Fintech UX Design: Merchant Onboarding and the Rules Behind the Form

Fintech UX design for merchant onboarding runs into one constraint that is easy to miss until the bank reviews the flow. The application is a legal intake as well as a signup flow, and some of its fields are there because a bank, a card network or a tax agency requires them. A designer who knows which fields are fixed and which are habit can shorten the form while keeping the bank’s required fields.

This is general information for product and design teams. It is not legal advice. Your sponsor bank, your counsel and your compliance lead decide what your program has to collect.

Key points

• Get your sponsor bank’s required field list before wireframes, then justify or cut every other field.
• Design for zero to four owners plus one control person, three underwriting outcomes and a second identity route.
• Put the term, renewal and cancellation fee in a summary box on the signature screen.

Who a merchant application is really for

A business owner filling in your form sees one company. Behind the screen there are often more. A payment facilitator, an ISO or a software platform with payments built in works under an acquiring bank, often called the sponsor bank, and that bank works under the card networks. Each of them has a claim on what the form asks.

The Visa Core Rules say that before contracting with a merchant, an acquirer or payment facilitator “must conduct an adequate due diligence review,” including a site visit where applicable or a suitable alternative, so that only legal transactions are submitted to VisaNet. The same rulebook makes the acquirer liable for what its payment facilitators and their merchants do, which is why the bank cares what your form asks.

The US anti-money-laundering rules sit one level up. The customer due diligence rule at 31 CFR 1010.230 applies to what it calls covered financial institutions, a group defined at 31 CFR 1010.605(e)(1) that includes banks. A payment facilitator is generally outside that definition, so the requirements may reach it through the bank’s program and its contract. Ask your sponsor bank for its field list and underwriting policy in writing.

What the application has to collect

Some questions cannot be designed away. Four sets of fields are usually fixed in a payment facilitator program, and the table shows who asks for each.

Identity basics

The bank’s customer identification program has a short minimum. Under 31 CFR 1020.220, a bank must obtain from its customer a name, a date of birth for an individual, an address and an identification number before it opens an account. That is four items for an individual and three for a business. Ask which extra fields are bank policy and which are leftovers from a paper form.

Owners and the control person

A fixed block of four empty owner panels makes a sole owner scroll past three sections that will never apply. The ownership step needs to handle zero to four owners plus one control person, and it should let the applicant say that an owner is also the control person without typing the details twice. Start by asking whether anyone owns 25 percent or more, and add an owner card only on a yes.

Those counts come from the due diligence rule, which has two tests. The ownership test covers each individual who “owns 25 percent or more of the equity interests.” The control test covers one person with significant responsibility to control, manage or direct the business. The rule’s own note says “up to four individuals may need to be identified” under the first test and one under the second.

Card network rules add their own line. Visa requires a payment facilitator to “provide the names of principals and their country of domicile for each of its Sponsored Merchants” to its acquirer and to Visa on request. If your form does not capture country of domicile for principals, your team may have to email merchants for it later.

The tax ID

Applicants may hesitate over the taxpayer identification number, so a line of explanation helps. The IRS says a business paid by card will get a Form 1099-K from its payment card processor “no matter how many payments you got or how much they were for.” The IRS instructions for requesters of Form W-9 say that when a payee has not supplied a correct number, the payor must withhold 24 percent of reportable payments until the problem is fixed.

Put that reason where the hesitation happens. A short note beside the field does it, along the lines of We use this number for tax reporting. If it does not match IRS records, part of your payouts can be withheld.

The February 2026 change for returning customers

On February 13, 2026, FinCEN issued an order granting exceptive relief from the requirement to identify and verify beneficial owners at every new account opening. Covered institutions may now limit that work to three situations, the first being when a legal entity customer first opens an account.

For later accounts the institution may rely on what it already holds, “provided the customer certifies or confirms (verbally or in writing) that such information is up-to-date and accurate.” It has to keep a record of that confirmation and check again if it learns of facts that call the earlier information into question.

For a merchant adding a second location or a new product, that points to a different screen. Show the owners already on file, ask the applicant to confirm that they are still correct, and store the confirmation with a date and the name of the person who gave it. Whether your sponsor bank has adopted the relief is its decision, so ask before building it.

KYC onboarding without a dead end

Plan three outcomes for every application: approved, conditionally approved and declined. Visa’s Payment Facilitator and Marketplace Risk Guide says application data must be validated and the merchant authenticated, and then expects a decision to “approve, conditionally approve, or decline a new seller application.”

