Merchant KYC And Onboarding

<p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><a name="_Toc89675708">Merchant Entity Fraud Managements</a><o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Developments in payments technology and fraud have tended to go hand-in-hand in the past. Payments giant Paypal, which arguably popularised money on the internet, was reportedly losing more than $1.6 Million every month on fraudulent transactions during early days. Paypal has since resolved those fraud issues, but a similar situation is arising today, with new avenues for fraud opening with India’s push for digital payments and the pandemic induced accelerated digitisation. The Reserve Bank of India (‘RBI’) reports an increase in both volume (28%) and value (159%) in reported financial fraud since last year.<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Increasing payment fraud even prompted a recent regulatory advisory for industry initiatives<a href="https://blog.cashfree.com/types-of-merchant-fraud-encountered-by-payment-aggregators-and-measures-to-tackle-it/#easy-footnote-bottom-3-2384">3</a> promoting user awareness. Tackling merchant based payment fraud however requires diligence at other levels as well. Acquirers like banks or payment aggregators (‘PAs’), bear the risk and responsibility here, being (often) the first to on-board merchants into the (digital) financial system. Here, the nature of merchant fraud PAs face and how they can be addressed is discussed.<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"> <p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><a name="_Toc89675709">Merchant fraud vs. transaction fraud</a><o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Payments fraud can take the form of ‘transaction fraud’, usually at the end-user level, consisting of unauthorised transactions, false refunds/chargebacks, etc. This often relies on extracted financial data via phishing, hacking databases, malware/screen-sharing apps, pagejacking to redirect legitimate traffic, etc. Remedies thus entail say security measures at the end-user level (mandatory AFA, payer authentication via 3-D Secure, tokenisation, SMS alerts, etc.) or merchant measures (cybersecurity checks, monitoring suspicious customer activity like multiple orders by the same person using different cards, alerts for scams like counterfeit product sale, etc.).<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Merchant fraud does involve transaction fraud, but can be differentiated given the source. It often revolves around the merchant’s identity, and resolution methods thus turn from user level diligence and security measures to merchant level monitoring and identity checks. Broadly, merchant fraud may be with the intention of duping individuals (fraudulent transactions), or the authorities (money laundering, tax evasion, terrorist financing). The former is challenging given multiple users can be defrauded simultaneously (unlike general transaction fraud that can be a single fraudulent transaction). Mandatory KYC, pre and post on-boarding merchant due diligence and transaction monitoring <a href="https://blog.cashfree.com/types-of-merchant-fraud-encountered-by-payment-aggregators-and-measures-to-tackle-it/#easy-footnote-bottom-8-2384">8</a> come together to tackle this fraud.<o:p></o:p><p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><a name="_Toc89675710">Forms of merchant fraud and the checks necessitated</a><o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt 36pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; text-indent: -18pt; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">1.    Forged KYC documents and Identity theft: Forged KYC documents allow fraud like identity theft, involving assuming a legitimate business’s identity by forging its key documents. Alternatively, the fraudster can create a new identity altogether, or claim authorisations, etc., that he doesn’t actually have. Document authenticity checks, signature matching, beneficial owner checks, etc., done via API based verification, eKYC/digital signature mechanisms, etc., are thus key here. Live photographs, geotagging and encouraging AI and face matching technology use in the RBI’s digital and video KYC processes also target effective digital equivalent of the original in-person KYC checks.<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt 36pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; text-indent: -18pt; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">2.    Faking business operations: This may be an inoperative business posing as operative say for AML/CFT activities, adopting a seemingly legitimate front to carry out illegitimate activities on the side, or attempting to circumvent restrictions on serviceable businesses. PAs for example adhere to bank defined lists of prohibited (eg.: drugs, hacking, tobacco)/ high-risk (eg.: pharmaceuticals, matrimony, job portals, travel agencies) businesses. Businesses from identified ‘high-risk’ jurisdictions also cannot be serviced. The fraud here allows a lower risk profile during on-boarding, and thereby the ability to operate. Actual site visits, examining balance sheets, credit history, etc., thus help. Domain name purchase dates, evaluating social media activity and customer reviews, can also reveal product legitimacy, possible shell companies, etc. The checks need to be on-going, for eg., merchant website content monitoring, checking product listings, etc. help track changes to the front demonstrated during on-baording. This also includes periodic updates of merchant risk categorisation and KYC.