---
title: "Seller Merchant Onboarding"
description: "How to register and onboard a Seller Merchant account for your sellers via the KOMOJU API, including live application fields, payment method setup, and test simulation."
url: "https://docs.priv.staging.komoju-dev.tools/en/docs/platform-model/seller-merchant-onboarding"
source_url: "https://docs.priv.staging.komoju-dev.tools/en/docs/platform-model/seller-merchant-onboarding.md"
language: en
last_modified: "2026-03-26"
---

# Get started

As a Platform Merchant (Platform Business), you are required to register a "Seller Merchant" account for each of your sellers/users via our APIs.

Key prerequisites:

1. We only accept **Japanese entities** (both Corporation and Sole Proprietorship) to register a Seller Merchant account.
2. Seller Merchant must have a **Japanese Bank Account** to receive payouts in JPY from KOMOJU.

# 1) Create a Seller Merchant account

Request [Merchant: Create](https://docs.priv.staging.komoju-dev.tools/en/api-reference#2025-01-28/tag/platform-model/POST/merchants) API to create a Seller Merchant account with `platform_role` set to `seller`.

```curl
curl -X POST https://komoju.com/api/v1/merchants \
-u <platform merchant secret key>: \
-d name='New Seller Merchant 1' \
-d platform_role="seller"

```

| Request Attribute | Type | Description |
| --- | --- | --- |
| `name` | string | Seller Merchant's name |
| `platform_role` | dropdown | The role of sub-merchant account. Please specify it as `seller` here. |

# 2. Query the seller merchant's live_application for required fields

Request [Live Application: Show](https://docs.priv.staging.komoju-dev.tools/en/api-reference#2025-01-28/tag/platform-model/GET/live_application/%7Bmerchant_id%7D) API with seller merchant's `uuid` you received from the previous step.

```curl
curl -X GET https://komoju.com/api/v1/live_application/{id}?locale=en \
-u platform_merchant_secret_key:

```

Response example

```json
{
    "merchant_id": "5td723eoi9txn8sj545ww2mv1",
    "status": "incomplete",
    "payments_enabled": false,
    "payouts_enabled": false,
    "requested_fields": [
        {
            "field_type": "phone_number",
            "field": "company_information.company_phone",
            "field_name": "Company Phone",
            "field_properties": {
                "minLength": 1,
                "pattern": "^([() \\-_+]*[0-9]){10}[() \\-_+0-9]*$"
            },
            "optional": false
        },
      	...
    ],
    "newly_requested_fields": [],
    "errored_fields": []
}

```

Within the `requested_fields` array, you'll find the required information for Seller Merchant registration. If a field's `optional` parameter is set to `false`, the Seller Merchant must provide the relevant information. If set to `true`, they can skip it if they don't have the corresponding details.

Following is the breakdown of each field property.

```json
"field": "visa_mastercard_credit_card.access_restrictions",
"field_name": "Implemented (to be implemented)",
"field_description": "Restrict IP addresses accessible to administrators; if IP addresses cannot be restricted, set access restrictions such as basic authentication on the administrator screen.",
"field_type": "checkbox",
"field_properties": {}
"optional": false

```

- `field` is the property name that should be used when submitting information for that field.
- `field_name` is the localized name for the field that should be shown to the user.
- `field_description` is a localized explanation of what the field is asking.
- `field_type` is the type of component that should be displayed.
- `field_properties` includes information about restrictions on the value of the field.
- `optional` represents whether the field is required or not.

**(1) field_types**

Different `field_types` are meant to help direct the types of form components shown to the user to help differentiate and format expected values.

| Type | Description |
| --- | --- |
| string | A string |
| dropdown | A dropdown of values. `field_properties['enum']` will contain the translation ↔ value pairings |
| radio | A radio selection. `field_properties['enum']` will contain the translation ↔ value pairings |
| checkbox | A true/false checkbox field. |
| url | a URL |
| text | a text box intended for longer values (ex: descriptions) than `string` |
| email | an email |
| date | Datepicker that formats the date as "YYYY-MM-DD" |
| integer | a non-negative integer field |
| file_upload | A field that allows multiple files to be uploaded. The file should be uploaded to the merchant file upload endpoint. The value of the field should then be a list of the `id`s of the files uploaded. |
| single_file_upload | A field that allows one file to be uploaded. The file should be uploaded to the merchant file upload endpoint. The value of the field should then be the `id` of the file uploaded. |
| terms_of_service | Should be represented as a checkbox, but will also have an extra `external_links` field property that links to the actual service agreement(s) |
| multi_select | A field that allows a list of selected options. `field_properties['items']['enum']` will contain the translation ↔ value pairings. |

**(2) field_properties**

`field_properties` provide information on the properties of the field.

