DNB publishes good practices on (in)direct payment services to sub-merchants

Background

The Dutch Central Bank conducted a thematic survey on a number of payment institutions and electronic money institutions involved in providing payment services to sub-merchants in 2022. The reason for this was that the Dutch Central Bank found that institutions were increasingly setting up arrangements through their customers to provide payment services to sub-merchants. A sub-merchant is a provider of goods or services, which has a business relationship with a customer of a payment institution or electronic money institution, and whose transactions for purchased products or services are processed by the payment institution or electronic money institution concerned. A common example is that the customer operates a platform, where payments are processed for the sellers operating on the platform. The aim of this study was to understand the integrity risks associated with these sub-merchants services. Moreover, it examined what control measures the selected institutions have in place to manage these integrity risks.

Good practices

Based on the above research, the Dutch Central Bank has drawn up good practices that help institutions to be able to actively analyze and identify specific risks for their own activities related to sub-merchants. This puts institutions in a better position to implement appropriate control measures.

Systemic integrity risk analysis (SIRA)
Pursuant to Section 2b Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wet ter voorkoming van witwassen en financiering van terrorisme), payment institutions and electronic money institutions must take measures to identify and assess risks of money laundering and terrorist financing. An essential part of this measure is the Systemic integrity risk analysis (SIRA). For institutions that provide services to customers with sub-merchants, it is recommended that the SIRA specifically includes an understanding of the risks related to these sub-merchants so that the risk related to their own customers portfolio can be identified. For conducting an effective SIRA, some good practices are recommended by the Dutch Central Bank. It is important to identify what kind of partnership structures customers of the institution have agreed with sub-merchants. The Dutch Central Bank outlines three examples in the good practices: i) marketplaces and platforms, ii) payment facilitators/aggregators, and iii) referral partners and other business partners.

Policy and customer due diligence
Payment institutions and electronic money institutions are required under the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act to conduct customer due diligence, which is based on an appropriate policy. To effectively implement the policy on sub-merchants, payment institutions and electronic money institutions can consider several elements directly related to their customer due diligence. One of these good practices is to establish a risk profile for customers with sub-merchants. Another key issue is to have customers with sub-merchants who are “in the payment stream” demonstrate that they are properly licensed as payment service providers.

Transaction monitoring
Payment institutions and electronic money institutions are required to monitor transactions appropriately. The Dutch Central Bank has found that monitoring transactions is more challenging in partnership structures with sub-merchants where all transactions are processed on one account (e.g., the account of the marketplace or a facilitator) and/or are processed in bulk. This is because the transaction monitoring system uses only one transaction profile instead of separate transaction profiles for the underlying sub-merchants. This makes it more difficult to detect potentially unusual transactions. In that case, the Dutch Central Bank recommends developing specific business rules to distinguish transactions form different sub-merchants and thus better monitor them. When creating the transaction profile, the institution includes the expected transaction profile of the underlying sub-merchants. The institution asks the customer with sub-merchants to regularly share the portfolio data of its sub-merchants.