<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt 36pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; text-indent: -18pt; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">3.    Bust-out fraud: Fake business operations can also target effecting bust-out fraud. This involves a bank customer applying for and obtaining loan/credit lines, exhausting them and then abandoning the account without repayment. The fraud is typically characterised by high chargeback rates. PAs here can be used by fraudsters to create a fake storefront to process the required illicit payments.<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt 36pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; text-indent: -18pt; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">4.    Transaction laundering/ Factoring: Approved merchant accounts can be used for illegitimate transactions, creating a challenge distinguishing these from the merchant’s legitimate transactions. Transaction laundering for instance involves fraudsters using an existing merchant’s payment credentials, for payments through unreported/shadow sites without the acquirer/merchant’s knowledge. Factoring involves the misuse with the merchant’s collusion, say allowing unapproved vendors/affiliates, or even the merchant’s own alternate business/subsidiary/branch, to use its account.A significant concern is that money laundering becomes scalable this way, without efforts to fake storefronts, etc. for the credentials. IP whitelisting (limiting domains on which the credentials can be used), transaction monitoring (anomalies like Merchant Category Code violations, URL mismatches, transaction/chargeback/refund pattern changes, exceeding permitted limits, restructuring transactions to fall below reportable thresholds), etc. are key here.<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt 36pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; text-indent: -18pt; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">5.    Exploiting payments chain complexities: Payment service providers providing multiple payment services also need to be alert to misuse of the payments chain’s complexity. Take a fraudulent (say) gaming merchant routing customer funds collected through a PA’s service, for supposed direct payout to legitimate recipients (the gaming winners, their own commissions). This is instead disbursed to fraudulent recipients. This, for one, enables money laundering. Second, the customer funds don’t settle in the merchant’s legitimate bank account, allowing revenue concealment and hence tax evasion.<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt 36pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; text-indent: -18pt; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">6.    Monitoring for corporate fraud and AML/CFT: Some factors can indicate corporate fraud or AML/CFT concerns, like verification of beneficial owners, say investors identified from MCA documents (like shareholding patterns), against sanction/ PEP/ international AML/CFT lists. Manipulation/ alteration of financial  statements like balance sheets, forging invoices/ receipts to cover illegitimate transactions, unusual revenue patterns, etc. are other indicators.<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt 36pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; text-indent: -18pt; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">7.    End-merchant fraud: With new merchant categories emerging with innovation, like online gaming, virtual currencies and related services, various B2B platforms and aggregators, etc., risk levels need to be assessed separately by PAs. Relevant factors here include whether they are regulated, compliance levels and practices for end-merchant verification (particularly since these end-merchants gain indirect access to the financial system through the platform).  For example, consider misuse internationally of crowdfunding and P2P lending platforms for money laundering, scams with virtual currencies or their misuse for converting illegally obtained funds, enabling illegal cross-border funds transfers, etc.<o:p></o:p><p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><a name="_Toc89675711">Holistic monitoring for effective fraud detection</a><o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">For effective merchant fraud detection, thus a PA has to aim for holistic monitoring, covering the merchant’s entire portfolio. Turning to new age AI/ML based fraud detection systems will be essential. Data also holds significant promise as a risk mitigation technique, and the proposed exemption of its use as such as a ‘reasonable purpose’ under the upcoming Indian data protection law is thus welcome.