Merchant website classification for payments
For card-not-present merchants, the website is the business. What it sells decides the merchant category code, the risk tier and whether the merchant can be boarded at all.
This guide shows how acquirers, payment facilitators and KYB teams use website categories at onboarding and across a live portfolio.
Why the merchant's website matters
An application is what the merchant says. The website shows what customers can actually buy, and card networks, regulators and fraud teams all judge the merchant by that.
Know your business
Confirm that the site exists, is live and sells what the application describes before the first transaction.
Correct merchant category code
The site's main offering points to the right code. Our guide to MCC codes by website covers the mapping.
Restricted and prohibited goods
Spot sites that sell things your risk policy, your bank partner or the card networks restrict or forbid.
Changes after boarding
A merchant can start selling something new months later. Regular rechecks find the change.
Front sites and laundering
A clean looking site can front for sales of other goods processed through the same account. Mismatches are an early sign.
Whole book reviews
Label every merchant website in one batch to see the real mix of business types in a portfolio.
Website categories that raise payment risk questions
These are categories from our set of 59 web filtering categories that payment risk teams most often act on. How you treat each one depends on your licence, your bank partner and current network rules.
| Site category | Why risk teams care | Common treatment |
|---|---|---|
| Adult | A higher-risk type that card networks treat with extra rules and registration. | Restricted Specialist approval only. |
| Gambling | Licensing varies by country and state, and online gambling has its own network rules. | Restricted Check licence and markets. |
| Illegal Drugs | Sales of controlled substances. | Prohibited Decline. |
| Health & Medicine | May include online pharmacies, prescription drugs or supplements with health claims. | Review Check what is sold and pharmacy status. |
| Tobacco | Online and cross-border tobacco and vape sales carry age and tax rules. | Review Check age checks and markets. |
| Alcohol | Age checks and shipping rules differ by market. | Review Confirm licences. |
| Weapons | Many providers restrict or ban firearms, ammunition and some accessories. | Review Apply your policy. |
| Cryptocurrency | Exchanges and crypto purchases need licensing and extra controls. | Review Check registration. |
| Dating | Subscription billing and chargeback patterns need monitoring. | Review Check billing terms. |
| Cloud Storage / File Hosting | Some file hosting models raise content and piracy concerns. | Review Check content policies. |
| Parked / For-Sale Domains | No live business is visible on the declared website. | Hold Ask for a working site. |
| Malware / Phishing / Suspicious | The site has been judged deceptive or harmful. | Decline Escalate to fraud. |
| Shopping, Food & Drink, Travel and similar | Ordinary retail and services. | Standard Normal checks. |
Category is a pointer, not a ruling: a Health & Medicine site might be a clinic blog or an unlicensed pharmacy. The category tells you where to look, and the review decides.
Card network rules, in general terms
The major card networks each run programs for merchant types they see as higher risk. Details differ by network and region, and they change, so treat this section as orientation rather than a rulebook.
Some merchant types need it first
For certain high-risk types, the acquirer must register the merchant with the network before processing. Typical examples are adult content, online gambling, some online pharmacies and tobacco sold online.
Correct coding is expected
Networks expect each merchant to carry the code that matches its main business. Miscoding high-risk sales as ordinary retail is a known compliance problem.
Extra costs for higher risk
Some programs add registration or per-transaction fees for the riskiest types. The amounts change, so confirm them with your network contacts.
Ongoing oversight
Acquirers are expected to monitor merchants after boarding, including what their websites sell, not only at the start.
Some sales are never allowed
Illegal goods and services are excluded everywhere, whatever the code. Your sponsor bank may add its own list of business types it will not support.
Show your work
Reviews by networks, banks and auditors go faster when each merchant record holds the website check, its date and the decision taken.
Check the source: the current network rules, your sponsor bank's policy and local law decide what you may accept. Use website categories to apply those rules consistently, not to replace them.
