The 2026 Merchant Underwriting Framework: How PSPs Assess High-Risk Businesses Under PSD3, FCA & Global AML Standards

Merchant underwriting is undergoing its most significant transformation in over a decade. What was once a largely documentation-driven onboarding checkpoint has evolved by 2026 into a comprehensive, continuous, and data-verified compliance discipline. PSPs, acquirers, and payment institutions now face expanded regulatory obligations driven by the convergence of PSD3/PSR, the UK’s FCA Consumer Duty, and a new wave of FATF-led AML tightening across global markets.

For high-risk merchants such as gaming, subscription services, travel, dating, CBD, forex/CFD, and digital goods, the bar is no longer simply “operational readiness.” PSPs must be able to demonstrate to regulators that the merchant operates transparently, handles customer funds responsibly, maintains clear disclosures, and presents no material financial crime exposure.
This means underwriting in 2026 is deeper, stricter, and far more evidence-driven than ever before.

Where PSPs once relied on static KYB files, financial statements, and MCC selections, they must now evaluate business-model risk, behavioural patterns, AML alignment, dispute forecasts, operational resilience, marketing accuracy, and ongoing customer-outcome risk. Underwriting has expanded from a one-time approval process to an ongoing governance function, one that regulators expect to be continuously monitored, documented, and auditable.

This blog breaks down what has changed, how PSPs evaluate high-risk merchants under the 2026 framework, the documentation required, common failure points, and how merchants can prepare themselves to avoid onboarding delays, frozen accounts, or declined applications.

What Has Changed in the Global Underwriting Landscape (2025 → 2026)

The underwriting environment entering 2026 is fundamentally different from the one PSPs operated in just a few years earlier. Regulatory bodies, card schemes and financial crime authorities have all tightened expectations simultaneously. As a result, PSPs can no longer treat underwriting as an administrative function; it has become a risk-management obligation subject to regulatory inspection, enforcement and ongoing oversight. High-risk merchants now face the greatest scrutiny, and PSPs must justify onboarding decisions with evidence, transparency and continuous monitoring.

Three major forces shape this new landscape: PSD3/PSR in the EU, FCA Consumer Duty in the UK, and FATF-driven AML reform worldwide. Together, they elevate the standard of what “good underwriting” looks like, while raising the operational burden for merchants entering regulated payment ecosystems.

PSD3’s enhanced risk-scoring and authentication-driven underwriting

PSD3 shifts underwriting from a static review to a behavioural and data-driven evaluation. PSPs must now assess:

• Authentication quality (SCA performance, exemption usage, fallback logic)
• Data completeness (device, behavioural, session intelligence)
• Customer-consent clarity
• Dispute and fraud patterns
• Operational transparency

This means PSPs increasingly rely on transaction-level context, rather than just merchant-provided documents, to determine risk posture. High-risk MCCs face deeper analysis of refund flows, renewal mechanics, customer communications and historical dispute ratios.

FCA Consumer Duty impact on PSPs (and why it matters globally)

Even merchants outside the UK feel the impact of the FCA’s Consumer Duty, because many PSPs standardise their global underwriting to align with these expectations. Consumer Duty requires PSPs to ensure:

• Clear pricing and value
• Predictable customer outcomes
• Transparent terms (especially subscription renewal flows)
• Avoidance of “foreseeable harm”
• Adequate support and complaint-handling structures

This means PSPs must reject merchants whose UX, marketing, claims or support processes could create poor consumer outcomes. High-risk verticals such as dating, supplements, coaching and forex are particularly affected.

FATF-driven AML tightening and global KYB expectations

AML frameworks worldwide are converging toward FATF’s updated standards. PSPs must now implement:

• Enhanced due diligence (EDD) for high-risk merchants
• Strong UBO and ownership verification
• More robust sanctions and PEP screening
• Evidence of anti-fraud and AML monitoring systems
• Perpetual KYC (continuous updating, not periodic)

Regulators now hold PSPs accountable for merchant-level AML failures, making high-risk underwriting more stringent and documentation-heavy.

The 5-Pillar Underwriting Model for 2026

By 2026, PSPs no longer evaluate merchants using simple onboarding forms and basic KYB documentation. Instead, they follow a multi-layered risk model designed to assess business legitimacy, financial stability, AML exposure, customer-outcome risk and regulatory compliance. This structured approach ensures PSPs can justify their onboarding decisions to regulators, card schemes and auditors.

The modern underwriting framework revolves around five core pillars, each representing a category of risk that must be understood and mitigated before a high-risk merchant is approved.

