# Merchant Underwriting Explained: Why Providers Say No

> How merchant underwriting works, what payment providers assess before and after approval, why rolling reserves happen, and how to pass review first time.
- **Author**: Aarthi Poonia
- **Published**: 2026-08-02
- **Category**: Payments, Compliance
- **URL**: https://dodopayments.com/blogs/merchant-underwriting-explained

---

You launched, wired up a checkout, took your first fifty payments, and then an email arrived asking for a certificate of incorporation, a director's passport, a working demo login, and an explanation of why your projected monthly volume tripled in three weeks. That email is merchant underwriting.

Merchant underwriting is the risk assessment a payment provider runs to decide whether it will accept the financial and regulatory liability of processing your sales. It is not a credit check in the lending sense. It is an estimate of how much the provider stands to lose if your customers dispute their charges, if you stop delivering, or if a regulator decides you should never have been onboarded.

That framing explains almost everything confusing about the payment underwriting process: why a profitable business gets declined, why approval can be revoked months later, and why the provider sometimes holds a slice of your revenue.

## What Merchant Underwriting Actually Assesses

Underwriters assess six things: who you are, whether the business is real, what you sell, how likely customers are to dispute, how much you will process, and whether you can absorb losses. Everything on a merchant account underwriting form maps back to one of those six.

| What underwriters look at | Why it matters |
| --- | --- |
| Legal entity and registration documents | Confirms the business exists and the contracting party is who they claim to be |
| Identity and ownership of directors and beneficial owners | Sanctions, adverse media, and fraud screening attach to people, not just companies |
| Product description and live website | Determines the risk category, and whether the promise made at checkout is deliverable |
| Refund policy, terms, and support contact | Poor policy disclosure is one of the strongest predictors of dispute volume |
| Delivery method and level of automation | Instant digital delivery is low risk. Long fulfilment gaps and manual delivery raise it |
| Projected monthly volume and average order value | Sets the provider's maximum exposure if every transaction were reversed at once |
| Financial stability and operating history | Determines whether you could fund refunds from your own balance sheet if sales stopped |
| Prior processing history and terminations | A previous account closure is the single strongest negative signal in underwriting |

The two that founders underestimate are ownership screening and delivery risk. On Dodo Payments, identity verification runs through Persona using a government-issued ID plus a liveness selfie, and registered entities must additionally disclose every director and every beneficial owner holding 10% or more of shares, capital, or profits, as set out in the [account verification documentation](https://docs.dodopayments.com/miscellaneous/verification-process). That threshold is the level at which anti-money-laundering rules in most jurisdictions require a named human behind the company.

Delivery risk matters because a dispute is fundamentally a claim that the buyer did not get what they paid for. A SaaS product that grants access the second a payment clears carries very little of that risk. A product delivered manually two weeks later carries a lot.

## Automated Onboarding vs Manual Merchant Underwriting

Most modern providers run a two-track model: automated approval for businesses that fit a known low-risk pattern, and manual review for everything else. The difference is not the standard applied, it is who applies it.

Automated onboarding uses document checks, entity lookups, website crawls, and sanctions screening that resolve in minutes. Manual review is triggered by ambiguity, not wrongdoing. A site that does not clearly say what is being sold, an entity in a jurisdiction with thin public registry data, a product near a restricted boundary, or a large projected volume will each route your file to a compliance analyst.

```mermaid
flowchart TD
    A[Sign up and submit business details] --> B{Entity and identity resolve cleanly?}
    B -- No --> M[Manual compliance review]
    B -- Yes --> C{Product category unambiguous?}
    C -- No --> M
    C -- Yes --> D{Projected volume within automated limits?}
    D -- No --> M
    D -- Yes --> E[Approved for live payments]
    M --> F{Additional documents requested}
    F --> G{Policy and risk assessment}
    G -- Pass --> E
    G -- Conditional --> H[Approved with reserve or volume cap]
    G -- Fail --> I[Declined]
    E --> J[Ongoing monitoring]
    H --> J
    J -- Threshold breach --> M
```

Speed is therefore largely within your control. Dodo Payments publishes a typical verification window of one to three business days, with most reviews completing inside 72 hours. Files that stall are almost always files where something did not match, not files where something was wrong.

For how onboarding differs across account models, our guide on how to [accept credit cards without your own merchant account](https://dodopayments.com/blogs/accept-credit-cards-without-merchant-account) covers the structural alternatives, and [what a merchant of record is](https://dodopayments.com/blogs/what-is-a-merchant-of-record) explains who holds the acquiring relationship in each case.