<o:p></o:p><o:p> </o:p><o:p> </o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">As a payment aggregator (‘PA’), when we on-board merchants, we need to address certain risks that arise, like fraud, excessive chargebacks, money laundering, tax evasion, etc. For this, regulatory guidelines and applicable laws require us to adopt several precautionary measures, including the Know-Your-Customer (‘KYC’) and merchant due diligence procedures. We thus carry out a range of checks for merchants, which start prior to onboarding and continue until the end of merchant relationship with us. The processes discussed may be replicated by financial service entities or any other product that would want to onboard merchants onto platform — both to comply with regulations and to mitigate risk.<o:p></o:p><p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><a name="_Toc89675712">What is KYC?</a><o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Regulated financial institutions like banks, PAs, investment companies, etc., conduct KYC whenever a client attempts to open an account with them or onboards with them (eg.: the KYC process you undertake when opening a bank account). A client may be an individual or a legal entity. The aim is to establish the client’s identity, address and legitimacy via a verification of its key documents. In combination with due diligence and other mandated checks, these allow us to say identify potential fraudsters, shell companies, detect money laundering, etc. See -Merchant Fraud Management section. Often non regulated entities, like an online marketplace for example, need to also perform a full or partial KYC as a precaution. These allow us to take a step towards securing not only ourselves, but also the end-customers and the financial system as a whole.<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">As PAs we can service a range of businesses, from e-commerce marketplaces, financial services like lending/wealth management/ credit management/payments/insurance, etc., edtech, healthtech, digital entertainment and streaming services like video/music/gaming, subscriptions like for SaaS companies, hospitality/ transportation services like taxi aggregators/hotel booking aggregators/vehicle rentals, etc. The checks we undertake thus vary from business to business, particularly based on the merchant’s legal form and line of business.<o:p></o:p><img border="0" width="452" height="431" src="file:////Users/prem.kumar/Library/Group%20Containers/UBF8T346G9.Office/TemporaryItems/msohtmlclip/clip_image002.jpg" alt="Diagram Description automatically generated" v:shapes="Picture_x0020_5">Figure 1<o:p></o:p><p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"> <p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"> <p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"> <p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"> <p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"> <p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><a name="_Toc89675713">The Complete KYC Procedure</a><o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">The Reserve Bank of India’s (‘RBI’) Master KYC Direction, the RBI PA Guidelines and the Prevention of Money Laundering Act, 2002 (the ‘PMLA’) (among others), together require the following 8 stage process:<o:p></o:p><p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><a name="_Toc89675714">Step 1: The KYC document check or CDD process</a><o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">The first stage is the KYC document check or the Customer Due Diligence Check (‘CDD’) process. It can be one or more of the following forms- Individual KYC and Business KYC:<o:p></o:p><ul type="disc" style="margin-bottom: 0cm; color: rgb(0, 0, 0); font-size: medium;"><li class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(95, 112, 130); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Individual KYC : When a merchant who is an individual (eg.: a sole proprietor), we carry out a ‘KYC’ process, or CDD for an individual. Broadly, we verify merchant identity via an ‘Officially Valid Document’ or OVD check (identity documents like Aadhaar, passport, driving license, etc.), individual PAN verification, and if necessary, current address proof check (utility bills, etc.). We can also ask for more documents to verify merchant’s financial/business status, say asking for your business registration documents. <o:p></o:p></li></ul><ul type="disc" style="margin-bottom: 0cm; color: rgb(0, 0, 0); font-size: medium;"><li class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(95, 112, 130); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Business KYC : When an business entity getting onboarded by us, we carry out a Business KYC process, or CDD for a business. Here we replace the OVD check with an ‘entity-proof’ check. This again differs based on what type of entity merchants are legally. For example, if merchant is a company, we need to verify certificate of incorporation, memorandum and articles of association, etc. If merchant is a trust/partnership on the other hand, we will need  trust/partnership deed, registration certificates, etc. Once we’ve verified your licensing/registration, we need to ascertain that the officer/employee transacting with us on your behalf has the authority from merchant to do so. For this we need your relevant Board resolutions, power of attorney, etc. Next we need Business PAN, and  address proof (GST) if licensing/registration documents don’t reflect the current address. We also need to conduct  ‘beneficial owner’ checks i.e., we need to verify who has actual ownership/control, like the directors, shareholders, etc., and carry out the ‘KYC’ process separately for them. We also verify numerous other documents for due diligence processes (discussed below).