Merchants
Trust, risk & security
Checks start before a merchant goes live and continue afterwards, to protect merchants, their customers and the wider payment ecosystem.
Merchant due diligence
Businesses are reviewed before they can accept payments.
Before activation, we review the business, what it sells and how it presents itself to customers, so that only eligible businesses are onboarded.
KYC/KYB verification
We verify the identity of businesses and the people behind them.
Know Your Customer (KYC) and Know Your Business (KYB) checks confirm that a business is who it says it is, and identify its authorised signatories and, where applicable, its owners.
Fraud risk management
Controls designed to detect and reduce fraudulent activity.
Fraud risk controls help identify suspicious behaviour and reduce the impact of fraud on merchants and their customers. We do not publish the details of these controls, as that would make them easier to get around.
Transaction monitoring
Transactions are reviewed for unusual patterns.
Payment activity is monitored for patterns that may indicate fraud, misuse or policy breaches, so that issues can be investigated and acted on.
Ongoing merchant monitoring
Onboarding checks continue after go-live.
Merchant accounts are reviewed periodically after activation. Merchants may be asked to update their information, documents or website policies.
Information security
Safeguards to protect data and systems.
We apply security controls to protect merchant and customer information. Specific certifications or standards are only shown on this site once they have been confirmed and approved for publication.
Security certifications and standards are shown here only after they have been confirmed.
What merchants can do
General good practice that helps keep your account and your customers safe.
- Protect your dashboard credentials. Use strong, unique passwords and don't share logins between staff.
- Turn on available security features. Use the account security options offered to you, and give staff only the access they need.
- Keep your website policies current. Update your terms, privacy and refund policies when your business changes.
- Report suspicious activity. If you notice unusual transactions or access, contact support promptly.
Report a security vulnerability
If you believe you've found a security issue in a BNYPay system, please follow our responsible disclosure process.
Want to understand our onboarding checks?
See how due diligence and verification fit into the seven stages of merchant onboarding.