## Why Some Verticals Face Higher Underwriting Scrutiny

Verticals attract scrutiny because of measurable loss history, regulatory exposure, or both. "High risk" is an actuarial judgement, not a moral one, layered with the reality that acquirers and card networks can fine the provider for a merchant's behaviour.

| Category | Underwriting concern |
| --- | --- |
| Adult and intimacy content | Card network restrictions, elevated dispute rates, reputational exposure for the acquirer |
| Gambling and games of chance | Jurisdiction-by-jurisdiction licensing, chargeback volume, AML sensitivity |
| Financial products, lending, and investment advice | Licensing requirements and consumer-protection liability |
| Health, wellness, and supplement claims | Unverifiable claims drive both disputes and regulator attention |
| Travel, ticketing, and bookings | Long delivery gaps leave the provider exposed for months before service is rendered |
| Marketplaces and multi-vendor resale | Funds flow to third parties the provider cannot verify |
| Crypto and virtual asset services | AML obligations plus partner-level restrictions |
| Manual and consultative digital services | Value sits in human labour, so quality disputes are hard to defend with evidence |
| Aggressive trial-to-paid subscriptions | Unexpected renewal charges are a leading cause of friendly fraud |

Then there is the middle band: categories that are not prohibited but need enhanced due diligence. Dodo Payments names AI content generation tools, marketing and outreach tools, resume and hiring tools, astrology and spiritual services positioned as entertainment, voice and music generators, e-books, and productised services in its [merchant acceptance policy](https://docs.dodopayments.com/miscellaneous/merchant-acceptance). Businesses in this band are usually approved, just asked for disclaimers, demo access, or policy links first.

If you have already been shut down elsewhere, our guide on [what to do when a Stripe account is banned](https://dodopayments.com/blogs/stripe-account-banned-alternative) covers how to present that history rather than hide it.

## What Triggers a Merchant Underwriting Review After You Are Live

Approval is a snapshot, not a permanent status. Providers run ongoing monitoring, and specific events pull your account back into review.

- **Dispute ratio crossing a monitoring threshold.** The most common trigger, and the one with hard numbers attached.
- **A volume spike far above your projection.** If you told underwriting you would process 20,000 dollars a month and you process 400,000, the provider's exposure multiplied while its assessment stayed the same.
- **A change in what you sell.** A new product line, brand, or fulfilment channel can move you into a category you were never approved for.
- **Refund rate climbing.** Not a network violation, but a reliable signal of product or expectation problems that become disputes.
- **Card testing traffic on your checkout.** A wave of small authorisations from a bot is treated as a security failure on your side. Our guide to [card testing fraud](https://dodopayments.com/blogs/card-testing-fraud) covers detection and mitigation.
- **A partner or regulator flag.** Acquirers, sponsors, and compliance vendors escalate merchants independently of what the provider observes.

### The chargeback thresholds that actually exist

Card networks operate formal monitoring programmes with published, numeric thresholds. Two matter for card-not-present businesses.

Visa consolidated its legacy fraud and dispute programmes into the Visa Acquirer Monitoring Program (VAMP), effective 1 April 2025. The VAMP ratio counts fraud reports (TC40) plus disputes (TC15) over settled card-not-present transactions (TC05). Per Visa's published VAMP fact sheet, an individual merchant is identified as Excessive at 220 basis points, reduced to 150 basis points on 1 April 2026 for merchants in the US, Canada, the EU, and Asia-Pacific. Merchant-level monitoring only engages once you record at least 1,500 combined fraud and dispute events in a month. Acquirer portfolios are held far tighter: 50 basis points for Above Standard, 70 for Excessive.

Mastercard runs the Excessive Chargeback Merchant programme, with two conditions that must both be met. Standard ECM is 100 to 299 first-presentment chargebacks in a month combined with a chargeback-to-transaction ratio of 1.5% or higher. High ECM is 300 or more chargebacks with a ratio of 3% or higher. The ratio uses the current month's chargebacks over the prior month's sales, and exiting requires three consecutive months back under the threshold.

Two things follow, both counterintuitive. A small merchant almost never hits network monitoring, because the event-count floors are high. That does not make you safe, because your provider's internal limit is what actually governs your account, and providers set it well below the network line to protect their own portfolio ratio. Ask what that internal threshold is rather than assuming the published network number applies to you.

Our [dispute management guide](https://dodopayments.com/blogs/dispute-management-guide) and the [chargeback fraud prevention](https://dodopayments.com/blogs/chargeback-fraud-prevention) playbook cover the operational side, and [chargeback protection](https://dodopayments.com/blogs/chargeback-protection) explains the pre-dispute tooling that keeps qualifying cases out of your ratio. Dodo Payments surfaces live dispute status in the [disputes dashboard](https://docs.dodopayments.com/features/transactions/disputes) so you watch the number rather than discover it in an email.

## Rolling Reserves and Why They Get Imposed

A rolling reserve is a percentage of your settled volume that the provider withholds for a fixed period before releasing it, on a rolling basis, so that once the cycle matures you receive steady payouts with the reserve balance staying roughly constant.