Pillar 1: Business Model Risk Assessment

PSPs evaluate whether the merchant’s business model is:

• Clearly explained
• Supported by accurate disclosures
• Operationally feasible
• Not misleading or overly aggressive
• Aligned with the selected MCC
• Compliant with vertical-specific rules

This includes reviewing website content, marketing funnels, trial terms, product claims, age restrictions (where applicable), and customer communication pathways.

High-risk MCCs (gaming, adult, supplements, coaching) receive a deeper review, often requiring merchants to submit screenshots, funnel flows and product/service descriptions.

Pillar 2: Financial Risk Review

Financial due diligence focuses on:

• Liquidity strength
• Settlement and reserve requirements
• Ability to handle refunds or chargebacks
• Historical processing data (if the merchant is switching PSPs)
• Exposure to negative balance events
• Cash-flow predictability

PSPs must ensure that the merchant can absorb potential losses and operational volatility, especially in verticals prone to disputes or seasonality.

Pillar: Chargeback & Dispute Risk Forecasting

PSPs now model forecasted dispute behaviour before onboarding, using:

• MCC averages
• Chargeback-to-transaction ratios
• Trial conversions and renewal patterns
• Descriptor clarity
• Refund pathway visibility
• Fulfilment windows

Merchants with unclear terms, high dispute rates or poor UX may be rejected or required to implement remediation controls before being approved.

Pillar 4: AML/KYC & Fraud Risk Evaluation

AML assessment includes:

• KYB & UBO verification
• Sanctions & PEP screening
• Source-of-funds analysis (where applicable)
• Transaction-flow mapping
• Identification of shell entities or high-risk jurisdictions
• Fraud vectors (friendly fraud, synthetic identities, device anomalies)

High-risk merchants must often provide AML policy documents, training logs, monitoring tools and SAR handling procedures.

Pillar 5: Regulatory & Scheme Compliance Fit

PSPs also confirm that the merchant aligns with:

• PSD3/PSR requirements (EU)
• FCA Consumer Duty expectations (UK)
• Card scheme rulebooks (Visa GBPP, Mastercard BRAM)
• Vertical-specific laws (travel, dating, CBD, forex)

If any part of the customer journey or business model violates scheme or regulatory standards, the PSP cannot approve the merchant.

Documents Required for Modern Underwriting (2026 Edition)

Underwriting in 2026 is evidence-driven. PSPs must be able to justify every onboarding decision to regulators, card schemes and auditors, especially for high-risk MCCs. This means the documentation burden on merchants has increased significantly. Merchants must now provide complete, structured and verifiable evidence covering corporate identity, financial stability, operational capability, AML readiness and customer-facing transparency.

A missing document or inconsistent data point can delay, complicate or result in a declined underwriting application.

Corporate Documentation

PSPs must validate the merchant’s legal and operational existence. Required documents typically include:

• Certificate of incorporation
• Articles of association
• Shareholder and UBO register
• Director and officer IDs
• Operating licences (sector-dependent)
• Proof of address and registered office
• Corporate structure overview (especially for multi-entity groups)

For high-risk businesses, regulators expect clear visibility into ownership lineage and any offshore involvement.

Financial Documentation

Financial risk assessment is central to underwriting, especially for verticals with chargeback or refund exposure. Merchants must provide:

• Recent bank statements
• Audited or management financials
• Processing history (if switching PSPs)
• Reserve or rolling balance arrangements
• Details of funding flows and settlement accounts

PSPs assess whether the merchant can withstand operational volatility, refund spikes or dispute cycles.

Operational Documentation

To evaluate service reliability and customer-outcome risk, PSPs require evidence of:

• Fulfilment processes
• Customer support SLAs
• Complaint-handling procedures
• Refund and cancellation processes
• Business continuity plans

Operational weakness is a top reason PSPs reject high-risk merchants.

AML & Compliance Documentation

Under PSD3, FCA and FATF-aligned rules, AML is now a gating factor not a formality. PSPs expect:

• AML policy and risk assessment
• Transaction monitoring procedures
• SAR (Suspicious Activity Report) escalation workflows
• Staff AML training evidence
• PEP/Sanctions screening logic
• Source-of-funds checks (where applicable)

If AML documentation is weak or outdated, onboarding stalls immediately.

