Compliance · 14 min read
Stripe Legitimacy Checklist: How to Make Payment Stores Appear 100% Legitimate
Most merchants do not lose a Stripe account because of fraud. They lose it because their file is thin. This is the checklist we use to build payment stores that pass underwriting, survive manual review and keep processing while competitors get frozen.
Last updated August 2026
Why legitimate-looking stores survive and thin ones die
Stripe does not read your intentions. It reads a file. That file is assembled from your application data, your website, your domain history, your bank details, your descriptor, your refund rate, your dispute rate, your ticket size and how fast your volume grows. A risk analyst, or more often an automated model, compares that file against thousands of merchants who failed. If your file resembles the failures, you get a review, a reserve or a shutdown, even with a clean record.
The practical goal is simple: every single data point a reviewer can pull must agree with every other one. Same legal name on the entity, the bank account, the domain WHOIS, the invoices and the descriptor. Same address on the site footer and the formation paperwork. Same phone number that a human actually answers. Coherence is what legitimacy looks like from the outside.
The one-sentence rule
Store identity: the foundation
Identity is where suspensions are won or lost, and it is the part most sellers rush. Build this before you take a single order.
Business registration
- Legal business entity (LLC or corporation) registered in a state or jurisdiction Stripe supports for your account country.
- EIN issued by the IRS rather than a personal SSN, so the account is underwritten as a company and not as an individual.
- Business bank account in the exact legal name of the entity, never a personal account and never a relative's account.
- Business address that physically exists and can receive mail. A registered agent or virtual office suite is acceptable; a PO box is not.
- Business phone number that is answered during published business hours, with voicemail that names the company.
- Business email on your own domain, such as support@yourbrand.com, instead of Gmail, Outlook or a free mailbox.
Two details matter more than people expect. First, the legal name on the bank account must match the entity character for character, because settlement failures are one of the fastest routes to a manual review. Second, do not reuse an address, phone number or email that already appears on another merchant account that was terminated. Processors link accounts through exactly these fields.
Ownership and documentation
- Articles of organization or incorporation saved as clean PDFs, ready to send within minutes.
- IRS EIN confirmation letter (CP 575 or 147C) stored alongside the formation documents.
- Government ID for every beneficial owner listed on the application, matching the name on the entity filing.
- A recent bank statement showing the business name and account number, for verification requests.
- A short written description of the business model, supply chain and fulfilment timeline, in plain language.
Prepare the packet before you need it
Website essentials
Your website is the single artefact a reviewer will open first. It has to look like a business that intends to exist next year.
- Professional domain, .com preferred, ideally aged six months or more, with WHOIS details that do not contradict your application.
- Valid SSL certificate from a recognised authority, serving every page over HTTPS with no mixed-content warnings and no self-signed certificate.
- Working contact form plus a visible email address and phone number, with a real reply within 24 hours.
- About Us page with genuine team photos, founding story, location and what the company actually does.
- Privacy Policy that reflects your real data practices and satisfies GDPR and comparable privacy law.
- Terms of Service that are legally sound, specific to your products and consistent with your billing model.
- Shipping and Returns policy with realistic timeframes, carriers, regions served and refund windows you can honour.
- FAQ page with at least ten real questions covering delivery, refunds, product use, billing and support.
Beyond the checkboxes, the small signals matter: prices shown in the currency you settle in, a functioning cart and checkout that a reviewer can walk through, product pages with original photography, no lorem ipsum anywhere, no broken links, no placeholder social icons pointing to empty profiles. Publish the business name and address in the footer so it matches the entity on the application.
If you sell anything regulated, add the compliance layer the category expects: ingredient panels, dosage guidance, age gates, disclaimers, licence numbers or lab reports. A reviewer in a high-risk category is specifically looking for whether you know the rules of your own industry.
Product, pricing and descriptor
- The products listed on the site are exactly the products you charge for. No hidden upsells, no different catalogue behind the checkout.
- Statement descriptor contains a recognisable brand name plus a support contact, so customers do not dispute out of confusion.
- Subscription or recurring billing is disclosed before purchase, with the renewal price, interval and cancellation path in plain text.
- Pricing is inside the normal range for the category; unexplained high-ticket orders on a new account draw immediate attention.
- Refund policy on the site matches what your support team actually does in practice.
Descriptor mismatch is one of the most common and most avoidable causes of disputes. If a customer sees an unfamiliar acronym on a bank statement, they call the bank instead of you, and a dispute costs far more than the refund would have.
Operations that hold up under review
- Support inbox monitored every business day, with a target first response under 24 hours.
- Refunds issued quickly and without argument when the customer is clearly right, to keep disputes below the level that triggers monitoring.
- Tracking numbers uploaded on every physical order and attached to the payment where the processor supports it.
- Order, shipping and supplier records retained for at least two years and exportable on request.
