A clear sequence from access request to remediation briefing—built for acquiring platforms, not generic consulting theatre.
Merchant onboarding audits succeed when scope, sample design, and deliverables are agreed before anyone opens a case file. This page is the working model we use with Hong Kong–based acquiring platforms and payment facilitators.
We name the systems in play—intake forms, document vault, screening provider, underwriting queue, merchant master—and the review window. Access owners and data-handling rules are confirmed in writing before fieldwork.
Sample size follows volume and risk mix, not a fixed percentage. We propose strata for SME, mid-market, and restricted MCC cohorts, then agree severity definitions so findings are comparable across files.
Fieldwork combines workflow walkthroughs with file-level scoring. We look for missing artefacts, undocumented overrides, skipped gates, and policy-to-config drift—not just absent ID scans.
You receive an exception register, a prioritized fix backlog with owners, and a residual-risk summary suitable for risk committees. One evidence pack, two audiences.