Payment gateway verification is where most online businesses meet Know Your Business (KYB) rules for the first time. Stripe, PayPal, Wise, Payoneer, Adyen, and Mollie all run substantively similar flows shaped by the same regulatory framework, but the practical experience varies enough that understanding the shared structure helps founders navigate any of them.
1. The KYB baseline. Every payment gateway collects: legal entity name and registration number, registered office address, articles of incorporation, a representative's personal KYC, beneficial-ownership disclosures for every 25 percent-plus shareholder, industry classification, expected transaction volume, and a linked settlement bank account. The exact document names vary by jurisdiction, but the categories are universal.
2. Industry risk classification. Gateways operate published or unpublished industry-risk lists. Sectors like crypto, adult content, gambling, cannabis, high-risk marketplaces, forex education, and dropshipping typically require enhanced review, higher rolling reserves, or outright decline. Choosing a gateway aligned with the business's industry appetite is the single largest predictor of a smooth onboarding.
3. Rolling reserves and holdbacks. New merchants often see a percentage of daily settlements held for a defined period — commonly 5–10 percent for 90–180 days. This is a chargeback-protection mechanism, not a punishment; it is standard for any acquiring rail and typically eases as the merchant's chargeback ratio stabilizes.
4. Chargeback ratios. Card networks enforce chargeback thresholds — typically 1 percent of transactions or 0.9 percent depending on the network's monitoring program. Merchants exceeding the threshold enter remediation and, if not resolved, face account termination and, in severe cases, MATCH-list placement that blocks new merchant accounts industry-wide.
5. PSD2 and SCA. In the EU and UK, Strong Customer Authentication requires an additional step (3D Secure 2, biometric, or hardware) on most consumer card transactions above a defined threshold. Gateways handle SCA orchestration, but merchants configure exemptions and monitor authorization rates. Poor SCA handling can drop conversion by five to ten points.
6. PCI DSS scope. Merchants that never touch raw card data — most gateway users — operate under SAQ A, the lightest self-assessment tier. Merchants that ingest card data, even through iframes not configured correctly, can find themselves in SAQ D scope with substantially heavier obligations. Confirming SAQ A scope at implementation avoids expensive surprises.
7. Regional coverage. Stripe operates directly in 45+ countries; PayPal in 200+ but with narrower functionality per market; Wise in 170+ for personal accounts with a more limited business footprint; Payoneer in 190+ for receiving accounts. The 'available country' claim is meaningful only when it maps to the specific product a business needs.
8. Fees. Card processing typically prices at 2.9% + fixed fee per transaction with cross-border and currency-conversion surcharges layered on. ACH, SEPA, and iDEAL are materially cheaper. Currency conversion is the least visible fee — typically 1–2% above interbank — and is often the largest line item for cross-border businesses.
9. Ongoing compliance. Once onboarded, gateways monitor transaction patterns, chargeback ratios, dispute-response quality, and beneficial-ownership changes. A quiet, well-behaved account rarely hears from compliance; an account with rapid volume changes, industry-mismatch signals, or dispute clusters commonly does.
For any business evaluating payment infrastructure, verification depth is one of the clearer proxies for gateway seriousness. A frictionless KYB on a real-money processor is a signal to interrogate; deliberate friction, well-executed, correlates with long-term account stability.