KYC And CIP Certification

Federal regulations require collection and verification of specific identity information from merchants. These regulations are designed to prevent the misuse of financial systems and prevent financial crimes such as money laundering and terrorist financing. This document describes the information merchants are required to provide before they can become our customer and have any funds settled by WePay.

When designing your merchant onboarding flow, Clear gives you flexibility through our RESTFul API. However, the below requirements will impact the user experience you design. These requirements stem from the federal regulations described above, and must be demonstrated to WePay before you go live.

Merchant Information

Merchant Information includes:

• Merchant Entity Type
• Business Name
• Government Identification Number
• Merchant Address
• Description of Merchant
• Merchant Website
• Merchant Phone Number
• Controller Information
• Beneficial Owner Information
• Publicly Traded Status

The requirements and specifics of each are detailed below:

Merchant Entity Type

Note: Depending on the entity type chosen, the information your platform must collect for each merchant will differ.

{
	"entity_country_info": {
		"US": {
			"employer_identification_number": "123211230",
			"legal_form": "limited_liability_company"
		}
	}
}

Business Name

Your platform must require your merchant to provide the legal name of its business. For sole proprietors, your platform should ask whether they have a DBA, and require the sole proprietor to provide one if they have a DBA.

Upfront Underwriting

If Upfront underwriting is enabled, the upfront underwriting process will trigger once merchants submit their annual sales volume, average transaction size (average ticket size), and annual credit card volume. Upfront underwriting is the process by which WePay evaluates the potential risk exposure of a business by gathering additional information from the merchant to calculate and predict the chargeback rate, refund rate, and non-delivery risk of goods and services in addition to calculating our dollar value of credit exposure. This is an upfront assessment of our risk exposure before enabling payment and payout capabilities. Underwriting only occurs once. After a merchant is underwritten, any updates will not result in another underwriting. Payment processing capabilities will default to disabled until upfront underwriting is complete.

To learn more, please contact your integration team or technical account manager for more information.

Government Identification Number

The charts below summarize the required government identification numbers that need to be provided.

Canadian Business Number Patterns

For merchants other than sole proprietors, we expect their provincial business registration number, as opposed to their federal business registration number. That said, merchants can submit any business registration number available, including federal registration numbers. Each province has a different pattern to expect, as outlined here.

Merchant Address

Your platform must require the merchant to provide the full physical address of its business. Note a couple exceptions:

• Individuals: Since merchants with entity type individual do not have business operations, this field is not required for entity type individual.
• Sole Proprietors: Your platform should only collect a separate business address from merchants with entity type 'sole proprietors' if the merchant operates its business from a different address than the merchant's home address. See examples below from WePay onboarding - the business address is only required if the merchant checks the box that the business operates from a different address than the home address:

• Other Business/Nonprofit types: The business street address must be collected. Army Post Office or Fleet Post Office box numbers and descriptions of physical locations are not permitted.

Description of Merchant

Your platform must request merchants to provide a brief description of its nature of business or, for individuals, the purpose of the account.

Merchant Website

Your platform must request merchants to provide its website, if applicable. If the merchant does not have a website, the merchant should be required to confirm it does not have one. See example below:

Merchant Phone Number

Controller Information

When laying out the user interface, you the platform must provide users with the legal definition of a controller as a tool tip or similar informational display, so that merchants are informed of the information they must provide. Remember, the legal definition of a controller is: a single individual with significant responsibility to control, manage, or direct a legal entity such as an executive officer, senior manager or other individual who regularly performs similar control functions.

Beneficial Owner Information

Since nonprofit organizations do not have owners or equity, there are no beneficial owners for nonprofits. Sole proprietors are 100% owned by the merchant, so there are no additional 'beneficial owners'.

The following information must be collected from each beneficial owner, and must be submitted via the associated parameters:

Note: Canadian SIN is optional.

Verify High Volume NGOs and Charities

1. first_trigger: Account has processed $500,000.00 in a rolling 12-month window. Platform to email merchant, providing context for additional verification, and allow them to submit information.
2. second_trigger: Account has processed $1,000,000.00 in a rolling 12-month window. Platform to email merchant, reiterating the required verification & that they are approaching the threshold, and allow them to submit information.
3. third_trigger: Account has processed $1,200,000.00 in a rolling 12-month window for the first time. Platform to email merchant, indicating that additional verification is now required, and direct them to your platform for submission.

The information is all provided to the Legal Entity resource. Note that once the additional information is provided once, it will not need to be provided again.

Here is a preview of how your platform can use the API endpoints above to collect information from high volume NGO's and Charities:

An example of how WePay has implemented the TPV questions for high volume entities.

An example of how WePay has implemented the TPV questions for high volume entities.

An example of how WePay has implemented the upfront questions for high volume entities

An example of how WePay has implemented the upfront questions for high volume entities

Publicly Traded Status

Entities that are corporations, limited liability companies, or partnerships can be publicly traded. Publicly Traded Companies (including subsidiaries) should provide account controller, not controller, information.

The following information must be collected to indicate Publicly Traded status:

Sample KYC UIs

All merchants will begin by providing information on their industry, sales volume, and transaction information, as shown here:

An example of how to implement collecting information on the industry, sales volume, and transaction size into your own UIs based on WePay's implementation

An example of how to implement legal form selection into your own UIs based on WePay's implementation

Sole Proprietor KYC UI

Provide the legal definition of "Sole Proprietor" to help users select the best legal_form for their account:

An example of showing the legal definition of Sole Proprietor in your own UIs based on WePay's implementation

Collect information about the business. EIN is optional as some Sole Proprietors operate using the individual's social security number:

An example of collecting business information of a Sole Proprietor in your own UIs based on WePay's implementation

Collect the Sole Proprietor's personal verification details. These will be the controller details, and there will not be any beneficial owners of a Sole Proprietor. If they have provided an EIN, then only the last 4 digits of their social security number are required; otherwise all 9 digits are required.

