A large share of firms asking about KYC are not directly regulated for it and are being held to it anyway, by a partner bank, a sponsor or a card scheme. That is an awkward position: the requirements arrive as contract terms rather than as rules, they change, and they are usually stricter in practice than the underlying regulation. This page is about that position, and about the merchant variant of it.
Obligations that arrive through a contract
When a partner supplies the regulated permission, it also supplies the standard, and it will ask for evidence that you meet it. That evidence is customer files. The awkward part is that the partner's requests are not always predictable and they are often retrospective: they ask about customers you onboarded a year ago under a standard that has since moved. A firm that keeps files with evidence, ratings and dates can answer. A firm that keeps a customer list cannot, and negotiates from there.
Merchant KYC is KYB with a behaviour question
When your customer is a business taking payments, the file is a KYB file plus an understanding of what they sell and to whom. The ownership work is the same. What is added is expectation: what kind of volume and what kind of transactions are normal for this merchant, so that a change is visible as a change. Recording that expectation at onboarding is what makes the review meaningful later, and it takes one paragraph.
Build for the request you will get, not the rule you read
The practical design goal for a firm in this position is simple. When a partner asks for a named customer's file, one person should be able to produce it in a minute, complete with what was collected, who approved it and when it was last reviewed. Every other feature is negotiable. If the answer to that request currently involves a search across a drive and two inboxes, that is the gap, and it will not be closed by better onboarding.
Questions people ask about kyc fintech
Do fintechs have KYC obligations if they are not banks?
Sometimes directly, often through a partner who imposes the same standard contractually. Which applies to you is a question for your counsel, and either way you will be asked to produce customer files.
How is merchant KYC different?
It is business-customer due diligence with an added expectation of what the merchant's activity should look like, so that a change in behaviour is legible against something you wrote down.
What does a partner bank usually ask for?
Named customer files, complete, with evidence and dates, often at short notice and sometimes for customers onboarded under an older standard. The ability to produce them quickly is worth more than any single feature.