Each outcome needs a screen somebody has to design. The conditional state deserves the most care, because it is where a legitimate business may be asked for a bank letter or a clearer photo of an ID. A message that says only that verification failed gives a real business no next step.

NIST’s digital identity guideline SP 800-63A-4 is written mainly for US federal agencies and does not bind a payments company, but it is a useful model. It asks for exception handling, such as a trusted referee, so that a person who fails the automated route has another one. It also recommends that services “provide a checklist with the allowed and required identity evidence” before the session starts. For a merchant application, that is a short screen at the start listing what to have on hand, such as the tax ID, the ownership percentages, a voided check and photo ID for each owner.

Canada has its own methods. Where FINTRAC’s rules apply to your program, its guidance on verifying identity allows a remote check of government photo ID, for example where the applicant scans the document with a phone camera and technology compares its features against known characteristics to confirm it is authentic. The guidance rules out a video call alone, so an agent looking at an ID on camera does not count by itself. Design the capture step for a phone, even when the application started on a desktop.

A second method uses a Canadian credit file that has “been in existence for at least three years” and draws on more than one source. A newcomer or a young founder may not have one, so the flow needs the photo ID route as well.

How to structure a long digital onboarding form

A merchant application is long by nature. GOV.UK’s default for long forms is one question per page, merged only where user research supports it. The Design System is public and written for government services, so test it with your own users.

Its question pages guidance says “Asking just one question per question page helps users understand what you’re asking them to do, and focus on the specific question and its answer.” The service manual adds that user research will show when pages can be merged. A legal name and a trading name can reasonably share a page. We would keep ownership and bank details on separate pages.

Owners often stop to find a document. The task list pattern exists for that, with sections a person can finish in any order. The same guidance warns, “Try to simplify the transaction before you use a complete multiple tasks page.”

Before the signature, show everything back. GOV.UK’s check answers guidance reads “Show a single check answers page immediately before the confirmation screen for small to medium-sized transactions,” with a link beside each answer to change it. On a merchant application it also lets the applicant catch a wrong ownership percentage or a mistyped tax ID before underwriting does.

One figure on form quality comes with a caveat. In a 2016 article on form usability, Nielsen Norman Group reports a CHI conference paper that found “78% one-try submissions in forms compliant with usability guidelines versus only 42% one-try submissions in forms violating them.” The article does not say which forms were tested, so your funnel may differ.

Accessibility criteria that apply to the form

Several WCAG 2.2 success criteria map directly onto an application form. Redundant Entry (3.3.7, Level A) says that information a user has already entered in the same process should be filled in for them or offered to select, with limited exceptions. On an application, that can cover details that repeat, such as a business address that is also the owner’s address or the applicant’s own name as the control person.

Accessible Authentication (3.3.8, Level AA) matters once an applicant saves and returns. Its core requirement is that no step of signing in depends on a cognitive function test, such as remembering a password or solving a puzzle, unless the step offers another method or a mechanism that helps the user complete it, with two narrower exceptions. A login that works with a password manager is one way to meet it.

Target Size (2.5.8, Level AA) sets a floor of “at least 24 by 24 CSS pixels” for pointer targets, with exceptions such as links inside a sentence. The floor matters for stand-alone remove and edit controls on owner cards. Error Identification (3.3.1) and Error Suggestion (3.3.3) ask that an error is described in text and that a fix is suggested when one is known.

Whether a given law requires WCAG conformance from your company is a separate question. Our guide to accessibility rules in 2026 goes through it.

Pricing, terms and the signature screen

The last step is where design has drawn a regulator’s attention. In July 2022 the FTC announced a case against First American Payment Systems, alleging hidden terms and surprise exit fees. One allegation was about the flow itself. “The defendants’ online enrollment system for new customers hid a three-year obligation, cancellation requirements and fees, the fact that agreements would automatically renew, and other important information from business owners, the complaint alleges.”

The press release says those facts were often in dense documents that owners had to click separate links to find. The case ended in a settlement order requiring the defendants to return $4.9 million, and in February 2025 the FTC said it was sending refund checks to 5,588 small businesses. The conduct described was alleged in a complaint. Would your own signature screen pass that test? Each of those terms is something the screen can show in plain view.

The Code of Conduct for the Payment Card Industry in Canada says “All merchant agreements must contain an information summary box that provides key elements of the agreement in a consolidated fashion.” A cost per transaction disclosure goes to the merchant at the same time as the card processing application. A summary box on the signature screen with the term, the renewal rule, the cancellation fee and the main rates is a sound default.

