Opening a payment gateway for your NPO: what they'll ask for, and why

"We'll just use the treasurer's bank account" is the shortcut that backfires

Every committee has, at some point, considered routing donations through whichever member's bank account is easiest — no forms, no wait. It rarely survives contact with a gateway application, and even where it technically could, it shouldn't.

Bank Negara Malaysia requires an acquirer to hold merchant settlement funds in a dedicated deposit account, kept separate from the acquirer's own funds ^{[1, §10.5]} — the money has to be traceable to the merchant it belongs to. Before that relationship exists, the acquirer must first verify who it is onboarding: "relevant background information on the merchant," "legitimacy of the merchant's business," and confirmation it "has not been blacklisted by any authorities or other acquirers" ^{[1, §11.1]}. That verification is about the organisation — its registration, its named representatives, its bank account — not a member acting personally. A personal account can't show CHIP's required "header of a recent bank statement for the account donations should settle into" [vendor, help], matched against your organisation's own registration.

Practical tips:

• Open a bank account in the organisation's own name before you apply for a gateway — most banks ask for the same registration documents a gateway later will, so do it once.
• If your constitution requires two signatories for withdrawals, set that up on the account now; gateways and auditors both look for it later.
• Donors trust "Persatuan..." or "Tabung..." over a person's name — see Fundraising in Malaysia on why every channel you collect through has to land in one set of books.

What the gateway is actually checking, and why

The list of documents a gateway asks for looks intrusive until you see where it comes from. Bank Negara Malaysia's Policy Document on Merchant Acquiring Services requires an acquirer to run "proper due-diligence for on-boarding of a merchant" before any relationship starts, verifying identity "using reliable documents, information or any other measures," which may include "business registration number, identification number... owner details, business nature and products/services offered" ^{[1, §§11.1–11.3]}.

BNM's AML/CFT policy document for financial institutions goes further and names your kind of organisation directly. Under the heading "Clubs, Societies and Charities," it requires reporting institutions — which includes the banks and payment institutions in your gateway relationship — to:

"conduct the CDD requirements applicable for legal persons or legal arrangements, as the case may be, and require them to furnish the relevant identification documents including Certificate of Registration and other constituent documents. In addition, reporting institutions are required to identify and verify the office bearer or any person authorised to represent the club, society or charity, as the case may be." ^{[3, §14A.9.17]}

That single paragraph is the source of almost every document CHIP's own onboarding checklist asks a Malaysian organisation for: your registration number, your constitution or equivalent constituent document, and IC copies of the people authorised to act for you [vendor, help]. CHIP's own site is explicit that this is not an obstacle aimed at non-profits — "Associations, NGOs, mosques, suraus, and Maahad Tahfiz are welcome to apply," accepting "organisation registration documents (such as ROS, SSM, JAIS, Yayasan, or relevant religious authority approvals), details of the management committee, organisation information" [vendor, chip-in.asia].

If your organisation is registered with the Registrar of Societies (ROS) rather than SSM, know this in advance: CHIP's own application auto-fills company details from SSM records, and a ROS-registered society won't be found automatically — you'll need to contact CHIP support to submit your registration documents another way [vendor, help]. (If you're still deciding between a society and a company limited by guarantee, Society vs Company Limited by Guarantee covers what that choice means beyond payment gateways.)

Practical tips:

• Keep a digital folder with your current Certificate of Registration, constitution or by-laws, and IC copies (front and back) of everyone with signing authority — you'll be asked for this more than once.
• If you're ROS-registered, don't wait for the auto-fill step to fail; contact your gateway's support up front and ask how they handle society documents.
• A constitution that's twenty years old and still refers to a defunct committee structure is worth tidying before, not during, a gateway application.

Your committee changes every AGM. Your gateway's records don't, automatically

This is the one that catches organisations out months after they've gone live. The rule above doesn't name a point in time — it requires the institution to "identify and verify the office bearer or any person authorised to represent the club, society or charity" ^{[3, §14A.9.17]}, without saying that verifying them once, at signup, discharges the duty for good. Read plainly, the obligation is to know who is actually authorised to represent you, which is a fact that changes every time your AGM elects a new committee. Neither BNM nor gateways publish a fixed re-verification calendar — that's genuinely something to confirm with yours — but the logic holds: if the names on file are no longer the people authorised to act for you, that's the gap this rule exists to close.

Practical tips:

• Add "update payment gateway signatories" to your standard post-AGM checklist, alongside updating your bank mandate and any other registered contacts.
• Keep your AGM minutes and the resolution naming the new committee — it's the document a gateway or bank is most likely to ask for if they query a change.
• Ask your gateway directly what, if anything, they need when office bearers change, rather than assuming silence means nothing is required.