| Property | Description | Example |
| --- | --- | --- |
| enum | A dictionary of option ↔ value mapping. The option is localized based on `locale` | `"enum": {"Sole Proprietor": "sole_proprietor", "Corporation": "corporation"}` |
| minLength | minimum length of the string/text | `"minLength": 1` |
| minimum | minimum value for fields of `integer` field_type | `"minimum": 0` |
| maximum | maximum value for fields of `integer` field_type | `"maximum": 2147483647` |
| format | Follows the possible built-in formats as specified by [https://json-schema.org/understanding-json-schema/reference/string.html#built-in-formats](https://json-schema.org/understanding-json-schema/reference/string.html#built-in-formats). Currently only `date` or `email` | `"format": "email"` |
| pattern | Regex pattern for formatting values | `"pattern": "^([() \\-_+]*[0-9]){10}[() \\-_+0-9]*$"` |
| external_links | a list of URLs linking to hosted service agreements | `"external_links": ["https://example.com"]` |

# 3. Upload files for seller merchant

Some `field_type`s (`single_file_upload`, `file_upload`) require that files be uploaded via our merchant file API first, then the UUID(s) submitted as the value for the live_application.

Request [File: Create](https://docs.priv.staging.komoju-dev.tools/en/api-reference#2025-01-28/tag/platform-model/POST/merchants/%7Bmerchant_id%7D/files) API to upload the files for Seller Merchant onboarding.

We only accept jpg, png, and pdf formats. Besides, each file size should be smaller than 10MB.

```curl
curl -X POST https://komoju.com/api/v1/merchants/{id}/files \
  -u platform_merchant_secret_key: \
  -F "paper=/path/to/file"

```

The response will look like:

```json
{
    "id": "6ssx1zxovw3fgmdsdd1zuzr5u",
    "resource": "file",
    "filename": "blank.png",
    "size": 998,
    "mime_type": "image/png",
    "created_at": "2023-01-10T12:16:00.819+09:00",
    "updated_at": "2023-01-10T12:16:01.085+09:00"
}

```

# 4. Submit fields

Based on the `requested_fields` received in step 2, information can now be submitted for the Seller Merchant via [Live Application: Update](https://docs.priv.staging.komoju-dev.tools/en/api-reference#2025-01-28/tag/platform-model/PATCH/live_application/%7Bmerchant_id%7D) API.

Here's an example of submitting `company_information.company_name`

```bash
curl -X PATCH https://komoju.com/api/v1/live_application/{id} \
  -u platform_merchant_secret_key: \
  -d "company_information.company_name=My Company"

```

If successful, the response will include any additional required fields based on what was just submitted. In the case of `company_name`, `newly_requested_fields` will be blank as no additional fields rely on the value `company_name`.

**An example of `newly_requested_fields`**

If you submit `sole_proprietor` as the `company_information.corporation_type`

```bash
curl -X PATCH https://komoju.com/api/v1/live_application/{id} \
  -u platform_merchant_secret_key: \
  -d "company_information.corporation_type=sole_proprietor"

```

In the response, see that `newly_requested_fields` now includes `sole_proprietor_proofs`.

```json
"newly_requested_fields": [
      {
          "field": "company_information.sole_proprietor_proofs",
          "field_name": "Sole proprietor proofs",
          "field_type": "file_upload",
          "field_properties": {}
      }
  ]

```

`newly_requested_fields` are only shown upon `update` and return new fields that should be added to the form as a result of the last update to live_application.

**For fields that allow multiple values (`multi_select`, `file_upload` field_types)**

Submit an array of values.

```curl
curl -X PATCH https://komoju.com/api/v1/live_application/{id} \
  -u platform_merchant_secret_key: \
  -d '{
    "visa_mastercard_credit_card.countermeasures_during_card_registration":
      [ "access_restrictions_during_card_registration"]
  }'

```

# 5. Complete the Live Application

The required information may vary based on the seller's type (e.g., corporation, sole proprietorship). Our API responses will guide you through the entire onboarding process, providing additional fields under the `requested_fields` and `newly_requested_fields` arrays as needed.

The live application must be completed by filling out all fields until `requested_fields`, `newly_requested_fields`, and `errored_fields` are empty. At this stage, the status field of the application should be set to `pending`.

The information required typically falls into five categories:

## (1) Acceptance of KOMOJU Service Agreements

To provide Platform Model service to your sellers, KOMOJU must establish a direct contractual relationship with them. It requires each Seller Merchant to consent to **KOMOJU Merchant Services Terms of Use** and **Privacy Policy**. As the Platform Merchant, you are responsible for ensuring your sellers agree to these terms when registering via your interfaces.

