KYC (Know Your Customer)

KYC comes from anti-money-laundering law. In the US, the Bank Secrecy Act and the USA PATRIOT Act require financial institutions to run Customer Identification Programs, and those obligations flow contractually from sponsor banks down to processors, payment facilitators, and ISOs. In payments, KYC applies to the people behind a merchant: owners, control persons, and beneficial owners: under FinCEN’s beneficial ownership rules, generally anyone holding 25% or more of the company, plus one individual with management control.

How it works

At application, each covered individual provides name, date of birth, address, and a government identifier such as an SSN. Verification services check those details against credit bureau records, public data, and document checks (a driver’s license photo matched against a selfie, for higher-assurance flows). Every individual is screened against the OFAC sanctions list and politically-exposed-person databases. Most legitimate applicants pass automatically in seconds; mismatches (a typo in a date of birth, a recent address move) route to document upload or manual review. Screening is not one-time: sanctions lists change, so ongoing monitoring re-checks existing customers.

Why it matters

For platforms embedding payments, KYC is the part of merchant onboarding most likely to create signup friction, and the quality of the provider’s verification stack determines how much. The practical questions: what data is collected and can it be collected inside your own UI via API, what share of applicants verify instantly, and what the fallback flow looks like when someone fails the automatic check. KYC pairs with KYB, which verifies the business entity itself, and both feed the broader underwriting decision.

QorPay runs KYC as part of its Automated Underwriting module, with boarding data collected through the QorCommerce v3 API so platforms keep control of the signup experience.