Consent, Context and Corroboration: The Open-Banking Evidence File Offshore Acquirers Expect
Why bank data matters to an offshore acquirer
An offshore acquirer underwriting a UK merchant is not simply assessing whether the business can process card payments. It is assessing whether the business can absorb the consequences of doing so: settlement timing, refund liability, chargeback exposure and the reserve that may be required if volumes rise or dispute levels deteriorate. Bank data is one of the few independent sources that can corroborate the merchant's own account of those matters.
Open banking has made that data easier to retrieve, but easier retrieval is not the same as a better evidence file. An underwriter needs to understand what the data represents, how it was obtained, what period it covers and why it is relevant. A folder of raw CSV exports rarely answers those questions. As of 2026, the more persuasive approach is to treat open-banking data as part of a controlled evidence pack, with consent records, narrative context and a clear boundary around what is disclosed.
What underwriters look for in source-of-funds reviews
Source-of-funds work is often where bank data is most useful and most frequently mishandled. The acquirer is seeking evidence that the funds supporting the business, and any reserve or guarantee, are consistent with the merchant's stated activity. It is not conducting a general audit of the director's personal life. The relevant question is whether the business's inflows and outflows tell a coherent story.
A well-presented file will usually show the account holder, the account type, the statement period and the nature of the transactions. It will identify the main categories of inflow — customer receipts, platform payouts, intercompany transfers, investor funding — and explain any material items that could otherwise look anomalous. It will also show outflows that support the business model, such as supplier payments, payroll, tax and financing costs.
Open-banking exports can help because they provide structured transaction data rather than a static PDF. But structure alone does not supply meaning. A transaction labelled 'transfer' may be a settlement from a payment processor, a director's loan or an unrelated movement. The evidence file should reconcile the labels to the business's own records and state clearly where an item has been explained by an invoice, contract or processor report.
Settlement narratives and the chargeback reserve conversation
Settlement data deserves particular attention. Offshore acquirers often want to see how card receipts arrive in the UK bank account, whether settlement cycles are predictable and whether the merchant has a buffer between receipt and refund or chargeback liability. Open-banking data can show the rhythm of incoming settlements, but the acquirer also needs the matching processor statements and a note on any timing differences.
Where a reserve is under discussion, the bank data should support the merchant's case without overstating it. A merchant might show that net inflows have been stable across several months, that refunds are funded from operating cash rather than reserve releases, and that the business holds a sensible working-capital balance. It should not present a single strong month as proof of durability. Underwriters are alert to seasonal businesses, concentrated customer bases and settlements that are temporarily inflated by delayed payouts.
A practical approach is to provide a short reserve narrative alongside the data: the reserve calculation proposed, the period it covers, the expected release triggers and the bank evidence that supports the merchant's ability to fund it. This keeps the conversation anchored to the acquirer's risk question rather than turning into an open-ended data request.
Presenting the data without over-sharing
UK merchants should be mindful of data minimisation under UK GDPR and of the commercial sensitivity of bank information. An offshore acquirer may ask for 'all bank statements' when a narrower set would suffice. The merchant is entitled to clarify the purpose, the period and the level of detail required.
A controlled disclosure might include:
- business current account statements for the last six to twelve months, depending on the review;
- open-banking transaction exports covering the same period, with a data dictionary explaining column headings;
- a schedule of material inflows and outflows, with references to supporting documents;
- processor settlement reports that reconcile to the bank credits;
- a redaction log identifying any personal data removed and the reason for removal.
Redaction should be principled, not selective in a way that misleads. Removing a director's home address is sensible; removing an entire transaction line because it is inconvenient is not. If a transaction is commercially sensitive, the merchant can offer a summary or a reference to a document reviewed under confidentiality rather than leaving an unexplained gap.
Consent also needs a paper trail. Open-banking data is accessed through regulated third-party providers and time-limited consent. The evidence file should record when consent was granted, which accounts were in scope, the retrieval date and when access expires. If the acquirer later queries the data, the merchant should be able to show that the export was authentic and contemporaneous.
A 2026 checklist for onboarding and periodic reviews
- Confirm the acquirer's specific data request in writing, including purpose, period and preferred format.
- Retrieve open-banking data through a regulated provider and save the consent record with the export.
- Reconcile bank credits to processor settlement reports and note any timing differences.
- Prepare a one-page cash-flow narrative covering inflows, outflows, seasonality and material anomalies.
- Identify source-of-funds items and link each to a supporting document or a clear explanation.
- Build a reserve-support schedule if a holdback or reserve is under discussion.
- Redact unnecessary personal data and maintain a redaction log.
- Label every file with account, period and retrieval date; avoid unattributed spreadsheets.
- Store the pack securely and share only through an agreed channel.
- Diarise consent expiry and refresh the evidence before the next periodic review.
The objective is not to overwhelm the underwriter with data. It is to give the acquirer a verifiable, proportionate account of the business's cash flow, with enough context to answer the risk questions that offshore acquiring naturally raises. An open-banking paper trail is most valuable when it reads as evidence of control, not as a data dump.
