High-Risk Merchant Account Requirements

A business is classified as high-risk when its industry, geography or business model carries elevated chargeback, fraud or regulatory exposure. Card schemes and acquirers usually treat the following as high-risk: forex and CFD brokerage, online gaming and betting, crypto on-ramps, nutraceuticals and supplements, travel and ticketing, dating, adult, debt advice, subscription and free-trial models, and any merchant selling cross-border into multiple regulated markets.

Classification is not a rejection. It simply means the pricing, reserve terms and onboarding scrutiny differ from a low-risk retail account — and that the right acquiring partner matters far more than it would for a standard e-commerce store.

Every licensed institution runs Know Your Business checks before a merchant identifier is issued. Expect to provide:

• Certificate of incorporation and current company extract.
• Memorandum and articles of association.
• Full ownership chart down to every ultimate beneficial owner holding 10-25% or more.
• Passport or national ID plus a recent proof of address for each director and UBO.
• Corporate bank account details and recent statements in the company's name.
• Any licence or regulatory authorisation required in your target markets.
• A signed description of the business model, funnel and marketing channels.

Documents should be recent (generally under three months for statements and address proofs), legible, and consistent — mismatched company names or addresses between documents are one of the most common causes of delay.

Underwriters review the live site before approval. The URL you submit must be publicly reachable, in the same language as your target market, and must display:

• Legal entity name, registration number and registered address in the footer or imprint.
• Clear pricing, currency and a complete description of the product or service.
• Terms and conditions, refund/cancellation policy, privacy policy and cookie notice.
• Contact details including a working support email and, ideally, a phone number.
• Accepted card scheme logos and any required regulatory or risk disclaimers.
• For subscriptions: explicit billing frequency, renewal terms and a self-service cancellation route.
• A functioning checkout — test pages, coming-soon splash screens or password walls fail review.

If you have processed before, prepare three to six months of statements or a gateway export showing monthly volume, average ticket size, approval rate, refund ratio and chargeback ratio. Acquirers generally expect chargebacks under 1% of monthly transaction count, with card-scheme monitoring programmes triggering in that region. A higher ratio is not automatically disqualifying, but you will need a credible remediation plan — descriptor changes, 3-D Secure coverage, pre-chargeback alerts, tighter refund handling.

New merchants without history should expect a staged volume cap, a rolling reserve (commonly 5-10% held for 90-180 days) and a shorter settlement review cycle until a track record is established.

Because payment services are delivered by licensed institutions, their AML obligations become your onboarding requirements. Broadly, you should be able to evidence sanctions and PEP screening of your own customers, identity verification proportionate to ticket size, transaction monitoring for unusual velocity or patterns, and a named person responsible for compliance. Our AML & compliance standards outline the baseline we apply to every merchant we introduce.

• PCI DSS scope: hosted fields or a hosted checkout keep you at SAQ-A rather than full certification.
• 3-D Secure 2 support for EEA and UK flows to satisfy strong customer authentication.
• A clear, recognisable billing descriptor that matches the brand your customer bought from.
• Webhook handling for authorisations, captures, refunds and disputes.
• Agreed settlement cycle and currency — commonly T+7 initially, moving to T+1 with track record.

• Submit a complete pack in one go — piecemeal documents restart the review queue.
• Fix website gaps (terms, refund policy, imprint) before applying, not after a decline.
• Be explicit about traffic sources and any restricted geographies you exclude.
• Disclose prior declines or terminations up front; they surface in matching databases anyway.
• Apply to the right acquirer for your vertical and geography rather than applying broadly.

Norcapay is not a payment institution. We are the bridge between merchants and licensed providers: we review your model, match it to acquirers with genuine appetite for your vertical and geographies, prepare the application pack so it clears underwriting first time, and stay involved after go-live on routing, approval rates and settlement. Payment services themselves are provided by the introduced licensed institutions.

If you would like your setup reviewed against the checklist above, speak to our team.