Merchant Onboarding Requirements

Last updated: 06 May 2026

These Merchant Onboarding Requirements describe what every applicant must provide before UnitPay activates a merchant account. They reflect our internal risk policies and standard Indonesian financial-crime, AML, and consumer-protection expectations.

1. Who can apply

UnitPay onboards incorporated business entities. Eligible legal forms include:

Indonesian limited liability companies (Perseroan Terbatas, "PT").
Indonesian commanditaire vennootschap ("CV") and similar partnerships, where the structure is legally registered.
Sole proprietors with valid business licences (Usaha Dagang with NIB).
Foreign legal entities with documented Indonesian counterparties or representative offices, subject to enhanced due diligence.
Indonesian foundations and cooperatives, where the activity to be processed is consistent with the entity's registered purpose.

Individuals (natural persons without a registered business) are not eligible for merchant accounts at this stage. Individuals seeking to receive payments may apply once we open an individual-tier offering, which is not currently active.

Foreign legal entities are onboarded only where there is a substantive Indonesian nexus (Indonesian customer base, Indonesian counterparty, branch or representative office). Pure pass-through structures designed to access the Indonesian market without a real local presence are declined.

2. Required documents (KYB)

For Indonesian entities, applicants must provide the documentary evidence listed below. Documents must be current and not expired; certified copies are accepted where the underlying instrument is not available in original form.

Required documents:

Akta Pendirian (Deed of Establishment) and the latest amendment deed, if any.
NPWP (Nomor Pokok Wajib Pajak) of the entity.
NIB (Nomor Induk Berusaha) issued through OSS.
Sectoral licences relevant to the merchant's business category (for example, OJK licence for regulated financial services, BPOM for pharmaceuticals, BKPM for foreign-investment entities).
KTP (Kartu Tanda Penduduk) of every director, every commissioner, and every ultimate beneficial owner holding 25% or more, direct or indirect.
Recent (within 90 days) bank statement of the entity's settlement account.

For foreign entities, applicants must provide: certificate of incorporation, registered office certificate, latest audited financial statements, passport copies of every director and signatory, certified board resolution authorising the merchant relationship, and proof of Indonesian counterparty relationship.

3. Director KYC

Every director, every commissioner of an Indonesian entity, and every authorised signatory must complete identity verification through our KYC vendor Didit. Verification includes document review, biometric liveness check (ISO 30107-3 PAD level 2), and AML screening against sanctions lists, politically exposed person (PEP) lists, and adverse media. The full process is described in our KYC Policy.

Verification typically completes in minutes for Indonesian KTP holders and within one working day for foreign passport holders. Failed liveness or document checks can be re-attempted; persistent failures route to a manual compliance review.

Director KYC links are issued individually to each in-scope person and are not transferable. The verification subject performs the flow in person on a device with camera access; assisted verification by a third party is not permitted.

4. Know-Your-Business diligence

Beyond document collection, applicants complete a Know-Your-Business questionnaire covering:

Business model description: what is sold, how customers are acquired, average ticket size.
Expected monthly transaction volume (count and value) by payment method.
Customer geographies, including any high-risk jurisdictions.
Refund policy and expected refund-to-transaction ratio.
Chargeback history with previous payment processors, if any.
Settlement currency preference and bank account details.
Source of funds for the entity's working capital, where relevant to risk tier.
Group structure and intra-group flows where the merchant is part of a larger corporate group.

The questionnaire is country-conditional: Indonesian merchants see additional fields about NIB sectoral classification and PPN status; foreign merchants see additional fields about home-jurisdiction regulatory status.

Responses are reviewed alongside public-source verification (registry filings, sector regulator records, news coverage). Where responses are inconsistent with public sources, the onboarding team raises clarification questions before proceeding.

5. Prohibited categories

UnitPay does not onboard merchants whose primary business falls in any prohibited category. Examples include: unlicensed gambling and lottery, escort and adult services, illegal pharmaceuticals, weapons and explosives, hate-speech platforms, multi-level marketing schemes, regulated financial services (lending, insurance, securities) without the relevant OJK or sectoral licence, and any activity prohibited by Indonesian law.

The full list, including grey-zone categories that require enhanced diligence, is published in our Acceptable Use Policy. Applicants whose business falls in a prohibited or restricted category will not be onboarded; submitted documents are retained only for the period required by AML law and then deleted.

Where an applicant's declared activity falls in a conditional category, onboarding is conditional on production of the relevant licence. Examples include OJK licences for regulated financial services, BPOM registration for pharmaceuticals and medical devices, and Bappebti registration for cryptocurrency-related activity.

6. Risk tier assignment

At onboarding completion, every merchant is assigned a risk tier (low, medium, high) based on industry, geography, expected volume, and the outcome of director KYC and AML screening. The tier determines:

Initial transaction and withdrawal limits.
Frequency of ongoing AML re-screening (annual, semi-annual, or quarterly).
Rolling reserve percentage, if any.
Frequency of merchant review (volume, chargeback ratio, business-model drift).
Settlement timing within the standard rail-specific bands.

Tier may be reassessed at any time based on transaction patterns, AML events, regulatory changes, or merchant request supported by documentary evidence. Reassessment is conducted by the AML Compliance Officer with the underlying signals documented in the case record.

7. Onboarding timeline

Standard onboarding for Indonesian merchants completes in 5 to 10 working days from receipt of complete documentation. Foreign entities and high-risk categories typically take 10 to 20 working days due to enhanced diligence. We acknowledge every application within one working day and provide weekly status updates while review is in progress.

Expedited onboarding is available for tier-1 enterprise prospects on a case-by-case basis; contact sales@unitpay.net to discuss eligibility.

Where an application is declined, the applicant receives a written explanation at the level of detail consistent with our regulatory obligations. Some grounds for refusal (in particular sanctions or AML grounds) cannot be disclosed in detail under the anti-tipping-off provisions of UU TPPU.

An unsuccessful applicant may re-apply once the underlying basis for refusal has been resolved (for example, after a missing licence has been obtained or a documentation gap has been closed). Re-application starts a fresh review.

8. Approval and activation

Approved merchants receive a counter-signed Service Agreement, sandbox API credentials, and a production-readiness checklist. Production credentials issue once the merchant completes a successful settlement test transaction (typically a small live transaction settled and reconciled to verify the bank account on file). Until that test passes, production credentials remain disabled.

The production-readiness checklist covers integration testing, webhook handling, refund flow validation, and merchant-cabinet familiarisation. Onboarding does not consider the merchant ready for live volume until each item is signed off.

After activation, ongoing obligations include keeping KYC and KYB documents current (refresh every 24 months or upon material change), notifying us of director or beneficial-owner changes within 30 days, and complying with the Service Agreement and all UnitPay policies in force from time to time.

Material business-model changes, new geographies, new customer segments, or new product categories must be discussed with the onboarding team before live processing begins. Material changes can drive a fresh KYB review and, where relevant, fresh KYC for newly added directors or signatories.

Effective date: 06 May 2026