**Referencing KOMOJU's service agreement**

At a minimum, you must provide your sellers with links to the correct terms and obtain their explicit consent when starting the onboarding process. Here's the recommended process:

1. Request [Live Application: Show](https://docs.priv.staging.komoju-dev.tools/en/api-reference#2025-01-28/tag/platform-model/GET/live_application/%7Bmerchant_id%7D) API to retrieve the URLs of **KOMOJU Merchant Services Terms of Use** and **Privacy Policy** from `service_agreement.agreed_to_tos` field.
2. Display these terms to your sellers on your platform when they opt into the service.
3. Submit your seller's consent back to KOMOJU via `service_agreement.agreed_to_tos` field in [Live Application: Update](https://docs.priv.staging.komoju-dev.tools/en/api-reference#2025-01-28/tag/platform-model/PATCH/live_application/%7Bmerchant_id%7D) API.

Here's an example of how to present our terms to your users via your interface.

![](https://files.readme.io/2158b8e-Screen_Shot_2024-02-03_at_18.51.44.png)

## (2) Company information

Below is a detailed list of the company-related information required for registration.

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `company_information.company_country` | dropdown | false | Country of company's entity. Since only a Japanese entity is allowed to use our service at this moment, you must select `JP`. |
| `company_information.corporation_type` | radio | false | The type of company, either `corporation` or `sole_proprietor` |
| `company_information.company_phone` | phone_number | false | Company's phone number |
| `company_information.share_capital_amount` | integer | false | Company's share capital. Required when the company type is `corporation`. |
| `company_information.share_capital_currency` | dropdown | false | The currency of the company's share capital. Required when the company type is `corporation`. |
| `company_information.registration_number` | string | false | The corporate number is a **13-digit unique identifier** for every Japanese corporation. Required when the company type is `corporation`. |
| `company_information.company_name` | string | false | Company's name |
| `company_information.company_name_kana` | string | false | Company's Katakana name |
| `company_information.company_name_alphabet` | string | false | Company's Alphabet name |
| `company_information.company_postal_code` | string | false | Postal code of company's address |
| `company_information.company_prefecture_state` | string | false | Prefecture of company's address |
| `company_information.company_prefecture_state_kana` | string | false | Prefecture of company's address in Katakana |
| `company_information.company_city` | string | false | City of company's address |
| `company_information.company_city_kana` | string | false | City of company's address in Katakana |
| `company_information.company_address` | string | false | Company's address |
| `company_information.company_address_kana` | string | false | Company's address in Katakana |
| `company_information.company_url` | url | true | The URL of the company's official site. |
| `company_information.industry_description` | text | false | Description of the industry that the company belongs to |
| `company_information.business_description` | text | false | Description of the company's business |
| `company_information.employee_number` | integer | false | Number of employees |
| `company_information.establishment_date` | date | false | The date of the company's establishment |
| `company_information.office_name` | string | false | Name of the company's Customer Support Department. (Please provide information that can be disclosed to Seller Merchant's customers.) |
| `company_information.contact_email` | email | false | Email to contact the company's Customer Support (Please provide information that can be disclosed to Seller Merchant's customers.) |
| `company_information.contact_phone` | phone_number | false | Phone number to contact the company's Customer Support (Please provide information that can be disclosed to your user's customers.) |
| `company_information.sole_proprietor_proofs` | file_upload | false | Provide proof of registration of sole proprietorship. Required when the company type is `sole_proprietor`. |

## (3) Personal Information

Below is the required information for the Representative Director and Applicant.

For Corporations:

- The Representative Director and Applicant can be the same person.
- The Applicant must have the authority to make decisions on corporate contracts.

For Sole Proprietorships:

- The Representative Director and Applicant should be the same person, so you only have to complete the `representative_director` fields.