Card and e-wallet acceptance asks for more than FPX ever did

For a fuller comparison of what FPX, DuitNow QR, cards and e-wallets each mean for your donors, see Online donation payment methods. Here, the difference that matters is what each one asks of you.

FPX and DuitNow QR get approved fastest because they draw straight from a bank account the gateway has already verified. Cards and e-wallets sit behind an extra layer: CHIP's onboarding page asks for "photos of your premises — signboard, interior and exterior," a recent utility, telco or internet bill or tenancy agreement, and any special licence your activity requires [vendor, help]. This lines up with BNM's own guidance that verification methods "may include site visits, website/channel checking or company screening," scaled to "the nature and size of the business" ^{[1, §§11.2–11.3]} — a higher-risk payment method invites a closer look, not a different set of rules.

Card networks treat organisations like yours as a known, named category, not an edge case. Visa's own Merchant Data Standards Manual lists MCC 8398 – Charitable Social Service Organizations ("non-political fund-raising organizations engaged in soliciting charitable donations/contributions...") and, separately, MCC 8661 – Religious Organizations, which names "Chapels," "Mosques," "Temples" and "Synagogues" among its examples ^[4]. It's worth asking your gateway which code they've assigned you.

Practical tips:

• If you don't operate from a shopfront, CHIP accepts a home setup: photos of the front door showing the unit number and the working space are the accepted substitute [vendor, help].
• Recurring donations by card only work once card acceptance itself is approved — apply for cards early if you plan to offer monthly giving, not the week you want to launch it.
• Confirm your merchant category code once you're set up; it's a fair question to ask, not a demand.

Your website has to show pages the law never asked you to publish

A donation is, in practice, almost never refundable once it's been given and receipted — which under Visa's own rules is itself a "restricted" return policy, and restricted policies must be disclosed to the cardholder. For an e-commerce merchant, that means "during the sequence of pages before final checkout, and include a 'click to accept' button, checkbox, or other acknowledgement" — a link only satisfies this if it's part of that acceptance step ^{[5, §5.4.2.5]}. CHIP's own onboarding requirements for cards and e-wallets go further, asking that "your website must show your refund, privacy and return policies, and your SSM registration number, business address and contact details" [vendor, help] — a gateway-set condition, not a card-scheme one, but one you'll need to meet regardless.

Practical tips:

• Write your donation/refund policy honestly — most organisations genuinely don't offer refunds outside clear error, and saying so plainly satisfies the rule better than vague language.
• Publish your registration number and a real contact your organisation answers, not a placeholder inbox nobody checks.
• Do this before you apply for cards, not after a rejection tells you it's missing.

When a good appeal week gets your account a harder look

A well-publicised appeal that pulls in far more than your usual monthly volume is a good problem — until the gateway wants to understand it before releasing funds. BNM does not prohibit an acquirer from withholding funds; it requires the withholding to be handled fairly. Where funds are withheld — the rule gives "suspected fraudulent transactions" as its example — the acquirer must give "clarity in the circumstances," a "definite period," an expedient release once that period passes, the funds kept in "a separate account" not used for its own operations, and "clear communication and regular updates" ^{[1, §16.2]}. None of this means a hold will happen to you — it means that if one does, you have a right to a clear answer, not silence.

Practical tips:

• If a campaign is likely to be unusually large, tell your gateway in advance — a heads-up is cheaper than a hold.
• If funds are withheld, ask directly for the circumstance and the timeframe; BNM's rule entitles you to both.
• Keep a paper trail of campaign announcements and expected volumes — it's the fastest way to answer a gateway's questions if they come.

What this means for your organisation

1. Open your operating account in the organisation's own name, not a committee member's personal account, before you apply for a gateway.
2. Assemble your document folder now: Certificate of Registration, constitution or by-laws, and current committee members' IC copies (front and back).
3. Know your registration body (ROS, SSM or BHEUU) and how your gateway wants those documents if auto-fill doesn't recognise you.
4. Put "update the payment gateway" on your post-AGM checklist, alongside your bank mandate, whenever office bearers change.
5. Apply for cards early if you plan recurring giving — the extra documents (premises, utility bill, licence) take longer than FPX.
6. Publish a plain donation/refund policy and your registration details on your website before you apply, not after a rejection.
7. Tell your gateway in advance about an unusually large appeal, and know what to ask for if funds are ever withheld.