor runs before it lets your business accept credit and debit card payments. Every business that wants a merchant account goes through it, and the outcome shapes not just whether you’re approved but the fees, reserves, and processing limits attached to your account. A straightforward retail shop can clear underwriting in a day or two. A business model that makes underwriters nervous can wait a week or more, or get turned away.
What Underwriters Are Actually Looking At
The first data point is your Merchant Category Code, a four-digit classification the card networks assign based on what your business does. Visa, Mastercard, and the other networks derived these codes from Standard Industrial Classification codes originally, then consolidated and expanded them for their own risk purposes.1Visa. Visa Merchant Data Standards Manual A neighborhood bakery and an online gambling site sit in very different risk buckets. Travel agencies, adult entertainment, credit repair, and subscription businesses all draw heavier scrutiny because their transaction patterns produce more chargebacks and delivery disputes.
Personal credit matters too. Underwriters typically want a FICO score of at least 600 to 650 from the business owner, and higher-risk industries push that threshold up. They will also pull the company’s commercial credit report, often from Dun & Bradstreet, to check payment history, outstanding liens, and legal judgments.2Dun & Bradstreet. Business Credit Scores and Ratings
Then come the transaction figures. Monthly volume and average ticket size round out the financial picture. A business processing $10,000 a month in $50 transactions looks very different from one pushing $500,000 in $5,000 chunks. Larger individual transactions mean a single chargeback hits harder, so processors set their exposure limits accordingly. If your chargeback ratio already exceeds 1% of monthly transactions, expect stricter terms or outright denial. Both Visa and Mastercard use that 1% threshold as the entry point for their formal chargeback monitoring programs.3Moneris. Visa/MasterCard Fraud and Chargeback Program Thresholds Guidelines
Documents to Have Ready Before You Apply
Incomplete paperwork is the most common reason applications stall. The underwriter needs to verify your identity, your business’s legal existence, and your financial capacity. Gather these before you start:
- Your Employer Identification Number from the IRS, which you can retrieve from your original confirmation letter or request online.4Internal Revenue Service. Get an Employer Identification Number
- Your formation documents (Articles of Incorporation or Articles of Organization) filed with your state’s Secretary of State, showing your entity type.
- Three months of personal and business bank statements.
- Three to six months of prior processing statements if you’ve accepted cards before.
- Government-issued photo ID for every individual who owns 25% or more of the company. This threshold comes from the Customer Due Diligence Rule, which requires financial institutions to identify and verify the beneficial owners of any legal entity opening an account.5Financial Crimes Enforcement Network. FinCEN CDD Exceptive Relief Order
- A voided check from your business checking account, confirming the routing and account numbers where settlement deposits will land.6Nacha. Direct Deposit Without a Voided Check? Absolutely!
When you fill out the application, your legal entity name must match exactly what the IRS has on file. Your “Doing Business As” name is what customers will see on their card statements, so enter it carefully. The business address needs to be a physical location, not a P.O. Box.
Website Requirements If You Sell Online
If you accept payments online, an underwriter will review your website before approving your account. A missing element can stall or kill the application. Your site needs to show:
- Your legal or customer-facing business name, a physical address with city and country, and a phone number or email for customer contact.
- A description of the goods or services and the transaction currency.
- Return, refund, and cancellation policies, disclosed before checkout. Privacy and data-security policies need to be accessible too.
- A delivery policy, if you ship physical goods.
For refund and cancellation policies specifically, Visa requires that the disclosure appear in the checkout flow before the customer completes the purchase, either directly on the page or as a linked page the customer acknowledges through a click-to-accept button or checkbox. Subscription merchants and businesses using negative-option billing face additional requirements, including explicit cardholder consent and a confirmation email with cancellation instructions.7Visa. Visa Core Rules and Visa Product and Service Rules
How the Review Actually Unfolds
After you submit through the processor’s portal, the first pass is automated. Software screens your business against several databases in a matter of minutes. The most important check is against Mastercard’s MATCH system, short for Mastercard Alert to Control High-risk Merchants. This database contains records of businesses whose merchant accounts were previously terminated for excessive chargebacks, fraud, or other violations. All payment processors are required to check MATCH before approving a new merchant.8Stripe. High Risk Merchant Lists Acquiring banks also screen applicants against the Office of Foreign Assets Control sanctions lists and other government watchlists as part of their anti-money-laundering obligations.
If automated screening turns up nothing, a human underwriter takes over. The acquiring bank has obligations under the Bank Secrecy Act to make sure it isn’t facilitating money laundering or other illicit transactions through the accounts it sponsors.9FFIEC. Third-Party Payment Processors – BSA/AML Manual The underwriter checks that your financial documents are consistent, reviews your website for the required disclosures, and may ask for clarification on anything unusual in your statements or processing history. Background checks on business owners for criminal history or pending litigation are also common.
A clean low-risk file often finishes in two to three business days. Complex business models, high-risk industry codes, or incomplete paperwork can stretch that considerably.
The Three Possible Outcomes
Full approval lets you start processing right away up to your requested monthly volume. This is what most low-risk businesses with solid financials and clean history receive.