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `representative_director_information.first_name` | string | false | Representative Director's first name |
| `representative_director_information.first_name_kana` | string | false | Representative Director's first name in Katakana |
| `representative_director_information.last_name` | string | false | Representative Director's last name |
| `representative_director_information.last_name_kana` | string | false | Representative Director's last name in Katakana |
| `representative_director_information.date_of_birth` | date | false | Representative Director's date of birth |
| `representative_director_information.gender` | radio | false | Representative Director's gender |
| `representative_director_information.country` | dropdown | false | Country of Representative Director's residence address |
| `representative_director_information.postal_code` | string | false | Postal code of Representative Director's residence address |
| `representative_director_information.prefecture_state` | string | false | Prefecture of Representative Director's residence address |
| `representative_director_information.prefecture_state_kana` | string | false | Prefecture of Representative Director's residence address in Katakana |
| `representative_director_information.city` | string | false | City of Representative Director's residence address |
| `representative_director_information.city_kana` | string | false | City of Representative Director's residence address in Katakana |
| `representative_director_information.address` | string | false | Address of Representative Director's residence address |
| `representative_director_information.address_kana` | string | false | Address of Representative Director's residence address in Katakana |
| `representative_director_information.address_building_name` | string | true | The building name of Representative Director's residence address. |
| `representative_director_information.address_building_name_kana` | string | true | The building name in Katakana of Representative Director's residence address. |
| `representative_director_information.phone` | string | false | Phone number of Representative Director |
| `applicant_information.country` | dropdown | false | Country of Applicant's residence address. Required when the company type is `corporation`. |
| `applicant_information.first_name` | string | false | Applicant's first name. Required when the company type is `corporation`. |
| `applicant_information.first_name_kana` | string | false | Applicant's first name in Katakana. Required when the company type is `corporation`. |
| `applicant_information.last_name` | string | false | Applicant's last name. Required when the company type is `corporation`. |
| `applicant_information.last_name_kana` | string | false | Applicant's last name in Katakana. Required when the company type is `corporation`. |
| `applicant_information.gender` | radio | false | Applicant's gender. Required when the company type is `corporation`. |
| `applicant_information.date_of_birth` | date | false | Applicant's date of birth. Required when the company type is `corporation`. |
| `applicant_information.identity_document_type` | dropdown | false | The copy of Applicant's identity document: 1. Passport 2. Driver's license 3. ID card 4. My Number Card. If the company is `sole_proprietor`, upload Representative Director's identity document. |
| `applicant_information.identity_front` | single_file_upload | false | Upload a picture or scan of the front side of the Applicant's identity document. If the company is `sole_proprietor`, upload Representative Director's identity document. |
| `applicant_information.identity_back` | single_file_upload | false | Upload a picture or scan of the back side. Required if the doc type is either Driver's License or ID Card. If the company is `sole_proprietor`, upload Representative Director's identity document. |

## (4) Site Information

Below is the required information related to your website.

- The store address must match the one listed on the website that hosts the Specified Commercial Transactions Law URL.

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `site_information.site_name` | string | false | Site's name. Site Name should be consistent with the name of the actual store. |
| `site_information.site_name_kana` | string | false | Site's Katakana name |
| `site_information.site_name_alphabet` | string | false | Site's Alphabet name |
| `site_information.site_url` | string | false | Site's URL |
| `site_information.note` | string | true | If making a payment on Seller Merchant's store requires any login information or other credentials, please supply them here. We may need to view the entire payment flow from the end-user perspective during screening. |
| `site_information.establishment_date` | date | false | The date of the site's establishment |
| `site_information.industry_type` | dropdown | false | The industry type of the site's services and products. If you're unsure, please select `other_not_listed_category`. |
| `site_information.site_annual_sales` | integer | false | Annual sales forecast of the store |
| `site_information.site_annual_sales_currency` | dropdown | false | The currency of annual sales forecast |
| `site_information.site_average_transactional_value` | integer | false | The average order value of the store |
| `site_information.site_average_transactional_currency` | dropdown | false | The currency of the average order value |
| `site_information.site_minimum_product_pricing_cents` | integer | false | The minimum price of a product in the store |
| `site_information.site_minimum_product_pricing_currency` | dropdown | false | The currency of the minimum price |
| `site_information.site_maximum_product_pricing_cents` | integer | false | The maximum price of a product in the store |
| `site_information.site_maximum_product_pricing_currency` | dropdown | false | The currency of the maximum price |
| `site_information.store_country` | dropdown | false | The country of the store address. The store address should match the one listed on the website that hosts the Specified Commercial Transactions Law URL. |
| `site_information.store_postal_code` | string | false | The postal code of the store address. |
| `site_information.store_prefecture_state` | string | false | The state of the store address |
| `site_information.store_prefecture_state_kana` | string | false | The state of the store address in Katakana |
| `site_information.store_city` | string | false | The city of the store address |
| `site_information.store_city_kana` | string | false | The city of the store address in Katakana |
| `site_information.store_address` | string | false | Store's address |
| `site_information.store_address_kana` | string | false | Store's address in Katakana |
| `site_information.sctl_url` | url | false | Specified Commercial Transactions Law URL. Please place the Specified Commercial Transactions Law page in a location that can be accessed directly from the top page. Refer to [this page](https://help.komoju.com/hc/en-us/articles/4747504515102) for the appropriate content. |
| `site_information.sales_permit_required` | radio | false | Does the seller's business require a sales permit to sell the products described? (Secondhand Dealer License, Liquor Sales License, Cosmetics Manufacturing and Sales License, Pharmaceutical Sales License) |
| `site_information.sales_permits` | file_upload | false | Upload the copies of Sales permits if `site_information.sales_permit_required` is `true` |
| `site_information.aup_accepted` | terms_of_service | false | Please ensure the seller has acknowledged and agreed with the [acceptable use policy](https://en.komoju.com/acceptable-use-policy/). |

## (5) Bank Account information

Below is the required bank account information.

For Corporations:

- You can only register a bank account under the same name as the corporation applying.

For Sole Proprietorships:

- You can only register a bank account under the name of the representative or the business name.

Before proceeding, please read [this guide](https://help.komoju.com/hc/en-us/articles/4747456646174) to ensure the bank account information is entered correctly.