Website & Checkout Compliance Evidence

This is one of the most critical areas for high-risk underwriting. PSPs require:

• Screenshots of pricing pages
• Renewal terms and trial disclosures
• Checkout flows
• Cancellation pathways
• Refund-policy pages
• Marketing claims and ad funnels
• Sample email confirmations

Everything must match scheme and regulatory expectations. If disclosures are unclear, PSPs often issue remediation tasks before approval.

High-Risk Vertical Benchmarks (How PSPs Evaluate Each Category)

High-risk underwriting is never “one-size-fits-all.”
PSPs evaluate each vertical using its own benchmark profile, dispute behaviour, fulfilment challenges, regulatory obligations and fraud exposure. In 2026, these benchmarks are stricter, more data-driven and more aligned with both PSD3 and global AML expectations.

High-risk MCCs must therefore be prepared to meet category-specific standards, not just generic underwriting requirements.

1. iGaming (MCC 7995)

iGaming remains one of the most scrutinised sectors globally. PSPs assess:

• Licensing (jurisdiction, validity, scope)
• Age verification and identity controls
• Geolocation enforcement
• Responsible gaming disclosures
• Bonus/credit mechanics and withdrawal rules
• Fraud risk via account takeovers and bot behaviour

Weak verification processes or unclear bonus terms are among the most common reasons for onboarding rejection.

2. Travel & Ticketing (MCC 4722 & 4511)

Travel merchants carry high fulfilment and customer-dispute risk. PSPs closely examine:

• Clarity of itineraries and cancellation terms
• Delivery of e-tickets and confirmations
• Refund obligations
• Supplier exposure
• Operational resilience during disruptions

Chargebacks due to “service not rendered” remain the biggest underwriting concern.

3. Forex / CFD / Trading Platforms

This vertical is subject to intense regulatory oversight. PSPs assess:

• Licensing (FCA, CySEC, ASIC, etc.)
• Appropriateness tests and risk disclosures
• AML and transaction-monitoring strength
• Source-of-funds checks
• Withdrawal practices and customer-fund segregation

Unregulated brokers or entities with unclear fund flows are typically declined.

4. Adult & Dating

Adult entertainment and dating platforms are evaluated on:

• Age verification
• Consent and content-moderation controls
• Clarity of subscription and renewal terms
• Advertising compliance
• Complaint patterns and dispute ratios

PSPs require proof that the merchant prevents underage access and mitigates reputational risk.

5. CBD, Supplements & Nutraceuticals

These merchants face scrutiny due to fulfilment, claims and refund challenges. PSPs review:

• Legality of products in each geography
• Certificates of Analysis (COAs)
• Product-benefit claims
• Shipping/return processes
• Subscription-billing clarity

Aggressive marketing statements or unverified health claims are major underwriting fail points.

What PSPs Check Behind the Scenes (But Merchants Don’t See)

Most merchants assume underwriting is based only on the documents they upload.
In reality, PSPs perform extensive off-platform, behind-the-scenes checks to assess financial crime exposure, operational reliability, reputational risk and alignment with regulatory obligations. These checks determine whether a merchant is truly safe to onboard regardless of how polished their website or documentation may appear.

Understanding what PSPs look for behind the scenes helps high-risk merchants prepare more effectively and avoid unexpected declines or long onboarding delays.

Blacklists, MATCH and Prior Merchant History

Before a PSP considers onboarding, it checks global and scheme-level risk databases, such as:

• MATCH (Mastercard’s Terminated Merchant File)
• Visa VMAS and VROL alerts
• Internal acquirer risk logs
• Consortium blacklists (shared fraud databases)
• Historical termination notes from previous PSPs

A merchant that appears on MATCH especially for fraud, chargebacks, or AML-related reasons will face immediate rejection unless the PSP has strong remediation evidence.

Transaction Patterns & Hidden Risk Signals

PSPs simulate and model the merchant’s expected processing behaviour.
They look for:

• Processing spikes or unusual volume projections
• GEO or BIN pattern anomalies
• High-risk trial/renewal ratios
• Subscription cycles that predict high disputes
• Inconsistent settlement routing
• Behavioural indicators of bot traffic or synthetic IDs

If projected chargebacks or fraud exceed risk thresholds, the PSP may impose reserves or decline the application entirely.

Beneficial Ownership & AML Risk Profiling

Behind the scenes, PSPs thoroughly evaluate the merchant’s ownership, often more deeply than merchants expect.

Checks include:

• UBO screening against sanctions lists
• PEP (Politically Exposed Persons) detection
• Links to high-risk jurisdictions
• Historical financial crime associations
• Prior involvement in failed or fraudulent ventures

If ownership is opaque, offshore without justification, or linked to risky entities, underwriting is likely to fail.