On electronic signatures, the US E-SIGN Act says a signature or contract “may not be denied legal effect, validity, or enforceability solely because it is in electronic form” (15 U.S.C. 7001). For most commercial transactions, that covers the format. It does not settle whether the merchant saw the terms clearly, and the FTC’s complaint was about that. The statute’s consent and disclosure steps are written for consumers, so ask counsel how your merchant agreement should handle them.

Fintech UX design checklist for merchant onboarding

• Field owners. Every question traces to the sponsor bank, a card network rule, a tax rule or your own risk policy. Anything unclaimed is reviewed for removal.
• Ownership step. Handles zero to four owners at 25 percent or more plus one control person, and lets one person fill both roles without retyping.
• Returning customers. If your sponsor bank has adopted the 2026 FinCEN relief, later applications show owners on file and record a dated confirmation.
• Three outcomes. Approved, conditionally approved and declined each have a designed screen and a matching email.
• Second route. A failed automated identity check leads to a manual path with a named list of documents.
• Before you start. A short screen lists the documents and numbers the applicant will need.
• Save and return. Sections can be completed in any order, and signing back in does not depend on memory alone.
• Check answers. One review page before signature, with a change link beside each answer.
• Terms in view. Contract length, renewal, cancellation fees and main rates appear in a summary box on the signature screen.
• Accessible entry. Data entered once is offered again, edit and remove controls are at least 24 by 24 CSS pixels, and each error says in text what to fix.

If your merchant application is due for a rework, our product design team can map each field to who asks for it and redesign the flow around what is left, with our software development team on the build. More is on the fintech industry page, or you can book a call to talk it through.

Sources

• 31 CFR 1010.230, Beneficial ownership requirements for legal entity customers, Electronic Code of Federal Regulations, current text read November 2026. Supports the 25 percent ownership test, the single control person, the “up to four” and “only one” counts, and the covered financial institution definition.
• 31 CFR 1020.220, Customer identification program requirements for banks, Electronic Code of Federal Regulations, current text read November 2026. Supports the four minimum identity items.
• Order granting exceptive relief from beneficial ownership requirements at each new account opening (FIN-2026-R001), Financial Crimes Enforcement Network, 2026. Supports the February 2026 change for existing customers and the confirmation record.
• Visa Core Rules and Visa Product and Service Rules, Visa, October 2026 edition. Supports the due diligence duty, acquirer liability for payment facilitators, and the principals and country of domicile requirement.
• Visa Payment Facilitator and Marketplace Risk Guide, Visa, 2021. Supports validation of application data and the three underwriting outcomes.
• Instructions for the Requester of Form W-9, Internal Revenue Service, 2024. Supports the 24 percent backup withholding rate.
• Understanding your Form 1099-K, Internal Revenue Service, read November 2026. Supports card processors issuing Form 1099-K regardless of amount.
• SP 800-63A-4, Digital Identity Guidelines: Identity Proofing and Enrollment, National Institute of Standards and Technology, 2025. Supports exception handling and the evidence checklist.
• Methods to verify the identity of persons and entities, FINTRAC, read November 2026. Supports the Canadian photo ID and credit file methods.
• Question pages, Complete multiple tasks and Check answers, GOV.UK Design System, read November 2026. Support one question per page, the task list and the review page.
• Structuring forms, GOV.UK Service Manual, read November 2026. Supports merging pages after user research.
• Website Forms Usability: Top 10 Recommendations, Nielsen Norman Group, 2016. Supports the 78 percent and 42 percent one-try submission figures, as reported from a CHI conference study.
• Web Content Accessibility Guidelines (WCAG) 2.2, World Wide Web Consortium, 2024. Supports success criteria 2.5.8, 3.3.1, 3.3.3, 3.3.7 and 3.3.8.
• FTC Takes Action to Stop Payment Processor First American from Trapping Small Businesses with Surprise Exit Fees and Zombie Charges, Federal Trade Commission, 2022. Supports the enrollment system allegations and the $4.9 million figure.
• FTC Sends More Than $2.6 Million in Refunds to Small Businesses Harmed by Payment Processor First American Payment Systems, Federal Trade Commission, 2025. Supports the 5,588 refund checks.
• Code of Conduct for the Payment Card Industry in Canada, Financial Consumer Agency of Canada, current version read November 2026. Supports the information summary box and the cost per transaction disclosure.
• 15 U.S.C. 7001, Electronic Signatures in Global and National Commerce Act, Legal Information Institute, Cornell Law School, enacted 2000. Supports the legal effect of electronic signatures.