> ❌ **Error:** If the account holder name is incorrect, there may be a delay in receiving the payout. Please make sure to accurately enter the half-width kana name as it appears in your bank passbook.

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `bank_account_information.transfer_type` | dropdown | false | Limited to Japanese bank accounts. Therefore, the option is limited to `domestic`. |
| `bank_account_information.default_frequency` | dropdown | false | You can decide the frequency that KOMOJU pays out to your user, either `weekly` or `monthly`. Learn more about payout frequency [here](https://help.komoju.com/hc/en-us/articles/4747518278302) |
| `bank_account_information.zengin_bank_name` | string | false | Bank's name |
| `bank_account_information.zengin_bank_code` | string | false | Bank's code |
| `bank_account_information.zengin_branch_name` | string | false | Bank branch's name |
| `bank_account_information.zengin_branch_code` | string | false | Bank branch's code |
| `bank_account_information.zengin_account_type` | dropdown | false | The bank account type, either `ordinary` or `checking` |
| `bank_account_information.zengin_account_number` | string | false | The bank account number. Please refer to [this guide](https://help.komoju.com/hc/en-us/articles/4747456646174) before filling out. |
| `bank_account_information.zengin_account_holder_kana` | string | false | Account holder's Katakana name. If incorrect, there may be a delay in receiving the payout. Please make sure to accurately enter the **half-width kana name** as it appears in your bank passbook. |
| `bank_account_information.currency` | dropdown | false | Limited to `JPY` since we only support Japanese domestic bank accounts for payout. |

# 6. Review submitted information

Request [Live Application: Show](https://docs.priv.staging.komoju-dev.tools/en/api-reference#2025-01-28/tag/platform-model/GET/live_application/%7Bmerchant_id%7D) again to review all submitted information. The `submitted_fields` array will display the information you've already provided.

# 7. Set up webhook

You can set up webhooks to subscribe to events and receive notifications when there are updates to the review status of a Seller Merchant's application.

- Learn more about Webhook events for Platform Model [here](https://docs.priv.staging.komoju-dev.tools/en/docs/platform-model/webhooks-in-the-platform-model.md)

# 8. Specify Seller Merchant's Owned Payment Methods

> ℹ️ **Note:** Owned Payment Methods can only be selected from your Common Payment Methods. Please note that only the payment methods listed in your Common Payment Methods are available for selection as Owned Payment Methods. For more details, refer to [here](https://docs.priv.staging.komoju-dev.tools/en/docs/platform-model/introduction-to-platform-businesses.md#payment-methods-setup-and-processing-fee-rate-setup).

You will need to apply for the payment methods your Seller Merchant intends to use. To view applicable payment methods to apply for, use the [Live Application: Payment Methods](https://docs.priv.staging.komoju-dev.tools/en/api-reference#2025-01-28/tag/platform-model/GET/live_application/%7Bmerchant_id%7D/payment_methods) API which will return the following:

```bash
curl -X GET https://komoju.com/api/v1/live_application/{id}/payment_methods \
  -u platform_merchant_secret_key:

```

- `submitted_payment_methods` lists the payment methods Seller Merchant has already applied for.
- `unsubmitted_payment_methods` lists the applicable payment methods Seller Merchant has not yet applied for.

To apply for a specific payment method, request [Live Application: Update Payment Method](https://docs.priv.staging.komoju-dev.tools/en/api-reference#2025-01-28/tag/platform-model/PATCH/live_application/%7Bmerchant_id%7D/payment_methods/%7Bpayment_method%7D) API.

Below are the details when applying for each payment method:

## (1) VISA/MasterCard

Payment methods: `visa_mastercard_credit_card`

Available for `corporation` and `sole_proprietor`

Note: 3D Secure 2.0 will be used for all credit card payments except some integration types. For more details, please see [this article (Japanese)](https://ja.komoju.com/blog/news/3d-secure/).

To enable credit card payments for your Seller Merchant, you will have to provide additional information about their business.

**1st stage questionnaire:**

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `shared_payment_method_data.has_processed_cc_before` | checkbox | false | Has your user's business processed credit card transactions before? (True/False) |
| `shared_payment_method_data.processes_card_info` | checkbox | false | Does your user intend to save or process credit card details? (True/False). Should select `False` since you should process the card instead of your seller. |
| `shared_payment_method_data.conducts_door_to_door_sales` | checkbox | false | Does your user's company operate Door-to-Door sales? (True/False) |
| `shared_payment_method_data.conducts_telemarketing` | checkbox | false | Does your company operate Telemarketing Sales? (True/False) |
| `shared_payment_method_data.conducts_mlm_scheme` | checkbox | false | Does your company operate Network Marketing? (True/False) |
| `shared_payment_method_data.conducts_business_opportunity_scheme` | checkbox | false | Does your company operate Business Opportunity (Biz-Opp)? (True/False) |
| `shared_payment_method_data.provides_specified_continuous_services` | checkbox | false | Does your company provide specified continuous services (aesthetic salon, beauty care, language class, tutoring, tutoring school, marriage introduction service, computer class)? (True/False) |
| `shared_payment_method_data.violated_consumer_contract_act` | checkbox | false | Has your business violated the Consumer Contract Act (消費者契約法) and lost a lawsuit due to the violation(s) in the past 5 years? (True/False) |
| `shared_payment_method_data.violated_commercial_transaction_act` | checkbox | false | Has your business violated the Specified Commercial Transaction Act (特定商取引法) in the past five years and lost a lawsuit due to the violation(s)? (True/False) |