An example of collecting the Sole Proprietor's personal information in your own UIs based on WePay's implementation

Business (Partnership) KYC UI

Provide an explanation of a legal business partnership.

An example of showing the legal definition of Partnership in your own UIs based on WePay's implementation

Collect the partnership's entity information.

An example of collecting business information of a Partnership in your own UIs based on WePay's implementation

Collect the personal information for the partnership's controller. The controller must disclose whether they have 25% or more equity in the partnership.

An example of collecting the Partnership's controller's personal information in your own UIs based on WePay's implementation

Collect the personal information for all individuals who own 25% or more equity in the partnership.

An example of collecting the personal information for all the Partnership's beneficial owners in your own UI based on WePay's implementation

Business (LLC) KYC UI

Identify why a user would select the LLC entity type to describe their account.

An example of showing the legal definition of an LLC in your own UIs based on WePay's implementation

Collect the LLC's entity information.

An example of collecting business information of an LLC in your own UIs based on WePay's implementation

Collect the personal information for the LLC's controller. The controller must disclose whether they have 25% or more equity in the LLC.

An example of collecting the LLC's controller's personal information in your own UIs based on WePay's implementation

Collect the personal information for all individuals who own 25% or more equity in the LLC.

An example of collecting the personal information for all the LLC's beneficial owners in your own UI based on WePay's implementation

Business (Corporation) KYC UI

Identify why a user would select the corporation entity type to describe their account.

An example of showing the legal definition of a Corporation in your own UIs based on WePay's implementation

Collect the corporation's entity information.

An example of collecting business information of a Corporation in your own UIs based on WePay's implementation

Collect the personal information for the corporation's controller. The controller must disclose whether they have 25% or more equity in the corporation.

An example of collecting the Corporation's controller's personal information in your own UIs based on WePay's implementation

Collect the personal information for all individuals who own 25% or more equity in the corporation.

An example of collecting the personal information for all the Corporation's beneficial owners in your own UI based on WePay's implementation

Nonprofit (Nonprofit Corporation) KYC UI

Identify why a user would select the nonprofit corporation entity type to describe their account.

An example of showing the legal definition of a Nonprofit Corporation in your own UIs based on WePay's implementation

Collect the nonprofit corporation's entity information.

An example of collecting business information of a Nonprofit Corporation in your own UIs based on WePay's implementation

Collect the personal information for the nonprofit corporation's controller.

An example of collecting the Nonprofit Corporation's controller's personal information in your own UIs based on WePay's implementation

Nonprofit (Unincorporated Association) KYC UI

Identify why a user would select the nonprofit unincorporated association entity type to describe their account.

An example of showing the legal definition of a Nonprofit Unincorporated Association in your own UIs based on WePay's implementation

Collect the nonprofit unincorporated association's entity information.

An example of collecting business information of a Nonprofit Unincorporated Association in your own UIs based on WePay's implementation

Collect the personal information for the nonprofit unincorporated association's controller.

An example of collecting the Nonprofit Unincorporated Association's controller's personal information in your own UIs based on WePay's implementation

Attestation

In addition to simply collecting the elements described above, federal regulations require that the person certify to the completeness and accuracy of the information provided. Traditionally, this requirement is fulfilled by including a specific attestation language and obtaining signature on the same form used to collect identity information.

Note: This attestation should be included not only when the identity information is submitted for the first time, but also when identity information is subsequently updated.

In a digital setting, this requirement can be fulfilled by including attestation language in the same user experience used to collect identity information and obtaining the electronic equivalent of a signature - timestamp, IP address, user name (or any other ID). Sample attestation language is provided here:

“By clicking "Submit," you hereby certify, to the best of your knowledge, that the information provided above is complete and correct.”

As an example, WePay provides this language in the embedded and hosted KYC flow:

The attestation language must be located right above the “submit” button.

Updates to Identity Information

If your platform would like to provide merchants with a seamless way to update their identity information, keep in mind a couple requirements:

• First, if any controller or beneficial ownership information is being updated, your platform must provide the merchant with a review of all details submitted for controllers and beneficial owners (including unchanged information and information that is being updated) for confirmation before submission. Note: For security reasons, your platform should not display any SSN or date of birth in this review.
• Second, as stated above in Attestation, you must require the merchant to certify that the information provided is accurate.

Note that any changes to identity or entity information may result in another review by WePay to verify the updated details.

curl -X POST \
  --url 'https://stage-api.wepay.com/legal_entities/id' \
  -H 'App-Id: 12121'\
  -H 'App-Token: stage_BGDS9205HGGQ4LWIzOWYtNGU0Yy1iMTU4LTM4Zjg0YmYxODQzOA'\
  -H 'Api-Version: 3.0'\
  -H 'Content-Type: application/json' \
  --data-raw '{
    "controller": {
      "address": {
        null
      }
    }
    }'

Certification Checklist

In summary, you must provide, and will only be certified after you provide:

1. UIs providing the complete list of entity types for your merchants to select from
2. UIs for collecting the correct identification numbers (e.g., EIN or Business Number) from each merchant based on entity type and country
3. UIs for all required merchant information fields
4. UIs for all required controller information fields for all entity types except individuals and sole proprietors
5. UIs for all required beneficial owner fields for all entity types except individuals, sole proprietors, and nonprofits
6. UIs to collect attestation from the merchant
7. UIs to update merchant identity information