Operational Readiness & Customer-Outcome Risk

PSPs also examine whether the merchant can deliver consistent, compliant customer outcomes. They review:

• Response times to customer complaints
• Refund-handling logic
• Subscription cancellation paths
• Fulfilment timelines and reliability
• Past reputation on trust platforms (indirectly monitored)

If a merchant demonstrates operational fragility or slow customer service, PSPs consider them too risky especially under FCA Consumer Duty standards.

Underwriting Fail Points (Why PSPs Decline High-Risk Merchants)

Even well-intentioned merchants are often surprised when underwriting fails at the final stage. In 2026, PSPs are required to apply higher scrutiny, stricter documentation standards and continuous verification especially for high-risk MCCs.
Underwriting failure is rarely about a single issue; it is usually the result of gaps in controls, missing evidence, or customer-outcome risks regulators classify as “foreseeable harm.”

Below are the most common fail points PSPs report across high-risk verticals.

Weak AML Framework or Incomplete UBO Transparency

This is the fastest route to a decline.

Under PSD3 and FATF expectations, PSPs cannot onboard merchants lacking verifiable AML controls.

Poor Website, Checkout or Disclosure Compliance

PSPs must reject merchants whose customer flows could cause disputes or regulatory exposure.

Fail indicators:

• Hidden or unclear pricing
• Missing renewal dates or trial terms
• Poorly visible cancellation paths
• Unsubstantiated marketing claims
• Conflicting or outdated refund policies

Under FCA Consumer Duty and PSD3, “unclear customer journeys” are now regulatory red flags.

Inconsistent Processing History or High Chargeback Exposure

PSPs review prior processing with a risk lens.
Fail points include:

• High historic chargeback ratios
• Excessive refunds
• Delivery failures
• Sudden volume spikes or unusual patterns
• MATCH/VMAS history

If the projected dispute rate is above thresholds, onboarding is paused or denied.

Missing Documentation or Incomplete Evidence Packs

Documentation gaps slow underwriting more than any other factor.

Common issues:

• No screenshots of pricing or renewal terms
• Outdated corporate records
• Missing bank statements
• Insufficient fulfilment evidence
• No AML training logs

PSPs require complete, auditable files to satisfy regulators.

Remediation & Fast-Track Approval Strategy

For high-risk merchants, underwriting success in 2026 depends on preparation and clarity. Most declines are avoidable when merchants understand what PSPs need and provide it in a structured, evidence-ready format. A strong remediation and fast-track strategy can reduce onboarding timelines from weeks to days.

Fixing UX, Disclosures & Pricing Transparency

PSPs will not approve merchants whose pricing or renewal terms are unclear.
Fast-track fixes include:

• Clear, front-loaded pricing
• Visible renewal dates and cancellation paths
• Accurate descriptors and refund terms
• Removal of misleading claims or aggressive upsells

These changes directly improve dispute forecasts and Consumer Duty alignment.

Strengthening AML & Compliance Documentation

Fast-track AML remediation typically includes:

• Updated AML policy + risk assessment
• Proof of sanctions/PEP screening
• SAR escalation workflow
• Staff training records
• Clear UBO structure documentation

PSPs must be able to evidence AML readiness to regulators.

Preparing a Complete Underwriting Dossier

The fastest approvals come from merchants who provide:

• Website & checkout screenshots
• Corporate + financial documents
• Processing history
• Support SLAs and fulfilment processes

A complete file removes friction for the PSP’s risk and compliance teams.

Maintaining Continuous Compliance

Fast-track onboarding only works when merchants demonstrate:

• Stable communication
• Predictable operations
• A willingness to implement controls quickly

PSPs favour merchants who operate like regulated businesses even when they aren’t.

Conclusion

Underwriting in 2026 is no longer a documentation exercise; it is a continuous compliance discipline shaped by PSD3, FCA Consumer Duty and global AML standards. PSPs must now justify every onboarding decision with evidence, transparency and ongoing monitoring, which means high-risk merchants must operate with stronger governance, cleaner disclosures and audit-ready documentation at all times.

Merchants who approach underwriting strategically fixing UX clarity, strengthening AML frameworks, preparing complete evidence packs and demonstrating operational readiness will benefit from faster approvals, better processing terms and long-term stability. Those who view underwriting as a minor administrative step will face delays, remediation demands or declined applications.

In a more regulated global payments landscape, underwriting maturity becomes a competitive advantage for every high-risk business preparing for 2026 and beyond.

---

FAQs