Direct answercompliance in international payments is the set of practices that keeps your operation within the rules required by banks, acquirers, and applicable law. The four pillars every seller needs to know are: KYC (identity verification at onboarding, which at Mundpay takes up to 24 business hours), PCI-DSS (card data security), data protection (safeguarding the buyer's personal data), and fraud and money-laundering prevention. Compliance does not slow the business down. It reduces blocks, lowers chargebacks, and increases the trust banks place in your account. The exact scope varies by case, so seek specialized guidance when needed.

What is compliance in payments, and why does it matter?

Compliance means being in conformity with the rules surrounding the money that flows through your operation. In international digital commerce, these rules come from several fronts at once: the banks that issue the cards, the acquirers that process the transactions, industry security standards, and the legislation of each country involved.

For the seller, it matters for one direct reason: the entire payment structure depends on trust. A gateway can only maintain high approval rates and stable accounts because it guarantees to banks that the transactions passing through it are legitimate. When a seller operates outside the rules, they do not just harm their own account, they add risk to the whole chain, and that is why the system reacts with blocks.

Thinking of compliance as a cost is the most common mistake. In practice, it is the opposite: every layer of compliance removes a reason for your money to be held, disputed, or blocked. The trust that sustains the operation starts exactly here.

KYC: know your customer and onboarding

KYC stands for Know Your Customer. It is the identity verification process every seller goes through when signing up. It is not a whim of the platform: it is a requirement of the financial system itself, to guarantee that there is a real, traceable person or company behind every account.

At Mundpay, onboarding KYC asks for:

  • Identity document of the person responsible for the account.
  • Proof of address, up to date.
  • Company registration and articles of incorporation, in the case of a registered business.

The review period is up to 24 business hours. Submitting documents that are legible, current, and consistent with each other speeds up approval and avoids back and forth. Beyond unlocking the account, good KYC is what sustains its stability over time: a verified identity generates less suspicion and fewer future holds. It is the foundation the rest of compliance rests on.

Data security: PCI-DSS and personal data protection

Two terms come up whenever the topic is data in payments, and it is worth separating what each one covers, because they are different layers.

  • PCI-DSS is the security standard specific to card data. It defines how the card number and transaction information are transmitted and stored securely within the payment environment. In practice, this standard is the gateway's infrastructure responsibility, not the seller's, but knowing it helps explain why a serious checkout never asks you to store card data on your own.
  • Personal data protection law, such as Brazil's LGPD, covers any personal data of the buyer: name, email, tax ID, address. It requires a legal basis and a clear purpose for processing that data. Here the seller has an active role, because they are the one collecting and using that data in marketing and customer relationships.

The practical rule is short: card data stays protected by the gateway's standard; the buyer's personal data is handled with care, transparency, and legitimate purpose. Promising one thing at checkout and using the data for another is where most data protection problems are born.

Fraud and money-laundering prevention

This pillar protects the business from two sides. On one side, fraud: transactions made with stolen cards or fake data, which turn into chargebacks and losses. On the other, anti-money laundering (AML) prevention, which guarantees the payment structure is not used to move funds of illicit origin.

Both connect back to KYC. Knowing who the seller is and monitoring transaction patterns is what allows the system to tell a healthy operation apart from a risk signal. When behavior strays from what is expected, the risk system kicks in.

At Mundpay, this risk team is proactive: it contacts the seller before applying any restriction, instead of blocking without warning. The result is that about 90% of alerts are resolved before turning into a formal chargeback. For the seller, this means one important thing: cooperating with the risk team, responding quickly, and keeping the operation transparent is what turns an alert into a resolved misunderstanding, not a frozen account.

We see our customers as invited guests to a party, and we are the hosts. It is our job every day to make every important aspect of the customer experience a little bit better.

Jeff Bezos Source: Jeff Bezos's letters to Amazon shareholders.

How does compliance reduce blocks and chargebacks?

Here is the missing piece. Compliance is not a brake on growth, it is what removes the reasons growth gets interrupted. Almost every block and almost every dispute is born from a risk signal, and each compliance pillar erases one of those signals:

  • Verified identity (KYC) removes suspicion of a fake account or registration fraud.
  • Protected data (PCI-DSS and data protection law) reduces security incidents and complaints.
  • Transparent operation (antifraud and AML) keeps the chargeback rate low, within the limit tolerated by acquirers, which is 0.90%.

A compliant seller triggers fewer alerts, and fewer alerts mean more stable accounts, more predictable payouts, and fewer surprises. If your concern is precisely not losing access to your cash, it is worth learning the practices to avoid a payment gateway block, which go hand in hand with compliance.