**2nd stage questionnaire: Reporting on Security Measures**

KOMOJU has been requested by the Ministry of Economy, Trade and Industry (METI), the Japan Credit Association (JCA), and other organizations to request that EC merchants planning to introduce new credit card payment systems declare the status of their security measures based on the "Security Checklist" developed by the Credit Transaction Security Measures Council.

The "Security Checklist" covers the basic security measures set forth in the "[Credit Card Security Guidelines (Version 4.0)](https://www.j-credit.or.jp/security/pdf/Creditcardsecurityguidelines_4.0_published.pdf)" published by METI.

Topic 1: Measures against inadequate access restrictions on the administrator's screen and administrator ID/PW mismanagement

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `visa_mastercard_credit_card.access_restrictions` | checkbox | false | Restrict IP addresses accessible to administrators; if IP addresses cannot be restricted, set access restrictions such as basic authentication. `true` = Implemented, `false` = Not known |
| `visa_mastercard_credit_card.mfa_implementation` | checkbox | false | Adopt two-step or two-factor authentication to prevent unauthorized use of acquired accounts. `true` = Implemented, `false` = Not known |
| `visa_mastercard_credit_card.account_lock_v2` | checkbox | false | Enable the account lock function and lock the account after 10 or less failed login attempts (based on PCI DSS ver 4.0). `true` = Implemented, `false` = Not known |

Topic 2: Measures against inadequate settings due to exposure of data directories

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `visa_mastercard_credit_card.public_directories` | checkbox | false | Do not place important files in public directories. `true` = Implemented, `false` = Not known |
| `visa_mastercard_credit_card.file_extension_restrictions` | checkbox | false | Configure settings such as restricting file extensions and files that can be uploaded by web servers and web applications. `true` = Implemented, `false` = Not known |

Topic 3: Periodic vulnerability assessments or penetration tests, and measures to address web application vulnerabilities.

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `visa_mastercard_credit_card.vulnerability_assessments` | checkbox | false | Conduct periodic vulnerability assessments or penetration tests, and take necessary corrective actions. `true` = Implemented, `false` = Not known |
| `visa_mastercard_credit_card.sql_injection_and_xss_v2` | checkbox | false | As measures against SQL injection and cross-site scripting vulnerabilities, use the latest plug-ins and upgrade software versions. `true` = Implemented, `false` = Not known |
| `visa_mastercard_credit_card.source_code_review` | checkbox | false | If a web application is developed or customized, conduct a source code review to confirm that it has been securely coded. `true` = Implemented, `false` = Not known |

Topic 4: Installation and operation of anti-virus software as measures against malware

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `visa_mastercard_credit_card.anti_virus_software` | checkbox | false | Install anti-virus software as measures against malware detection/removal, and update signatures, perform periodic full scans. `true` = Implemented, `false` = Not known |

Topic 5: Countermeasures against malicious validation and credit masters

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `visa_mastercard_credit_card.against_validation_hack` | checkbox | false | One or more of the following measures are implemented: restrict access from suspicious IPs, restrict input from the same account, identity verification including EMV 3-D Secure, limit on the number of validity checks. `true` = Implemented (You do not need to take any additional measures if you have introduced 3D Secure via KOMOJU.), `false` = Not known |

Topic 6: Countermeasures against unauthorized login

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `visa_mastercard_credit_card.have_countermeasures_against_unauthorized_login` | checkbox | false | Does your site have a user login function (i.e., register/maintain a credit card number and log in to use that card number)? `true` = Yes, `false` = No |

Topic 7: If you answered `true` to `visa_mastercard_credit_card.have_countermeasures_against_unauthorized_login`, please answer the following questions regarding the anti-fraud login measures implemented in your system.

