Coris’s mission is to make sure software companies and fintechs are in business with the right SMBs. A core component of the Know Your Business (KYB) process is evaluating whether incoming SMB applicants pursue business activities that are prohibited or restricted by law, or are deemed high risk.

Certain types of businesses and industries are deemed illegal based on the nature of their activities or their location. Meanwhile other businesses are considered “high risk” or restricted because they can generate regulatory, reputational, or credit risks for the companies that serve them.

Software companies and fintechs should avoid associating with prohibited business activity and should develop their own framework for evaluating restricted and high risk businesses. In this article, we outline common types of prohibited, restricted, and high risk businesses; when and why companies should avoid working with them; and options for automatically screening for these types of businesses during the SMB onboarding process.

‍

What are prohibited, restricted, and high risk businesses?

A prohibited business is a merchant that is considered unsuitable to conduct business with. Companies might prohibit a business from their platform because its activity is outlawed by the government or the jurisdiction where the company operates in, the business or its owners appear on a sanctions list, or because it’s located in a country that the company is not allowed to do business with. 

Restricted businesses are merchants that operate in legal industries but might face additional hurdles when accessing financial or software services due to greater regulatory, financial, and reputational concerns about them. Many times, restricted businesses need written approval before accessing a platform. This is often due to card network rules, financial institution requirements, and a software company’s own compliance and legal requirements.

High risk businesses are merchants that are perceived to be at greater risk of elevated chargebacks and/or financial failure. This perception can be driven by several factors: the merchant’s industry and product, geographic location, previous presence on Mastercard’s MATCH list, and even the sale of big ticket items or a history of elevated chargebacks. 

Companies may try to avoid merchants deemed restricted or high risk because the benefits of serving them can be outweighed by the risks and costs. For example, merchants in heavily regulated industries can generate increased operational costs for the company serving them, and merchants in “culturally taboo” industries can generate credit and reputational concerns. If a company takes on a high risk merchant, they will try to compensate for these risks with higher account & processing fees, restrictions on processing, or more frequent periodic reviews.

Businesses are most often classified as prohibited, restricted, or high risk based on the merchant’s industry or product offering. In the next two sections, we’ll walk through some examples of industries that are clearly prohibited in the U.S., and others deemed restricted or high risk.

‍

Common prohibited business activities

Below is a non-exhaustive list of activities that software and financial services companies are often prohibited from doing business with. Companies should evaluate businesses and their ultimate beneficial owners (UBOs) for association with the below activities during the SMB onboarding & underwriting process.

• Illegal, criminal, or fraudulent activities: This includes businesses or UBOs who are engaging or previously engaged in money laundering, drug trafficking, human trafficking, terrorist financing, or any other criminal enterprises. Businesses verifiably engaged in pyramid schemes, or practices that deceive investors / customers, also fall into this bucket. 

• Sanctioned businesses, individuals or countries: This includes businesses or UBOs who are domiciled or operating in countries subject to sanctions or trade embargoes by the software / financial service’s company’s main operating country. It also includes individuals and business entities that have been sanctioned by the main operating country.  In the U.S., companies typically check sanctions lists issued by OFAC (the Office of Foreign Assets Control) in order to avoid working with individuals, businesses, and countries sanctioned by the government.

• Counterfeit, pirated, or stolen goods: These are businesses that develop or distribute unauthorized, fake copies of brand-name products, violating intellectual property law.  

‍

Common restricted and high risk industries

Below we identify some well-known restricted and high risk industries. Where possible, we note the industry’s common Merchant Category Code (MCC) and six-digit North American Industry Classification System (NAICS) codes. These codes are often leveraged by risk teams during SMB onboarding and underwriting.

1. Casinos & gambling 

MCC: 7995; NAICS: 7132 | Restricted

These businesses move large amounts of money between multiple parties at frequent intervals, making them an easy breeding ground for nefarious financial activity. As a result, they are highly regulated or outlawed in certain geographies. Many companies consider them high risk due to their greater regulatory exposure, and the ethical or reputational concerns that come with them.

‍

2. Weapons and firearms 

MCC: 4214, 3489; NAICS: 423910, 332994 | Restricted

Many types of weapons, explosives, and firearms are heavily regulated, and so are their manufacturers and sellers. This creates additional regulatory requirements and increases the cost to serve these businesses. Oftentimes, companies will prohibit or severely restrict engagements with these types of businesses due to regulatory, ethical, or reputational concerns.