<o:p></o:p></li></ul><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Platform KYC: Lastly, depending on the line of business as marketplace, marketplace may self-have on-boarded end-merchants. In turn, they may be needed to carry out a KYC or verification process for them as well, whether under regulations that apply to them or as an additional diligence measure<o:p></o:p><img border="0" width="387" height="698" src="file:////Users/prem.kumar/Library/Group%20Containers/UBF8T346G9.Office/TemporaryItems/msohtmlclip/clip_image004.jpg" alt="Diagram, timeline Description automatically generated" v:shapes="Picture_x0020_4">Figure 2<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Methods of verifying the documents also vary, like the traditional physical check (original seen and verified, in-person verification). Today digital checks like digital document and signature checks (eKYC, DigiLocker, etc.), API based verification, Digital KYC and Video KYC procedures are being introduced to ease the process and replace earlier physical checks. For us as a PA, relaxations are also being brought in to the CDD process, allowing us to rely on the KYC merchant would have already undergone while opening accounts with the bank merchant’s are banking with. In another welcome move, the RBI has extended the Central KYC Registry for legal entities, introducing a new mode for digital KYC for businesses via a KYC identifier (previously this was only allowed for individuals).  <o:p></o:p><p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><a name="_Toc89675715">Step 2: Verification against sanction and PEP lists</a> <o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Next, we need to verify the names of our merchants and their beneficial owners against certain lists, like national and international terrorist lists, or ‘Politically Exposed Persons’ lists. If a name matches a sanctions list, we also need to report this to the Financial Intelligence Unit of India (‘FIU-IND’). Along with these, we verify numerous other lists, like blacklists/ greylists/ defaulter lists for companies, directors, etc. issued by banks, the Ministry of Corporate Affairs, the Securities and Exchange Board of India, the Enforcement Directorate, the Office of Foreign Assets Control (U.S.), etc. (for a detailed list please see Appendix II below). These checks aid us in the fight against terrorism and money laundering, and also helps us define risk levels for a specific client.<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"> <p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"> <p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"> <p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><a name="_Toc89675716">Step 3: Onboarding policies and merchant screening</a><o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Next we carry out a background and antecedent check, which takes the form of an initial screening, and for which we define an internal merchant Onboarding Policy. Our aim here is to verify the nature, purpose and bona fides of a prospective client’s business. We conduct a range of checks such as licensing/registration checks, credit checks, profit and loss statement checks, balance sheet reviews, etc., based on information we seek directly from the prospective client, together with checking publicly available information like the merchant’s websites, product listings, end-customer reviews, social media activity, etc., to ascertain business legitimacy. We are also required under law to ascertain whether you are PCI-DSS compliant. <o:p></o:p><p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><a name="_Toc89675717">Step 4: Merchant profiling and diligence levels</a><o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">After these initial checks, we need to classify merchants as low/medium/high risk. Diligence levels and levels of post onboarding monitoring that we carry out are defined based on this, for example we need to conduct enhanced due diligence for PEPs, but simplified due diligence for self-help groups. Also, we are prohibited from servicing some businesses altogether (tobacco, hacking, gambling, weapons, etc.), while others are considered high-risk (pharmaceuticals, matrimony, gaming, security brokers, jewellery, etc.) requiring increased monitoring and diligence.<o:p></o:p><p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><a name="_Toc89675718">Step 5: Ongoing due diligence</a><o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Post onboarding, our due diligence checks will continue to keep track of any changes in merchant behaviour that are a cause for concern. For example, a change in merchant website details or an unexpected listing of high-risk products can indicate fraud. These may also call for reviewing merchant risk profiles and due diligence levels.