Seller compliance checklist

An actionable summary of what to keep in order day to day:

  • Complete onboarding: document, proof of address, and, if a registered business, company registration and articles of incorporation, all legible and current.
  • Consistent data: the sign-up information matches the operation and the invoice.
  • Secure checkout: use the gateway's infrastructure for card data, never collect or store it yourself.
  • Data protection in practice: make clear what data you collect and why, and use it only for the stated purpose.
  • Relationship with risk: respond quickly to the risk team and keep chargebacks below 0.90%.
  • Niche and market: check the specific rules for your segment, especially on international sales like Nutra under FDA rules.
  • When in doubt, get guidance: when changing markets or business model, seek specialized legal or accounting support.

An honest caveat is due: compliance varies by case, by country, and by segment. This checklist covers the essentials of a digital operation, but it does not replace a specialist's analysis when the situation calls for it.

In short: compliance for the seller

  • Compliance in international payments means operating within the rules of banks, acquirers, and applicable law, with legitimate and traceable transactions.
  • KYC is identity verification at onboarding: document, proof of address, and, for a registered business, company registration and articles of incorporation, reviewed in up to 24 business hours at Mundpay.
  • PCI-DSS protects card data within the payment environment; data protection law protects the buyer's personal data end to end.
  • Fraud and anti-money laundering (AML) prevention stops illegitimate transactions; at Mundpay the risk team is proactive and resolves about 90% of alerts before a chargeback.
  • Compliance reduces blocks and chargebacks because it erases the risk signals that trigger holds, keeping the rate below the 0.90% limit.
  • Scope varies by country, niche, and model; when in doubt or expanding, seek specialized legal or accounting guidance.

FAQ: Frequently asked questions on compliance in international payments

What is compliance in international payments?

Compliance in international payments is the set of practices that keeps a seller's operations within the rules that banks, acquirers, and applicable laws require. In practice it involves verifying the identity of who sells (KYC), protecting card data with the PCI-DSS standard, handling personal data according to LGPD, and maintaining controls to prevent fraud and money laundering. The goal is simple: legitimate, traceable, and secure transactions with less risk of account restriction. The exact scope varies by country, niche, and business model, so seek specialized guidance whenever in doubt.

What is KYC and how long does onboarding take at Mundpay?

KYC (Know Your Customer) is the verification of seller identity at signup. It includes identity document, proof of address, and for Business Entity, business registration number and partnership agreement. At Mundpay the onboarding analysis takes up to 24 business hours. KYC is not bureaucracy for its own sake: it reduces fraud, protects the gateway's reputation with banks, and sustains account stability over time.

What is the difference between PCI-DSS and LGPD?

They are different layers. PCI-DSS is a security standard specific to card data, defining how that data is transmitted and stored safely in the payment environment. LGPD is Brazilian law on personal data protection and covers any data that identifies a person, like name, email, and CPF, requiring legal basis and purpose for processing. One protects the card number in the payment flow, the other protects the buyer's personal data end to end.

Does compliance help avoid blocks and chargebacks?

Yes. Most blocks and disputes come from risk signals: unverified identity, inconsistent data, or transaction patterns that look like fraud. When a seller keeps KYC current, data protected, and transparent operations, they send fewer risk alerts and gain account stability. At Mundpay the risk team is proactive and contacts the seller before any restriction, and about 90% of alerts get resolved before becoming a formal chargeback. Acquirers tolerate a chargeback limit of 0.90%.

Does a seller need specialized compliance guidance?

It depends. For most operations, following the gateway's KYC, respecting PCI-DSS and LGPD, and maintaining an antifraud policy covers daily needs. But compliance varies by country, niche, and volume, and sensitive niches like Nutra in the US have additional rules. Whenever there is expansion to a new market, a change in model, or doubt about a specific obligation, the recommended path is to seek legal or accounting guidance specialized in that area before acting.

If Mundpay's risk team contacts you, what should you do?

The risk team is proactive and contacts you before applying any restriction. When you get an alert, the recommendation is to respond quickly and provide the requested information with transparency. Most alerts get resolved before becoming a formal chargeback, about 90%. Cooperating in this process, explaining your operation's context, and keeping documentation current is what turns an alert into a resolved misunderstanding. Never ignore or delay responding to the risk team, because lack of response can make the situation worse.

What happens if you don't keep operations in compliance?

Operating outside compliance rules causes account blocks, payout holds, and transaction disputes. A non-compliant seller sends more risk signals, which triggers frequent alerts, limit restrictions, and eventual account closure. Beyond that, it hurts the entire payment chain, not just one account. The system reacts with blocks to protect banks and acquirers. The chargeback limit acquirers tolerate is 0.90%, and exceeding it triggers more restrictions. In summary, noncompliance kills cash flow predictability and can stop the business.