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `visa_mastercard_credit_card.countermeasures_during_card_registration` | multi_select | false | Please check if you have implemented effective measures to prevent fraudulent use at the time of member registration (credit card number registration). Options: `access_restrictions_during_card_registration`, `mfa_implementation_during_card_registration`, `user_information_validation_during_card_registration`, `fraud_detection_system_during_card_registration` |
| `visa_mastercard_credit_card.countermeasures_during_authentication` | multi_select | false | Please check if you have implemented effective countermeasures against fraudulent logins during login authentication after member registration. Options: `access_restrictions_during_authentication`, `mfa_implementation_during_authentication`, `login_attempt_restriction_during_authentication`, `login_notification_during_authentication`, `device_fingerprint_during_authentication` |
| `visa_mastercard_credit_card.countermeasures_during_user_data_modification` | multi_select | false | Please check if you have implemented effective measures to prevent fraudulent use when changing member attributes after login. Options: `access_restrictions_during_user_data_modification`, `mfa_implementation_during_user_data_modification`, `fraud_detection_system_during_user_data_modification` |

- `access_restrictions_during_card_registration`: Restrict access from suspicious IP addresses
- `mfa_implementation_during_card_registration`: Identification by two-factor authentication, etc.
- `user_information_validation_during_card_registration`: Confirmation of personal information at the time of member registration
- `fraud_detection_system_during_card_registration`: Fraud detection system (Fraud service)
- `access_restrictions_during_authentication`: Restrict access from suspicious IP addresses
- `mfa_implementation_during_authentication`: Identification by two-factor authentication, etc.
- `login_attempt_restriction_during_authentication`: Tighten limits on the number of login attempts (to address account password cracking)
- `login_notification_during_authentication`: Email and SMS notifications upon login, throttling, etc.
- `device_fingerprint_during_authentication`: Device fingerprints, etc.
- `access_restrictions_during_user_data_modification`: Restrict access from suspicious IP addresses
- `mfa_implementation_during_user_data_modification`: Identification by two-factor authentication, etc.
- `fraud_detection_system_during_user_data_modification`: Fraud detection system (Fraud service)

## (2) JCB/AMEX/Diners (Japan)

Payment methods: `jcb_amex_diners_credit_card`

Available for `corporation` and `sole_proprietor`

Note: 3D Secure 2.0 will be used for all credit card payments except some integration types. For more details, please see [this article (Japanese)](https://ja.komoju.com/blog/news/3d-secure/).

To enable credit card payments for your Seller Merchant, you will have to provide additional information about their business.

**1st stage questionnaire:**

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `shared_payment_method_data.has_processed_cc_before` | checkbox | false | Has your user's business processed credit card transactions before? (True/False) |
| `shared_payment_method_data.processes_card_info` | checkbox | false | Does your user intend to save or process credit card details? Should select `False` since you should process the card instead of your seller. (True/False) |
| `shared_payment_method_data.conducts_door_to_door_sales` | checkbox | false | Does your user's company operate Door-to-Door sales? (True/False) |
| `shared_payment_method_data.conducts_telemarketing` | checkbox | false | Does your company operate Telemarketing Sales? (True/False) |
| `shared_payment_method_data.conducts_mlm_scheme` | checkbox | false | Does your company operate Network Marketing? (True/False) |
| `shared_payment_method_data.conducts_business_opportunity_scheme` | checkbox | false | Does your company operate Business Opportunity (Biz-Opp)? (True/False) |
| `shared_payment_method_data.provides_specified_continuous_services` | checkbox | false | Does your company provide specified continuous services? (True/False) |
| `shared_payment_method_data.violated_consumer_contract_act` | checkbox | false | Has your business violated the Consumer Contract Act (消費者契約法) and lost a lawsuit in the past 5 years? (True/False) |
| `shared_payment_method_data.violated_commercial_transaction_act` | checkbox | false | Has your business violated the Specified Commercial Transaction Act (特定商取引法) in the past five years? (True/False) |

**2nd stage questionnaire: Reporting on Security Measures**

Same security checklist as VISA/MasterCard above, using the `jcb_amex_diners_credit_card` field prefix instead of `visa_mastercard_credit_card`.

## (3) PayPay

Payment methods: `paypay`

Available for `corporation` and `sole_proprietor`

The following information is required when applying for PayPay:

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `paypay.accepted_paypay_tos` | terms_of_service | false | Seller Merchant has read and agreed with the [PayPay加盟店規約](https://about.paypay.ne.jp/terms/?merchant-online), [PayPay加盟店ガイドライン](https://about.paypay.ne.jp/terms/merchant-online/guideline/online/), and [自治体等およびふるさと納税ポータルサイト運営会社への加盟店情報連携の同意について](https://paypay.ne.jp/store/introduction/jichitai-cp-houkatsu/). Also agrees to be contacted by PayPay regarding sales promotions. |

## (4) Merpay

Payment methods: `merpay`

Available for `corporation` only.