<o:p></o:p><p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><a name="_Toc89675719">Step 6: Transaction monitoring</a><o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">A crucial check post onboarding we do is monitoring merchant transactions, to spot any possible red flags, such as variations in expected transaction characteristics. These can be expected total transaction volume, average order value, chargeback frequency, etc. For example, if a merchant exceeds the maximum permitted transaction limits, displays an unusual refund pattern, or we receive multiple end-customer complaints – these are causes for concern. In case of any suspicious transactions (say which raise money laundering concerns) and also transactions exceeding certain thresholds (eg. cash transactions above Rs.10L, cross border wire transfers above Rs.5L), they must be reported to FIU-IND by regulated entities. <o:p></o:p><p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><a name="_Toc89675720">Step 7: Record-keeping and Internal Governance requirements</a><o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Next, we keep records of all merchant transactions and identity documents, normally for at least 5 years. These need to be provided to authorities upon request, such as for an investigation. There are also numerous internal governance mandates to ensure effective implementation of requirements, like dedicated internal committees, internal audits, periodic risk assessments and adequate employee training. A Designated Director and a Principal Officer, who have specific reporting obligations under the PMLA, must also be appointed . <o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"> <p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"> <p class="MsoNormal" style="margin: 0cm; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 26.25pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><a name="_Toc89675721">Step 8: Periodic Updates</a> <o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-align: justify; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Lastly, we need to update both merchant risk profiles and KYC periodically. As per law, we must update merchant KYC every 10 (low risk), 8 (medium risk) and 2 (high risk) years. The ongoing due diligence checks also aid us with this.<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"> <p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"> <img border="0" width="370" height="698" src="file:////Users/prem.kumar/Library/Group%20Containers/UBF8T346G9.Office/TemporaryItems/msohtmlclip/clip_image006.jpg" alt="Graphical user interface, text, application Description automatically generated" v:shapes="Picture_x0020_3"><img border="0" width="451" height="585" src="file:////Users/prem.kumar/Library/Group%20Containers/UBF8T346G9.Office/TemporaryItems/msohtmlclip/clip_image008.jpg" alt="Graphical user interface, application Description automatically generated" v:shapes="Picture_x0020_2"><img border="0" width="452" height="597" src="file:////Users/prem.kumar/Library/Group%20Containers/UBF8T346G9.Office/TemporaryItems/msohtmlclip/clip_image010.jpg" alt="Graphical user interface, application Description automatically generated" v:shapes="Picture_x0020_1"><o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"> <p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"> <p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"> <p class="MsoNormal" style="margin: 0cm 0cm 7.5pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">List of Abbreviations<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt 36pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-indent: -18pt; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">1.    AMFI- Association of Mutual Funds in India<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt 36pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-indent: -18pt; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">2.    AoA- Articles of Association <o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt 36pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-indent: -18pt; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">3.    BBPS- Bharat Bill Payment System <o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt 36pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-indent: -18pt; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">4.    BIS- Bureau of Indian Standards<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt 36pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-indent: -18pt; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">5.    CBI- Central Bureau of Investigation<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt 36pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-indent: -18pt; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">6.    CBIC- Central Board of Indirect Taxes and Customs<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt 36pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-indent: -18pt; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">7.    CBSE- Central Board of Secondary Education<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt 36pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-indent: -18pt; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">8.    CDD- Customer Due Diligence<o:p></o:p><p class="MsoNormal" style="margin: 0cm 0cm 7.5pt 36pt; font-size: 12pt; font-family: "Times New Roman", serif; color: rgb(0, 0, 0); text-indent: -18pt; line-height: 24pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">9.    CIN-<span style="font-size: 13.5pt; font-family: "Open Sans", san

Explore

Quick Links