Scaling Your Merchant Portfolio With Automated Due Diligence

An ISO that underwrites a merchant well at boarding but never looks at that account again is running due diligence only once, on a portfolio that changes every day. A merchant's risk profile six months after boarding often looks nothing like it did on day one.

Automated merchant due diligence treats underwriting as an ongoing check rather than a one-time gate, which matters more as a portfolio expands past the point where any risk team can review every account by hand.

Why One-Time Underwriting Is Not Enough

Global card fraud losses reached $33.41 billion in 2024, according to the Nilson Report. A meaningful share of that risk surfaces well after a merchant is boarded, as a business changes what it sells, who it sells to, or how much volume it processes.

A portfolio that only gets checked at boarding has no way to catch a merchant that drifts into a higher-risk category over time. By the time a pattern shows up in chargebacks, the exposure has often already been building for months.

What Automated Due Diligence Actually Checks

Gratify's Underwriting product evaluates more than 62 configurable data points against six verification integrations, producing a letter-grade score an ISO can read at a glance rather than a raw number that needs interpretation.

Benchmarking a merchant's chargeback rate against its own merchant category code, rather than against a flat industry-wide threshold, catches outliers that a single blanket rule would miss. A business that looks fine against an average-risk MCC can still be flagged correctly against the tighter benchmark for its own category.

Scaling Due Diligence Across an Expanding Portfolio

Configurable rules per ISO or PayFac mean an expanding portfolio does not force every account into the same risk template. A payments company boarding merchants across several verticals can apply different thresholds to each one without building a separate process for every vertical.

A full audit trail on every underwriting decision matters more, not less, as a portfolio expands, since a sponsor bank or card network reviewing an ISO's program needs to see why each account was approved, not just that it was.

Portfolio Monitoring as the Next Layer

Underwriting a merchant well at boarding answers whether that account should have been approved in the first place. Watching how that same account behaves afterward is a separate question, and it is the one Gratify's Revenue Assurance product is being built to answer.

Revenue Assurance is still in development, but its purpose is to extend the same configurable, data-driven approach Underwriting applies at boarding into ongoing portfolio monitoring, so a risk team is not relying on a once-a-year review to catch a merchant that has drifted into a different risk category.

Schedule a demo of Gratify's Underwriting product to see how configurable due diligence rules apply across an expanding merchant portfolio.

Frequently Asked Questions

What is automated merchant due diligence?

It is the use of configurable data checks and verification integrations to evaluate a merchant's risk, both at boarding and on an ongoing basis, instead of relying only on a one-time manual review. It replaces a flat pass-or-fail check with scoring that reflects a merchant's specific business and category.

How is due diligence different from a one-time underwriting check?

A one-time check only evaluates a merchant at the moment of boarding and does not account for how that business might change afterward. Ongoing due diligence re-checks a merchant's risk profile over time, which matters because a business's risk level is not fixed.

Why does benchmarking by merchant category code matter?

Different types of businesses carry different baseline chargeback and fraud rates, so a single flat threshold either misses real outliers in low-risk categories or over-flags normal activity in higher-risk ones. Comparing a merchant against its own category produces a more accurate read on whether its numbers are actually unusual.

What does an audit trail provide that a risk score does not?

A risk score tells a reviewer what the outcome was, while an audit trail shows why that outcome was reached, including which data points and rules applied. Sponsor banks and card networks generally expect to see that reasoning, not just the final decision.

Is Revenue Assurance available today?

Revenue Assurance is still in development and is not yet a fully available product. Gratify's live Underwriting product already provides the configurable scoring and audit trail that ongoing portfolio monitoring is designed to extend.