Merchant Due Diligence & Compliance Guide

Cropay evaluates risk across the contracting entity, beneficial owners, operating jurisdictions, products or services, transaction types, fulfillment channels, content governance, and partner institution requirements, and applies documentation, approval, monitoring, and periodic review controls proportionate to risk. Sharing the same MCC or industry label does not imply identical risk or automatic onboarding approval.

• Certificate of Incorporation, Business Registration Certificate, registered office address, principal place of business, constitutional documents, and proof of good standing.

• Identity verification, residential address, ownership percentage, and authorization proof for directors, ultimate beneficial owners (UBOs), controllers, and authorized representatives.

• Settlement bank account details, source of funds, business revenue model, website or application URLs, product or content descriptions, target customer base, and operating jurisdictions.

• Applicable licenses, registrations, regulatory status, historical enforcement actions, material litigation, insolvency proceedings, or adverse media disclosures.

• Supplemental documentation reasonably required by partner institutions or risk underwriting teams.

The specific document checklist is determined by risk profile and applicable legal obligations. Do not submit identity document images through general website inquiry forms; always use approved secure onboarding channels.

Underwriting review covers the merchant’s actual offerings, item pricing, digital delivery, refund and cancellation rules, billing descriptors, customer support channels, Privacy Policy, cardholder authorization flow, content moderation policies, and platform fund flows. Dating, live streaming, creator show, streaming media, and digital content platforms must additionally explain their content moderation, minor protection, user reporting and suspension rules, creator governance, and virtual gift or revenue-share responsibilities.

Where applicable, Cropay or its partner institutions conduct sanctions, politically exposed person (PEP), adverse media, fraud, and abnormal transaction screening, and perform ongoing monitoring of website content, transaction patterns, refund ratios, chargeback ratios, geographic distribution, and device anomalies. A preliminary screening match does not automatically constitute a finding of illegality and is reviewed against reliable documentation on a case-by-case basis.

• Keep all corporate and operational disclosures true, complete, and current, and cooperate with periodic or event-driven reviews within specified deadlines.

• Report material changes in ownership, directors, bank accounts, websites, applications, product catalogs, target regions, transaction patterns, or regulatory status in advance.

• Never route transactions through unapproved domains, undisclosed affiliates, third-party aggregators, mirror sites, or unreviewed high-risk product lines.

• Retain verifiable evidence of cardholder authorization, orders, digital delivery, refunds, customer complaints, chargeback responses, and content moderation actions.

• Take immediate containment action and notify Cropay upon discovering fraud spikes, unlawful content, data breaches, or account takeover incidents.

Both the merchant and Cropay shall retain due diligence, transaction, and compliance decision records in accordance with their respective legal and contractual obligations. Where statutory, law enforcement, or contractual retention periods exceed general operational retention schedules, the longer mandatory period applies. Records are subject to strict access controls and used solely for lawful purposes.

Where reasonable grounds exist to suspect money laundering, terrorist financing, fraud, sanctions evasion, or other unlawful activity, Cropay may restrict services, request information, preserve evidence, or file reports with competent authorities. Where applicable law prohibits "tipping off" or mandates confidentiality, Cropay cannot disclose the existence or details of reports, investigations, or risk control reasons to the merchant.

Underwriting assessments may result in approval, conditional approval, requests for supplemental documentation, parameter restrictions, rejection, suspension, or termination. Cropay may re-evaluate a merchant based on new information, shifting risk indicators, or partner institution directives. Merchants may request a review under our Complaints & Dispute Handling Policy, provided that Cropay is not required to disclose internal risk rules that would compromise security controls, breach confidentiality, or prejudice an investigation.

Hong Kong’s Money Service Operator (MSO) licensing regime applies to remittance and money changing services as defined under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615). Whether any specific license is required depends on the contracting entity, actual fund flow activities, and applicable jurisdictions. This page does not constitute a representation that Cropay holds any specific financial license, registration, or regulatory status; any such claim may only be published after official registry records, certificates, entity names, and permitted scopes have been formally verified.