The reserve exists because of timing. A customer can dispute a card transaction months after it settles, but your payout arrives in days. If the provider has already paid you and you have spent the money, the provider funds the reversal. A reserve closes that gap without ending the relationship.

Reserves are typically imposed when your category has a long delivery window, your dispute or refund rate is elevated, your volume grew faster than your underwriting file supports, or you are new with no processing history in a category that needs one. They are usually negotiable downward after a clean run of months. Get the release criteria in writing when the reserve is set, because "we will review it" is not a criterion. They also change your cash flow model in a way founders miss: on thin margins, a reserve is a direct revenue delay for as long as the hold period runs. Our breakdown of [how merchant of record payouts and settlement work](https://dodopayments.com/blogs/mor-payouts-settlement-explained) covers how holds, thresholds, and payout schedules interact.

## Account Termination and the MATCH List

Termination ends a provider relationship. MATCH placement is what can follow it, and the two are not the same thing.

MATCH stands for Mastercard Alert to Control High-risk Merchants. Acquirers are required to query it before signing a new merchant agreement, and to add a merchant they have terminated for one of Mastercard's defined reason codes. The system searches records added by any acquirer over the preceding five years, which is why a listing is commonly described as a five-year problem.

Fourteen reason codes exist. Most describe conduct: laundering, illegal transactions, collusion, identity theft, fraud conviction. Two carry explicit numeric criteria, and these are the ones that catch otherwise legitimate businesses:

- **Code 4, Excessive Chargebacks.** Mastercard chargebacks in a single month exceeded 1% of Mastercard sales transactions in that month, and those chargebacks totalled USD 5,000 or more.
- **Code 5, Excessive Fraud.** The fraud-to-sales dollar volume ratio was 8% or greater in a calendar month, and the merchant effected 10 or more fraudulent transactions totalling USD 5,000 or more in that month.

Note how much lower the MATCH chargeback criterion is than the network monitoring thresholds. A merchant well below Visa's or Mastercard's programmes can still meet MATCH criteria, because MATCH attaches to termination rather than to monitoring.

Removal is narrow. A processor can remove a listing only if it was added in error, or if the listing was for PCI DSS non-compliance and compliance has since been restored. There is no general "we fixed it" appeal, which is the strongest argument for treating your dispute ratio as a weekly operational metric rather than a problem to address after the warning email. Our guides to [chargeback prevention for SaaS](https://dodopayments.com/blogs/chargeback-prevention-saas) and [friendly fraud prevention](https://dodopayments.com/blogs/friendly-fraud-prevention) cover the controls that keep the number down, and [PCI compliance for SaaS](https://dodopayments.com/blogs/pci-compliance-checklist-saas) covers the obligations behind code 12.

Providers also enforce independently of the networks. Dodo Payments' merchant acceptance policy sets out suspension, payout withholding, transaction reversal, and penalties proportional to losses up to USD 425,000 for material breaches such as misclassifying a business to bypass category restrictions.

## How to Pass Merchant Underwriting on the First Submission

Underwriting is a matching exercise. Every discrepancy between what you say, what your site shows, and what public records hold costs you a review cycle. Eliminate the discrepancies and most files clear in days.

- **Publish a site a stranger understands in ten seconds.** What is sold, what it costs, what happens after payment. A holding page, waitlist, or "coming soon" screen is a decline under most policies, including Dodo's.
- **Make terms, refund policy, and privacy policy reachable from every page.** Underwriters check that they exist and that refund terms are specific. "Refunds at our discretion" is worse than no policy.
- **Publish a real support contact.** An email address that resolves and a stated response window. This measurably reduces disputes, because unhappy customers contact you instead of their bank.
- **Match your entity details exactly.** Registered name, number, address, and director names must match the incorporation certificate, and the bank account holder name must match the verified entity, because providers cannot pay out to third-party accounts.
- **Give a working demo or test credentials.** An underwriter who cannot see the product cannot assess delivery risk, so they assume the worst.
- **Project volume honestly, then flag growth early.** Underestimating to look safe backfires, because exceeding your projection is itself a review trigger.
- **Describe the product in one plain sentence.** "AI-assisted invoice reconciliation for freelance accountants, sold as a monthly web subscription" tells an underwriter everything. "Next-generation intelligent automation platform" invites questions.
- **Disclose anything borderline yourself.** Voluntary disclosure of a prior termination or a sensitive feature is treated far more favourably than the same fact found later.

Confirm you are operating from a supported jurisdiction before you build. Dodo Payments publishes its [accepted countries and territories](https://docs.dodopayments.com/miscellaneous/accepted-countries-and-territories), and geography is one of the few underwriting constraints no documentation overcomes. Founders without a registered company should read [accepting payments without a company](https://dodopayments.com/blogs/accept-payments-without-company) first, since individual accounts follow a shorter document path.

