By By Dan Frechtling, Senior Vice President, Product & Strategy, LegitScript

Retail payments have outgrown the idea that merchant trust can be established once and revisited later. Merchant profiles don’t stay static, especially in digital commerce, where business models, product catalogs, and risk exposure can change quickly. A review process built around annual refreshes leaves payment service providers, acquirers, and marketplaces with less visibility than they need during the months in between.

Recent Know Your Customer (KYC) research by Capgemini points to the same problem. Legacy KYC programs are built around calendar-based reviews, even though the actual risk profile can shift when ownership, business activity, geography, or new adverse signals change. The larger takeaway is hard to miss. Point-in-time trust is becoming less useful when merchant behavior can change in days rather than years.

Merchant Portfolios Are Changing Faster Than Legacy Review Cycles

The traditional review cycle in payments was built for a market where merchant risk moved slower and changes were easier to spot. Retail commerce today has shifted in ways that legacy review models weren’t built to handle. New products can appear overnight, storefront content can shift with the click of a button, and merchants can expand into new categories or jurisdictions long before the next formal check arrives. With AI, cycle times are even shorter. Periodic reviews miss the mark.

Fraud pressure is broad enough that payment service providers, acquirers, and marketplace operators can’t afford to treat merchant risk as a problem that appears only at onboarding. The Federal Trade Commission reported that consumers lost more than $15.9 billion to fraud in 2025, a sharp increase from the previous year. FTC data also shows that a growing share of fraud reports now involves financial loss, with the most recent figures showing the share of reports involving loss rising from 27% in 2023 to 38% in 2024.

Those figures make a stronger case for oversight models that can catch changes in risk before the next scheduled review.

Onboarding Still Matters, But It Can’t Carry the Whole Burden

Strong underwriting remains a necessary starting point. Know Your Business checks, identity verification, merchant classification, website review, and beneficial ownership screening will always play an important role in the initial approval decision. Even a thorough onboarding process, though, can only capture a moment in time.

The more difficult question comes later. A merchant that fits a lower-risk profile at approval may expand into new product categories, change its operating model, or introduce new exposure without making that shift obvious at first. When oversight relies too heavily on fixed review cycles, changes can go unnoticed until disputes arise, compliance concerns surface, or other warning signs begin to appear.

Review Is Becoming More Targeted Across the Merchant Life Cycle

This shift is driving greater adoption of what’s often referred to as Perpetual KYC, or pKYC, a more continuous and contextual approach to merchant oversight. Perpetual KYC changes the purpose of review. Instead of treating reassessment as a routine compliance exercise, it turns review into a response to meaningful change. A new beneficial owner, a different product mix, a shift in transaction behavior, or a change in geography can all warrant a closer look. 

The value comes from focusing attention where the risk profile has actually changed rather than applying the same cadence across the entire merchant portfolio.

Retail payments benefit from that approach in a few clear ways. Lower-risk merchants are less likely to get caught in repetitive reviews that add friction without improving visibility. Higher-risk merchants are more likely to draw attention when their business model, conduct, or ownership drifts away from the basis for the original approval. A review process tied more closely to actual change gives payment providers and marketplaces a better chance of responding before small issues turn into larger ones.

Automation Works Best When It Supports Human Judgment

Automation has become more important in merchant oversight because the volume of signals is too large to manage through manual review alone. Screening tools can help surface changes in merchant behavior, flag new risk indicators, and create a record of what changed and when. That kind of speed and consistency matters, especially when payment providers and acquirers monitor large portfolios across multiple categories and jurisdictions.

The pace and complexity of change make human judgment more important. Merchant risk rarely shows up in isolation. A change in website content may indicate elevated risk on its own, but the same change can carry more weight when it appears alongside new transaction patterns, a shift in product mix, or activity in a higher-risk market. 

Automated systems are useful for identifying those signals early, but experienced compliance specialists, underwriters, merchant risk analysts, and trust and safety professionals are still the ones who must decide whether the change warrants closer review, additional controls, or removal from the portfolio.

Merchant Oversight Is Becoming a Stronger Growth Requirement

The shift toward continuous oversight is becoming a practical requirement for sustainable growth in retail payments. Payment service providers, acquirers, marketplaces, and other e-commerce platforms are all under pressure to approve merchants quickly without creating blind spots that become more expensive later. But fixed review cycles leave too much room for risk to change between formal checks, 

A more continuous approach gives payment service providers, acquirers, and marketplaces a better chance to identify drift earlier and respond before disputes, compliance concerns, or reputational damage begin to build. Periodic reviews still have a place, but they no longer carry the full burden of merchant oversight in a retail environment where merchant behavior can change quickly.

About author