VIPRATECH LABS

Merchant Onboarding KYC Verification

Read merchant KYC packs, cross-check PAN, GSTIN, bank proof and the merchant's website, and give risk analysts a ready-to-decide file with every check explained.

Who it is for

  • Head of Merchant Risk
  • Merchant Onboarding Operations Manager
  • Compliance Officer
  • Chief Risk Officer

The problem

A payment aggregator onboarding a small merchant collects a PAN card, GST registration certificate, cancelled cheque or bank statement, address proof and, for companies and partnerships, incorporation documents and signatory details, plus the website or app the merchant will sell through. Analysts open each file, re-type names and numbers, and check that the legal name, GSTIN, bank account holder and website all describe the same business.

Name and entity mismatches

The trade name on the GST certificate, the legal name on the PAN and the account holder on the cheque differ in small ways that analysts must resolve by hand.

Website and business-model checks

Confirming that a merchant's site shows a real catalogue, terms, refund policy and contact details, and nothing on your prohibited list, is slow and inconsistent between analysts.

Back-and-forth with sales

Missing pages and unreadable uploads are discovered days later, and the merchant is chased repeatedly through the sales team.

Thin audit trail

When an auditor or partner bank asks why a merchant was approved, the reasoning sits in emails and analyst notes rather than a structured record.

What we build

We build a KYC review assistant that sits between your onboarding form and your risk analysts. It classifies each uploaded document, extracts the fields that matter and checks them against each other and against the verification sources you already use, such as GSTIN lookups and penny-drop bank account validation. A website review agent visits the merchant's URL and records what it finds: product categories, pricing, terms, refund and grievance policies, contact details and possible prohibited-category signals, with dated screenshots. The analyst receives one file with every check marked pass, fail or needs review. Missing or unreadable documents trigger a specific request back to the merchant.

  • Classifies PAN, GST certificate, cancelled cheque, bank statement, partnership deed, incorporation certificate and address proof
  • Extracts legal and trade name, PAN, GSTIN, account number and IFSC, registered address and signatory details
  • Matches names and addresses across documents and explains each mismatch in plain words
  • Reviews the merchant website or app listing for catalogue, terms, refund and grievance policies and prohibited-category signals
  • Compares extracted data with GSTIN lookup and bank account validation responses from your existing providers
  • Drafts a specific missing-document request instead of a generic rejection

How it works

  1. 01Collect the onboarding packDocuments and the merchant URL arrive from your onboarding form, CRM or partner portal and are grouped by application ID.
  2. 02Classify and extractEach document is identified and its fields extracted, with a confidence score and page reference for every value.
  3. 03Cross-check the entityNames, PAN, GSTIN, bank details and addresses are compared across documents and with the verification API responses you already receive.
  4. 04Review the websiteAn agent browses the merchant site read-only, captures screenshots and records catalogue, policy and risk-category observations.
  5. 05Route by outcomeClean files go to a fast-track queue; mismatches, gaps and risk signals go to detailed review, and missing documents trigger a request.
  6. 06Analyst decidesThe risk analyst approves, rejects or asks for more, and the decision is written back to your merchant system with its evidence.
Merchant Onboarding KYC Verification: workflow diagram
Open full size

Architecture

  1. Intake
    • Onboarding form and partner portal connector
    • CRM webhook
    • Application-level document grouping
  2. Document understanding
    • OCR with layout detection
    • Document classifier
    • LLM extractor with KYC field schemas
  3. Verification
    • Cross-document entity matcher
    • Adapters for your GSTIN and bank account validation providers
    • Read-only website review agent with screenshots
  4. Review
    • Analyst console with pass, fail and review markers
    • Missing-document request templates
  5. Integration and audit
    • Merchant management system API
    • Audit log of checks, edits and decisions
Merchant Onboarding KYC Verification: architecture diagram
Open full size

Inputs and outputs

Inputs

  • PAN of the entity and its signatories
  • GST registration certificate
  • Cancelled cheque or recent bank statement
  • Incorporation certificate, partnership deed or shop establishment licence
  • Address proof and signatory ID, with masked Aadhaar where used
  • Merchant website or app store URL

Outputs

  • Structured merchant profile with extracted fields
  • Check-by-check result: pass, fail or needs review
  • Website review notes with dated screenshots
  • Specific missing-document requests
  • Decision record with evidence links for audit

Where people stay in control

Every merchant approval, rejection and risk categorisation is made by a risk analyst. The assistant prepares and explains the checks; it never activates a merchant or sets a risk category by itself.

Integrations

  • Merchant onboarding or merchant management system (API)
  • Salesforce, Zoho or LeadSquared CRM
  • Your existing GSTIN, PAN and bank account validation API providers
  • Document storage such as S3 or a DMS
  • Case management or ticketing tool for analyst queues

Guardrails

  • Masked Aadhaar only; full Aadhaar numbers are never stored, per UIDAI rules
  • Only verification sources you are licensed to use, called through your existing providers
  • Website agent is read-only and records the date and URL of every screenshot
  • Field-level confidence thresholds agreed with your risk team
  • Regular sampling of fast-tracked files by a senior analyst

Compliance notes

  • Designed to support the merchant due diligence and record-keeping expected of payment aggregators under RBI directions.
  • Personal data of proprietors and signatories handled with purpose limitation and minimisation, in line with the DPDP Act 2023.

A typical pilot

Duration: 3 weeks

One merchant segment, such as small online sellers onboarded through self-serve, using past applications whose outcomes are already known.

Deliverables

  1. 01KYC field schema and check list agreed with your risk team
  2. 02Working extraction and cross-check pipeline on de-identified past applications
  3. 03Website review agent configured for your prohibited-category list
  4. 04Analyst console prototype
  5. 05Accuracy report and production plan

What we measure

Field extraction accuracy
Compared with analyst-entered values for the same applications.
Agreement with past findings
How often the system's flags match the issues analysts actually raised on those files.
Analyst review time per file
Timed on a sample of applications with and without the prepared file.
Missing-document detection
Incomplete packs the system identified, checked against the document chases that actually happened.

FAQs

01Does this replace our verification API vendors?

No. It reads the documents and combines results from the GSTIN, PAN and bank validation vendors you already use. Face match and document tamper checks can be added as a separate step if you need them.

02How does the website review handle sites that block bots or are still being built?

The agent records what it could and could not load and marks the check for analyst review. It never tries to bypass logins, captchas or other access controls.

03Can it read regional-language documents such as shop establishment licences?

Yes, for printed text in common Indian languages, with low-confidence fields sent to an analyst. The pilot reports accuracy per document type so you can see where it is weaker.

04Where does merchant data go?

It stays in your cloud account or an India region. We can use model endpoints that do not retain or train on your data, and personal details are masked in logs.

Related use cases

Akhilesh Mittal

Founded by Akhilesh Mittal. 8 years building a security platform for a New Zealand company. IIT ISM Dhanbad and IMT Ghaziabad. Builds production agentic AI.

Pick one queue and test it on your own data

Book a discovery call. We will choose one workflow, such as merchant KYC review or dispute evidence, and scope a short pilot that runs alongside your current process.