How AI Is Transforming Merchant Risk Management: Insights from Rajiv Beri, CTO of NPST

Traditional underwriting models are designed to assess risk at the point of onboarding. They rely on KYC and KYB documents, business details, and predefined rules to decide whether a merchant can be onboarded. These checks remain necessary, but they capture only a snapshot of a merchant at one moment in time.

The risk landscape has become more dynamic. Acquiring is no longer limited to a few large banks, and payment aggregators and smaller institutions now manage very large merchant and sub-merchant bases. A merchant that looked legitimate at onboarding may later change its business model, transaction patterns or online presence. Systems that look at individual indicators in isolation, or that rely on static low, medium, or high labels, can miss these shifts.

The pressure is also growing from outside. UPI now averages more than 800 million transactions a day. RBI's Fraud Risk Management Directions of July 2026 expect banks to run Early Warning Signal systems in real time or with minimal lag, with particular attention to mule accounts. NPCI's UPI merchant discount rate (MDR), once applicable, will require correct merchant categorization and will carry a revenue consequence as well as a compliance one. Merchant risk has moved from a one-time decision to a lifecycle discipline.

The need is to move from a one-time assessment to continuous, contextual risk management. Banks and payment providers should understand not only who a merchant is, but also how its behaviour evolves after onboarding.

Rule-based systems work on predefined conditions. They are effective at catching known risks, but they struggle when suspicious activity does not fit an established pattern, or when fraudsters change their methods to get around existing rules. Manual reviews are thorough, but they are costly and hard to scale across large merchant bases.

AI and machine learning can analyse multiple data points together and build a view of what is normal for a particular merchant or business category. Every merchant has its own transactional profile, covering volumes, frequency, geography and timing. Instead of asking only whether a transaction crosses a fixed threshold, AI asks whether the behaviour fits that merchant’s pattern. This helps surface early warning signs, such as a small domestic merchant suddenly processing high-value transactions.

At NPST, our Risk Intelligence Decisioning Platform (RIDP) applies this across the merchant lifecycle. It produces an explainable rationale, recommends limits that can grow as a merchant builds a track record, and triggers re-underwriting when risk changes. The models draw on NPST's experience running payment infrastructure at scale, with our supervised models retrained regularly on fresh data. In some scenarios, this has surfaced risk well ahead of conventional channels.

AI doesn't replace rules, regulatory checks or human judgement. RIDP sits alongside a bank's existing fraud risk management systems, feeds intelligence back into them, and leaves final decisions with the institution.

Each signal answers a different question. Identity checks establish whether a merchant’s business information is consistent with verified records. Behavioural signals show how transactions and activity change over time. Website-risk signals show what the merchant actually does online, including prohibited content, restricted products or services, and any mismatch with the declared business category.

The value lies in reading them together. For instance, a change in a merchant's website, when accompanied by shifts in transaction behaviour or inconsistencies in business information, may indicate elevated risk and warrant further investigation.

NPST’s RIDP combines these inputs into a single, explainable risk view, so this gives banks and payment providers a more reliable basis for deciding whether to seek additional verification, revisit an existing risk assessment or leave things as they are.

Onboarding sets a merchant’s initial risk profile, but it does not guarantee that the profile will hold. Many institutions treat due diligence as a periodic exercise and then monitor lightly. That leaves a gap, because merchants can change their business practices after approval.

Banks and payment providers should watch for sudden spikes in transaction volumes, unusual transaction counts or frequency, rising refunds or chargebacks, quiet changes to business or KYC information, and mismatches between the declared business and its online presence. Repeated attempts by previously identified high-risk merchants to re-enter the ecosystem also deserve attention.

Technology makes this practical at scale. In RIDP, transaction monitoring and ongoing behavioural analysis can flag material changes and trigger a fresh risk assessment. Not every deviation signals wrongdoing. The aim is to spot warning signs early enough for institutions to verify the facts and respond proportionately.

Yes. By analysing transaction activity, merchant information, and compliance indicators together, AI can reveal early signs of trouble. One example is a pattern of very small transactions followed by disputes. The individual losses look negligible but missed response timelines can lead to penalties far larger than the transactions themselves. Catching such a pattern early lets an institution intervene before it escalates. Automated checks can also help identify potential breaches of payment-network requirements, such as prohibited content or incorrect merchant category classification.

Accuracy and reliability depend on a few things. Data from different sources must be complete, consistent, and current. Models must separate genuine business change from suspicious behaviour, since a pattern that is unusual for one merchant may be normal for another, and they must keep false alerts low. Models also drift as fraud tactics evolve, so they need regular retraining and evaluation. Institutions need explainability, so they understand why a case was flagged, along with strong data security and privacy safeguards.

Finally, a flag is not a finding. Alerts have to be reviewed in context before action is taken, which is why NPST’s RIDP keeps a human in the loop and logs the reasoning behind each decision.

Over the next three to five years, merchant risk management will become more continuous, predictive, and tightly integrated with payment infrastructure. Instead of relying on onboarding checks and periodic reviews, institutions will reassess risk as new information arrives and act before small red flags become incidents. At NPST, this is the direction of our work, drawing on our experience running payment switching, applications, and merchant technology for banks and fintechs, alongside AI-led risk intelligence.

To keep pace, banks and payment providers will need dependable data pipelines that bring together identity, business, transaction, and online-activity data. They will also need real-time decisioning infrastructure, continuous model evaluation, explainability and clear processes for acting on insights. Data governance will matter just as much, covering privacy, security and well-defined data-sharing arrangements.

I also expect more collaboration across the ecosystem. A shared case-management repository of known bad actors, accessible to trusted stakeholders and subject to regulatory and privacy safeguards, could help identify repeat offenders and systemic patterns faster. As digital payments keep expanding, the goal will be to make risk management more responsive without adding friction for legitimate merchants.