## How Merchant Underwriting Changes Under a Merchant of Record

Under a merchant of record, the MoR is the legal seller. It holds the merchant account, carries the acquiring relationship, and owns the card network compliance obligations that come with it. Your onboarding is lighter because you are not applying for your own acquiring relationship.

Lighter does not mean absent. The MoR still runs its own acceptable-use review, its own KYC on you and your beneficial owners, and its own ongoing monitoring, because it inherits every liability your sales create. When your dispute ratio rises, it rises inside the MoR's portfolio, and the MoR's acquirer holds the MoR accountable. That is exactly why MoR acceptance policies read as strictly as they do: the MoR is underwriting on behalf of the acquirer above it.

| Dimension | Direct merchant account | Merchant of record |
| --- | --- | --- |
| Who holds the acquiring relationship | You | The MoR |
| Who is named in card network programmes | Your merchant ID | The MoR's portfolio, with your sub-account monitored internally |
| Documents you submit | Full acquirer underwriting pack | Identity, entity, product, and payout details |
| Who fights disputes | You, with your own evidence workflow | The MoR, using evidence you supply |
| Who carries tax registration and remittance | You, in every jurisdiction you sell into | The MoR |
| What happens if you breach policy | Termination and possible MATCH listing | Account restriction or closure by the MoR |

The trade-off runs both ways. You get faster onboarding, no acquirer negotiation, and someone else handling tax and disputes. You also accept that a private acceptable-use policy governs your account, and that policy can be stricter than card network rules, because the MoR manages concentrated risk across many merchants. Dodo Payments sets out the structural comparison in its [merchant of record versus payment gateway documentation](https://docs.dodopayments.com/features/mor-vs-pg), and our guides on [merchant of record legal compliance](https://dodopayments.com/blogs/merchant-of-record-legal-compliance), [how MoR chargebacks work](https://dodopayments.com/blogs/merchant-of-record-chargebacks), and [MoR versus payment service provider](https://dodopayments.com/blogs/merchant-of-record-vs-payment-service-provider) go deeper. For solo founders weighing the operational load, [handling refunds and chargebacks as a solo founder](https://dodopayments.com/blogs/handle-refunds-chargebacks-solo-founder) is the honest version of what you take on when you underwrite yourself.

## FAQ

### How long does merchant underwriting usually take?

Automated approvals resolve in minutes, while manual review typically runs one to three business days. Dodo Payments states that most verification reviews complete within 72 hours, and files that take longer are usually waiting on a mismatch such as a bank account name that does not match the verified legal entity.

### What chargeback rate gets a merchant account terminated?

There is no single number. The published reference points are Mastercard's Excessive Chargeback Merchant threshold of 100 or more chargebacks at a 1.5% ratio, and Visa's VAMP Excessive Merchant threshold of 150 basis points from 1 April 2026 with a floor of 1,500 combined fraud and dispute events per month. Providers almost always enforce a stricter internal limit, so ask yours directly rather than assuming the published threshold protects you.

### Why did my payment provider impose a rolling reserve?

Reserves cover the timing gap between paying you out in days and a customer's ability to dispute a card charge months later. They are typically applied when your delivery window is long, your dispute or refund rate is elevated, or your volume grew well beyond the projection in your underwriting file. Ask for the specific release criteria in writing when the reserve is set.

### Does a merchant of record mean I skip underwriting entirely?

No. The MoR holds the merchant account and the acquiring relationship, so you avoid applying for your own, but the MoR still runs KYC on you and your beneficial owners, reviews your product against its acceptable-use policy, and monitors your account on an ongoing basis. It carries your liability, so it underwrites you on its own behalf.

### Can I get removed from the MATCH list before five years?

Only in two narrow cases: the acquirer added the record in error and can confirm it, or the listing was filed under the PCI DSS non-compliance reason code and compliance has since been restored. Outside those two paths there is no general early-removal process, and the record remains queryable by acquirers for five years.

## Conclusion

Merchant underwriting is a liability calculation, not a verdict on your business. Providers are pricing the chance that they end up paying for transactions you have already been paid for, and every question on the form maps back to that risk.

That makes underwriting mostly winnable in advance. A clear site, reachable policies, matching entity documents, working product access, and an honest volume projection move most files through in days. Watching your dispute ratio weekly, keeping refunds fast, and flagging growth before it lands keeps you out of the post-onboarding review loop that produces reserves and terminations.

If you would rather not run an acquiring relationship yourself, the merchant of record model shifts that machinery to someone whose job it is. See [dodopayments.com](https://dodopayments.com) for how the model works and [dodopayments.com/pricing](https://dodopayments.com/pricing) for the fee structure behind it.
---
- [More Payments articles](https://dodopayments.com/blogs/category/payments)
- [All articles](https://dodopayments.com/blogs)