Mismatch patterns to look for
Most problems show up as a gap between what the merchant declared and what the site shows. These are the patterns risk analysts see most often.
Questions to ask the merchant
- Which websites, apps and social shops will take payments through this account?
- What are your top products by sales, and where are they shown on the site?
- Which countries do you sell and ship to?
- Do you sell any items that need a licence or an age check?
- Why does the site show products that are not in the application?
Evidence worth recording
- The categories found and the date of the lookup.
- Screenshots of product, checkout, terms and refund pages.
- The merchant's answers and any licences supplied.
- The final decision, the code assigned and who approved it.
- The date of the next scheduled recheck.
Keep it fair: many mismatches have honest causes, such as an old site, a new product line or a template left online. Ask before you decline, and record what you were told.
An onboarding workflow with website categories
Category data fits into the KYB flow you already have. It adds a fast first check, so manual review time goes to the applications that need it.
Capture every domain
Ask for all websites the merchant sells through, not only the main one, and normalize them to registered domains.
Look up categories
Join the domains to the local database file for categories, country, language and a popularity band.
Compare with the application
Check the site category against the declared business and the proposed merchant category code.
Apply your policy
Route restricted categories, mismatches, parked sites and brand new domains to manual review.
Review and decide
Analysts check products, terms, refund policy and contact details on the flagged sites.
Store the baseline
Save the onboarding category so later changes can be detected automatically.
Ongoing merchant monitoring
Boarding a merchant is the start, not the end. Our full database is refreshed monthly, and new domains are checked again after a week and after a month, so changes in what a site sells surface on a regular cycle.
Changes that deserve an alert
- Any move into a restricted category such as Adult, Gambling or Tobacco.
- A live shop that becomes parked or for sale.
- A new secondary category that does not fit the merchant code.
- A switch in main language or country away from approved markets.
Changes that are usually fine
- Extra detail in IAB content labels on the same kind of shop.
- Seasonal ranges within the same retail category.
- A blog added next to an existing shop.
- Popularity growth for a site with the same category.
Portfolio reviews in one batch
Many acquirers and payment facilitators have never labelled every merchant website at once. A single batch join gives a clear picture and a ranked list of merchants to look at.
Real business mix
Merchants by site category against merchants by code, side by side.
Mismatch list
Every merchant whose site category does not fit its code, ranked by risk.
Dead websites
Merchants whose declared website is parked, for sale or has no category.
Restricted exposure
Merchants in restricted categories, checked against registrations on file.
For broader industry codes on the same domains, see SIC and NAICS codes by website and website to industry. Category names and definitions are in our taxonomy.
Fields to keep on every merchant record
These fields come from the category database and sit next to your own application data. Together they let rules and analysts work from the same picture.
| Field | Example | Use in payments risk |
|---|---|---|
| Primary category | Shopping | Check against declared business and code. |
| Secondary categories | Health & Medicine | Find restricted lines inside a general shop. |
| IAB content category | Vitamins and supplements | Finer product detail for review notes. |
| Parked flag | No | Confirms a live business exists. |
| Country and language | Germany, German | Matches markets to licences and approvals. |
| Popularity band | Top 1,000,000 | Context on scale versus declared volume. |
| First seen | Registered 21 days ago | New sites with high declared volume need a look. |
| Category at onboarding | Stored baseline | Detects change at each refresh. |
A simple merchant website risk score
Many teams turn the website signals into a points score that decides the review route. The weights below are an example to adapt, not a standard.
| Signal | Example rule | Points |
|---|---|---|
| Restricted category | Any primary or secondary category on your restricted list. | +40 |
| Category mismatch | Site category does not fit the declared business or proposed code. | +30 |
| Parked or no category | Declared website shows no live business. | +25 |
| Very new domain | First seen in the last 30 days. | +15 |
| Market mismatch | Site language or country outside approved markets. | +10 |
| Established site | Ranked popularity among real users for a long period, same category as declared. | minus 15 |
Fast track
Standard checks only. The website confirms the application.
