Skip to main content
Melio runs the KYC, KYB, sanctions, and payment-risk checks for you. This page explains where those checks happen, how you find out the result, and what can block a payment.

​
Entity validation

When you create an entity (POST /entities), Melio validates the submitted fields. If a field has the wrong type or fails a rule, the request returns 400 with field-level detail in the error details, naming the field and the problem. A common case is a tax-id type that does not match the business formation type.

​
Business eligibility (KYC, KYB, sanctions)

Melio screens the business and its owner (the owner’s name and date of birth are collected for sanctions screening). The result is exposed continuously through the limitations endpoint:
Each write operation is reported as allowed: true, or allowed: false with one or more reasons. A reason carries a code and, when relevant, the fields that are missing. When eligibility changes, Melio sends api.entity.updated and api.limitation.updated. If information or documents are missing, Melio may contact the entity directly.
Some compliance fields are fixed once the entity is created: legalName, legalAddress, and taxInfo. Sending them in an update returns 400.

​
What can block a payment

A payment can be stopped at several points: The risk review is the one that can stop a payment that already looked accepted: the payment stays blocked during review, with no separate status. Device and IP signals from the Sonar SDK feed this decision.

​
How to react

  • Check limitations first. Read GET /limitations before adding accounts or creating payments, and surface missingFields to the business.
  • Handle the errors. Treat 403 BUSINESS_NOT_ELIGIBLE and the 400 compliance errors as user-fixable, not retryable as-is.
  • Subscribe to the webhooks. api.entity.updated, api.limitation.updated, and api.payment.updated tell you when a decision changes.

Sonar session token

The device and IP signals that feed the payment risk decision.