When Providing Crypto Payment Collection Services to Merchants, Is It Necessary to Understand What the Merchant Actually Sells?

Short answer

Yes. A company name, certificate of incorporation and wallet address answer only part of the question; they cannot prove what the merchant actually sells or the commercial rationale for each payment received. Goods, customers, performance and fund flows should be understood on a risk-based basis, with ongoing monitoring for anomalies; this does not amount to a full audit of every merchant transaction by transaction.

cross-border finance and crypto paymentsmerchant payment collection and cross-border payments

Identity verification is not the same as transaction background verification

A business license can prove that an entity exists, but "who this company is" and "why it received this payment" are two separate questions. For merchant crypto asset collection, it should at a minimum be possible to understand the merchant's main business, the recipients of its payments, and the purpose of settlement. Otherwise, proceeds from ordinary sales, payments collected on behalf of others, and funds generated through fictitious orders will appear in the system as the same on-chain transfer.

AUSTRAC's customer due diligence guidance makes clear that due diligence should understand customer risk and the purpose of the business relationship, and should be updated when circumstances change. FATF's virtual asset risk indicators also list amounts lacking a reasonable business explanation, frequency, and abnormal customer behavior as factors of concern. FATF documents are international references for risk identification; specific obligations and reporting procedures still depend on local law.

Information should be collected around how the merchant earns money

For ordinary physical-goods e-commerce, websites, product categories, price ranges, logistics, and after-sales samples can be checked; for subscription software, subscription terms, user sources, and service delivery records are more suitable. For professional services, service contracts and milestone deliverables can be reviewed. There is no need to request exactly the same large package of documents from every type of merchant, but it should be possible to match revenue sources, collection scale, and operating capacity.

Assume a company declares that it sells low-priced software, then consecutively receives multiple payments far above its ordinary per-order price and requests settlement to an unrelated third party. The reasonable action is not merely to check whether an address has been flagged red by a risk tool, but to inquire about the transaction content, the payment relationship, and the reason for third-party collection, and then decide whether to continue processing based on the responses and evidence. This scenario is hypothetical and does not mean that a high amount is itself unlawful.

On-chain traceability may still lack off-chain facts

A transaction hash can help locate asset transfers, but it cannot independently prove that goods have been delivered, that the buyer agreed to pay, or that the merchant holds the necessary qualifications. Conversely, a formally complete invoice cannot automatically rule out problems. A more reliable approach is to cross-check on-chain records against orders, contracts, user behavior, and settlement accounts, and to retain records of how inconsistencies were handled.

Ongoing verification should have trigger conditions

It is advisable to establish a basic transaction profile at onboarding and to use newly added high-risk regions, changes in business type, concentrated complaints, or sudden changes in collection patterns as signals for review. Upon identifying anomalies, supplementary due diligence, restrictions on new transactions, or escalation for approval may be adopted in accordance with applicable law and contract; whether to report, freeze, or notify the customer must be determined separately, and all anomalies must not be treated uniformly as crimes, nor should the sales team be allowed to release them on its own.

Recommended actions

Set industry-specific lists of business information that are streamlined yet explanatory.
Record the expected amount, frequency, payer type and settlement counterparty.
Cross-verify on-chain records against sampled orders and performance evidence.
Specify the person responsible for escalation of anomalies, authority to suspend processing and record-keeping requirements.

Information note: This article provides general information and does not replace legal advice based on specific facts.

References

Know your customer: getting customer due diligence right — Australian AUSTRAC
Virtual Assets Red Flag Indicators — Financial Action Task Force (FATF)