- Chargeback evidence assembled from one place: order data, delivery proof, customer communications and the terms accepted at checkout.
- Fraud tooling switched on: address verification, CVC checks, velocity rules and blocklists for repeat abusers.
Treat your dispute rate as the number that decides your account's lifespan. Card network monitoring programmes start biting around one percent, and processors act earlier than that. Every operational habit above exists to keep that number low before a threshold is crossed rather than after.
The first 90 days of processing
New accounts are watched most closely at the start. A sudden jump from zero to heavy daily volume looks like a bust-out even when it is a genuine launch.
- Start with modest daily volume and grow gradually week over week rather than overnight.
- Keep average order value stable during the first weeks; save aggressive high-ticket offers for later.
- Run real traffic from disclosed channels, not a burst of paid traffic to a page the processor has never seen.
- Fulfil and deliver quickly, because early delivery disputes are weighted heavily against new accounts.
- Watch decline rate daily; a rising decline rate is the earliest signal that issuers or the processor are tightening on you.
Red flags that trigger review
- Domain registered days before the application, with private WHOIS and no indexed content.
- Policy pages copied verbatim from another store, still naming a different company.
- Address, phone or email reused from a previously terminated merchant account.
- Website checkout that does not work, or a catalogue that does not match the application description.
- Volume spike far beyond the amount declared during onboarding.
- Refund rate near zero combined with a rising dispute rate, which suggests unresolved customer complaints.
- Prohibited or restricted products listed anywhere on the site, even on an old page you forgot to remove.
What to do when Stripe asks questions
A documentation request is not a termination. It is a chance to close the gap between your file and reality. Respond the same day, in a calm and factual tone, with exactly what was asked and nothing that was not.
- Send unedited documents in their original form; a retouched PDF ends the conversation permanently.
- Explain the business model in three or four sentences: what you sell, who buys it, how it ships, what the refund terms are.
- Attach supplier invoices and fulfilment proof when the question is about delivery capability.
- If a reserve is proposed, accept it and keep processing rather than opening a new account elsewhere.
- Fix whatever prompted the question on the website the same day, then say that you fixed it.
Never spin up a replacement account in secret
The 10-minute self-audit
Run this once a month on every payment store. If any answer is no, fix it this week.
- Does the legal name match across entity, bank account, domain records, invoices and descriptor?
- Does the site load over HTTPS with no warnings, and does checkout complete end to end?
- Are Privacy, Terms, Shipping, Returns and FAQ pages present, current and written for this specific store?
- Did someone answer the contact form and the phone number in the last seven days?
- Is the dispute rate below 0.75 percent and the refund rate consistent with your policy?
- Is every product on the site allowed under your processor's restricted business list?
- Is the document packet complete and ready to send within the hour?
Frequently asked questions
Why does Stripe suspend accounts that have no chargebacks yet?
Stripe reviews risk before losses happen. Most early suspensions are triggered by a mismatch: the business described in the application does not match the website, the product, the descriptor or the volume pattern. Zero chargebacks does not clear that mismatch, because the review is about predicted exposure, not past performance.
Can I use an LLC formed in another state or country?
Yes, as long as the entity is real, in good standing, and matches the country of the Stripe account and the bank account you settle into. What breaks accounts is an entity registered in one country while the bank, the address and the phone number point somewhere else.
Is an EIN mandatory, or can I use my SSN?
Stripe accepts sole proprietors with an SSN, but a company profile backed by an EIN reads far better in review, keeps your personal identity out of the file and lets you settle into a business bank account. If you sell anything a processor considers high risk, get the EIN.
Does a virtual office address count as a real business address?
A registered agent or virtual office suite is generally acceptable because mail can be delivered and the address exists on the map. A PO box is not, and neither is an address that appears on twenty other merchant applications. Never reuse an address you found on a public list of cheap virtual offices.
How old should my domain be before I apply?
There is no hard rule, but domains older than six months with real indexed content, a stable WHOIS record and consistent hosting look substantially better than a domain registered the same week as the Stripe application. If the domain is new, slow your ramp-up and keep the site complete from day one.
What should I do the moment Stripe asks for documentation?
Answer within hours, not days, and send exactly what was requested in clear PDF or high-resolution scans: formation documents, EIN letter, a bank statement header, supplier invoices and fulfilment proof. Do not send extra unsolicited material, do not argue in the reply, and never send an edited document.
Does spreading volume across several payment stores keep me compliant?
It keeps you resilient, not exempt. Every store still needs its own legitimate entity, bank account, website and policies. Routing spreads volume so no single account looks abnormal and gives you a working checkout if one processor pauses you, but it never replaces the underwriting work in this checklist.
Where CloakX fits
This checklist keeps each individual account healthy. CloakX handles what happens after that: routing checkout across several legitimate payment stores, keeping every account inside safe daily limits, and moving traffic away from a store that starts showing risk signals so a single review never takes your revenue offline.