‍

3. Alcohol, tobacco, and cannabis (CBD) 

MCC: 8398, 5921, 5715, 5993, 8099; NAICS: 445310, 459991, 424590 | Restricted

Some of these substances are considered controlled substances in certain geographies. Their sale and possession are held to stricter regulatory requirements, or outlawed outright. Like the previous example, this can create additional operational burden for companies, and generate ethical and/or branding concerns.

‍

4. Pharmaceuticals & medical Services 

MCC: 5912, 5122, 8099; NAICS: 325400 | Restricted

The medical and pharmaceutical industries are highly regulated, and that extends to companies selling medical products or services. Companies serving these merchants will need to expand their operations in order to meet more stringent regulatory requirements. 

‍

5. Timeshares, travel agencies, and tour operators 

MCC: 7012, 4722, 4723; NAICS: 561510, 561520 | High risk

These businesses are often considered high risk due to elevated levels of chargebacks, disputes from unhappy customers, and their willingness to do business in higher risk geographies. Payment processors won’t necessarily avoid doing business with them, but they may conduct deeper underwriting analysis and offer them more conservative services to mitigate financial risks.  

‍

6. Credit reparation services 

MCC: 7299; NAICS: 541990 | High risk

These merchants are in the business of helping consumers repair their credit - what could be risky about that? It comes down to three things: 1) these businesses serve individuals with pre-existing financial issues, who might have a higher likelihood of being unable to pay, creating credit risk; 2) higher chargeback rates due to customers canceling subscriptions after completing repairs; and 3) a negative reputation due to some nefarious business practices from certain players.

‍

7. Telemarketing 

MCC: 5966; NAICS: 561422 | High risk

Telemarketing businesses are deemed high risk due to the prevalence of card-not-present transactions (increasing the risk of fraud), misleading business practices that can lead to reputational damage, and longer delivery times (also known as non-delivery exposure, or “NDX”).

‍

Current SMB due diligence processes are manual 

As part of due diligence, many companies develop lists of prohibited, restricted, and high risk merchants. This helps them systematically keep track of merchants they either will not do business with, or merchants they will need to evaluate more carefully. 

The current business screening process is extremely manual. Risk teams at software & financial services companies will aggregate information on businesses from multiple sources:

• Official sanctions lists: These are usually from government sources (e.g., OFAC in the U.S.), and outline the businesses, individuals, and countries that the company definitely cannot do business with. 
• Lists of high risk businesses: Lists such as Mastercard’s MATCH list help payment processors identify businesses deemed high risk in the past, which can be a useful indicator for predicting future business behavior.
• Business’s website: A business’s own website includes important information about its products and other signals of the business’s legitimacy. Product data is helpful for identifying any risky inventory and determining the business’s industry, which risk teams manually assign using the MCC and NAICS code catalogs.
• 3rd party review platforms: Websites such as Google and Yelp contain important organic reviews of businesses, which can help companies understand a business’s reputation. 
• Manual searches on search engines: Risk analysts will often check each business’s UBOs for past criminal activity reported in media outlets. 

‍

Automatically screen for prohibited, restricted and high risk businesses in 46 countries

Coris automates the business intelligence gathering outlined in the previous section. Using just the business’s name and postal code, companies can instantly:

• Determine a business’s industry: Merchant Real Industry is the first tool to auto-predict MCC and six-digit NAICS codes. It uses GPT-4 to deliver industry classification as accurate as manual analysis, at a fraction of the time. 
• Assess business legitimacy: SiteRating analyzes a business’s web presence and provides a risk classification score based on the presence of certain pages, accepted payment methods, merchant type, and more. MerchantProfiler, our KYB product, also aggregates reviews from 3rd party platforms to understand a business’s legitimacy & reputation with customers.
• Screen product & service catalogs: SiteRating also allows risk teams to screen for custom keywords tied to prohibited, restricted, or high-risk products and services. 
• Screen businesses and business owners for criminal activity: Adverse Media Insights surfaces information on past criminal activities or legal disputes associated with the business and its owners. This includes accusations of business fraud (credit card fraud, forgery, etc.), convictions, or open cases against the business or its management.
• Automate sanction checks & other screenings: MerchantProfiler checks each business for presence on lists such as OFAC sanctions lists in the U.S. In the U.S., we also conduct TIN matching and check Secretary of State records for business verification.

‍

Get started today

Make manual prohibited business checks a thing of the past. Join companies like Mindbody and Coast and make your SMB onboarding 5 times faster with Coris.

‍Reach out today to learn more about Coris’s automated solutions for SMB KYB, risk & fraud management.