Analyst review
A short manual look at products, terms and contact details.
Senior review
Restricted or mismatched merchants go to the risk team before any approval.
Worked example: one week at a payment facilitator
An invented payment facilitator boards a few hundred small merchants a week. This is how website categories change the work of its two risk analysts.
Monday: batch lookup
All new applications are joined to the database. Most sites match their declared business and pass straight through.
Tuesday: mismatches
A small group of sites show a different category than declared. Analysts review these first.
Wednesday: parked sites
Applicants with parked websites are asked for a live shop before approval.
Thursday: restricted
Two applicants sell tobacco products online. They go to the specialist route with extra checks.
Friday: monitoring
The monthly refresh shows an existing merchant that moved into Gambling. Its account is reviewed.
Quick glossary
Payment and data terms used in this guide, in plain words, for colleagues outside the risk team.
Acquirer
The bank or institution that processes card payments for a merchant.
Payment facilitator
A provider that boards many sub-merchants under its own master account.
KYB
Know your business: checks that a company is real, legal and what it says it is.
MCC
Merchant category code, a four-digit code for the type of business a merchant runs.
Transaction laundering
Processing payments for one business through another merchant's account.
Card-not-present
Sales where the card is not physically shown, such as online and phone orders.
Who uses merchant website classification
Any business that takes on merchants or sellers needs to know what their websites sell. The data is the same, while the decisions differ.
Acquirers and sponsor banks
Portfolio oversight, network compliance and code accuracy.
Payment facilitators
Fast, consistent sub-merchant onboarding at volume.
Marketplaces and platforms
Seller vetting when sellers link to their own shops.
KYB and compliance vendors
Website checks embedded in onboarding products under an OEM licence.
Fraud and chargeback teams
Context on merchants behind disputes and unusual patterns.
Lenders and BNPL providers
Merchant and borrower checks on the business behind a website, before credit lines or instalment plans are offered at checkout.
Affiliate and partner programs
Partner vetting, so commissions are not paid to sites in categories the program does not allow.
Limits to plan for
Website categories make screening fast and consistent. They work best as one input in a wider KYB process, with these limits in mind.
Not identity checks
A category says what a site sells, not who owns it. Ownership and identity checks remain separate steps.
Domain level view
Large marketplaces host many sellers. For those, the seller's own pages need checking.
Hidden content
Products behind logins or shown only to some visitors may not be visible in a public site review.
Rules change
Network programs and local laws move. Keep your category to policy mapping under regular review.
Read more on parked domain detection and how to find newly registered domains, both useful when checking very new merchants.
Frequently asked questions
What is merchant website classification?
Labelling a merchant's website by what it offers, such as clothing, software, gambling or supplements. Payment providers compare that label with the application and with their restricted and prohibited lists.
Why do acquirers check a merchant's website?
The website is the shop window for card-not-present sales. A mismatch with the application can mean a wrong code, a riskier business than declared or a front site.
Do card networks have rules for high-risk merchant categories?
Yes: some categories must be registered by the acquirer before processing, typically adult content, online gambling, some online pharmacies and tobacco sold online. Lists and fees change, so check the current rules.
Can a category database replace a manual website review?
No, it screens and ranks a whole portfolio quickly, so analysts review the right merchants first. Final decisions still need a person and your own policy.
How often should merchant websites be rechecked?
At onboarding and then on a regular cycle. A monthly comparison against the onboarding category catches most changes in what a site sells.
Does a parked merchant website matter?
Yes, a merchant processing payments while its website is parked or for sale needs a closer look. You can test single sites with our domain checker.
Know what every merchant website sells
Over 120 million categorized domains with 59 web filtering categories and IAB content labels, refreshed monthly, with about 300,000 new domains categorized every day. Files run inside your own systems.