Conditional approval is where the interesting terms live. The processor agrees to take you on, but with guardrails. The most common one is a rolling reserve, where the processor withholds a percentage of each day’s sales and holds those funds for a set period, typically 90 to 180 days. A common arrangement is 5% of daily sales held for six months. Once the holding period passes, older funds release back to you on a rolling basis as new funds enter the reserve.10Stripe. Rolling Reserves 101: What They Are and Why They Matter The percentage typically ranges from 5% to 15% depending on your risk profile.11BlueSnap Support. Reserve FAQs
Processors may also cap your monthly volume, your maximum single transaction, or both. These limits let them watch your performance without carrying excessive exposure. After 6 to 12 months of clean processing with low chargebacks and stable volume, you can often negotiate to reduce or eliminate the reserve. Get the release criteria in writing before you sign. A vague promise to “review after six months” gives you no leverage when you ask for your money back.
If you’re denied, the processor sends a formal notice explaining why. Common reasons include poor personal credit, a high-risk business model the processor doesn’t want in its portfolio, incomplete documentation, or a MATCH listing. Denial from one processor doesn’t mean denial everywhere. Processors that specialize in high-risk merchants may still approve you, though their fees and reserve requirements reflect the added risk.
The MATCH List and Why It Follows You
Landing on the MATCH list is one of the worst outcomes a merchant can face. The list is maintained by Mastercard but used industry-wide. When a processor terminates your account and the reason meets specific criteria, they’re required to add you to the database. Reason codes include excessive chargebacks (monthly Mastercard chargebacks over 1% of sales and at least $5,000), excessive fraud (a fraud-to-sales ratio of 8% or higher in a calendar month with at least 10 fraudulent transactions totaling $5,000 or more), PCI non-compliance, transaction laundering, a principal owner’s fraud conviction, and data compromise.8Stripe. High Risk Merchant Lists
Once you’re on MATCH, the record stays for five years. Every processor checks it during underwriting, so a listing makes opening a new merchant account extremely difficult. Processors willing to work with MATCH-listed businesses charge significantly higher fees and impose stricter reserves. Some businesses shift to ACH transfers or cash while they wait out the listing period.
The Personal Guarantee You’ll Be Asked to Sign
Almost every merchant account application requires the business owner to sign a personal guarantee, and many applicants gloss over it. The guarantee makes you personally liable for chargebacks and other financial obligations if the business can’t cover them. This isn’t limited to high-risk merchants. It’s standard across the industry. Processors sometimes waive it for publicly traded companies or businesses with strong multi-year financials, but those exceptions are rare.
The practical impact is significant. If the business closes or goes insolvent while customers are still filing chargebacks, the acquiring bank can pursue your personal assets to recover its losses. Sole proprietors and general partners already carry personal liability by default. But if you structured the business as an LLC or corporation specifically to separate personal assets from business debts, a personal guarantee effectively punches through that protection for merchant account obligations.12National Credit Union Administration. Personal Guarantees
The most aggressive form is an unlimited, joint, and several guarantee. “Unlimited” covers all obligations to the processor, including future ones. “Joint and several” means if multiple owners signed, the processor can pursue any one of you for the full amount.12National Credit Union Administration. Personal Guarantees Read the guarantee language carefully. If you default, the processor can pursue collection through lawsuits and wage garnishment. Filing personal bankruptcy is the only reliable way to discharge a personal guarantee, and that comes with its own consequences.
What Happens After You’re Approved
Underwriting doesn’t end when your account goes live. Processors and card networks continuously monitor merchant activity, and your account can be reviewed, restricted, or terminated at any time if your risk profile changes. Your acquiring bank watches for red flags like sudden spikes in volume or average ticket size, transactions from unexpected geographic regions, and changes to the products or services listed on your site. A coffee shop approved at $10,000 per month that suddenly processes $50,000 in a week will trigger a review. If you change your business model after approval, notify your processor and expect potential re-underwriting. Operating outside your approved Merchant Category Code can end in account termination and a MATCH listing.
You also take on an ongoing obligation to protect cardholder data under the Payment Card Industry Data Security Standard. PCI compliance is not optional. Failure to comply is one of the specific reason codes for MATCH listing, and your processor can terminate your account for it.8Stripe. High Risk Merchant Lists Your requirements depend on annual transaction volume. Merchants processing over six million transactions per year face the most rigorous rules, including an annual on-site assessment by a Qualified Security Assessor and quarterly network scans. Most small businesses fall into the lowest tier, processing fewer than one million transactions annually, and can satisfy their obligations by completing an annual Self-Assessment Questionnaire and maintaining basic security controls.
Processors typically charge a monthly or annual PCI compliance fee, and many add a separate non-compliance fee if you haven’t validated your status. Non-compliance charges accumulate monthly until you complete your assessment. The real risk is what happens after a breach. If card data is compromised and you weren’t PCI-compliant at the time, the resulting fines from the card networks and liability for fraudulent transactions land on you.
One final thing to check before you sign: the contract itself. Merchant processing agreements often run three years with an automatic renewal clause. Early termination fees are the most common surprise. Some processors charge a flat fee if you cancel before the term ends. Others use a liquidated damages formula that multiplies your average monthly processing fees by the number of months remaining on the contract, which can produce a bill far larger than a flat fee. A handful of states have capped early termination fees or imposed specific disclosure requirements, so enforceability depends partly on where you operate. Courts generally won’t enforce a termination fee grossly disproportionate to the processor’s actual losses. Also scrutinize rate-increase clauses that let the processor raise your discount rate with 30 days’ notice, and equipment lease terms that may be non-cancellable even after you close the merchant account.