The following information is required when applying for Merpay:

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `merpay.accepted_merpay_tos` | terms_of_service | false | Seller Merchant has read and agreed with the [メルペイ加盟店規約](https://www.merpay.com/merchant/terms/) and [メルペイプライバシーポリシー](https://static.jp.mercari.com/privacy). |
| `shared_payment_method_data.privacy_policy_url` | string | false | URL of your user's privacy policy |

## (5) Bank Transfer

Payment methods: `bank_transfer`

Available for `corporation` and `sole_proprietor`

No additional information is required when applying for Bank Transfer.

## (6) Pay-easy

Payment methods: `pay_easy`

Available for `corporation` and `sole_proprietor`

No additional information is required when applying for Pay-easy.

## (7) Konbini

Payment methods: `convenience_store`

Available for `corporation` and `sole_proprietor`

The following information is required when applying for Konbini:

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `shared_payment_method_data.open_time` | string | false | Opening time of Seller Merchant's customer service |
| `shared_payment_method_data.close_time` | string | false | Closing time of Seller Merchant's customer service |
| `convenience_store.expected_number_of_payments` | integer | false | Seller Merchant's expected number of transactions per month |

## (8) 7-Eleven

Payment methods: `seven_eleven`

Available for `corporation` only

For 7-Eleven payment, there is a screening process to ensure that the site and operation are in line with the regulations set by 7-Eleven. The expected review time is approximately one to two months after applying.

The following information is required when applying for 7-Eleven:

| Field | Type | Optional | Description |
| --- | --- | --- | --- |
| `shared_payment_method_data.open_time` | string | false | Opening time of Seller Merchant's customer service |
| `shared_payment_method_data.close_time` | string | false | Closing time of Seller Merchant's customer service |
| `seven_eleven.no_direct_delivery_from_producer` | checkbox | false | 7-Eleven payment is not available for products shipped directly from the place of production or manufacturer. Products must be in your own or contracted warehouse for immediate delivery at the time of order. |
| `seven_eleven.no_ticket_sales` | checkbox | false | Admission tickets, spectator tickets, and other "ticket sales" cannot be handled. |
| `seven_eleven.correct_flow_for_order_items` | checkbox | false | If you have products that are on backorder or made-to-order, orders must be accepted only after the products have arrived at your store or warehouse. |
| `seven_eleven.delivery_within_two_months` | checkbox | false | Made-to-order and pre-order products must be shipped within two months of ordering. The specific date of shipment or arrival must be clearly indicated on the website. |
| `seven_eleven.all_items_are_cheaper_than_konbini_limit` | checkbox | false | If you have merchandise that requires more than 300,000 yen per transaction, your site must clearly indicate "Konbini Payment(s) cannot be used for payments over 300,000 yen". |
| `seven_eleven.display_sales_permit_number` | checkbox | false | If you have products that require a sales license, you must clearly state the license number on your website. |
| `seven_eleven.order_fee_is_displayed` | checkbox | false | Shipping costs must be clearly listed on the site and available for review before adding items to the shopping cart. |
| `seven_eleven.no_international_transaction` | checkbox | false | 7-Eleven payment can only be used within Japan. Cannot be used for overseas orders/shipments or non-Japanese websites. |
| `seven_eleven.provided_info_matches_sctl` | checkbox | false | The application information submitted to KOMOJU and the content of the "Notation based on Act of Specified Commercial Transactions" page must match. |
| `seven_eleven.sctl_page_has_phone_number` | checkbox | false | Your phone number must be displayed on the "Notation based on Act of Specified Commercial Transactions" page. **The phone number must be a landline number, cell phone numbers are not acceptable**. |
| `seven_eleven.product_pages_are_public` | checkbox | false | Are the product pages ready and publicly accessible? |
| `seven_eleven.have_sold_as_regular_price` | checkbox | false | If the product is listed with a regular and a discounted price, you must have a record of selling it at the regular price. |
| `seven_eleven.site_is_public` | checkbox | false | Is the site URL accessible? If login is required, include the login information in the "Notes" section. |
| `seven_eleven.note` | string | true | 1. Share login credentials here if ID/PW is required to access your user's site. 2. If your phone number differs from the one on the "Notation based on Act of Specified Commercial Transactions" page, enter your new phone number here. |

# 9. (Test environment only) Simulate the Live application status

Once you complete the merchant application and at least one Owned Payment Method application, you'll be able to simulate the result of KOMOJU's review.

(1) Simulate Merchant Application status

Request [Live Application: Simulate Status](https://docs.priv.staging.komoju-dev.tools/en/api-reference#2025-01-28/tag/platform-model/PATCH/live_application/%7Bmerchant_id%7D/simulate_status) API to simulate whether the merchant application will be `accepted` or `declined`.

(2) Simulate Owned Payment Method Application status

Request [Live Application: Simulate Payment Method Status](https://docs.priv.staging.komoju-dev.tools/en/api-reference#2025-01-28/tag/platform-model/PATCH/live_application/%7Bmerchant_id%7D/payment_methods/%7Bpayment_method%7D/simulate_status) API to simulate the status (`accepted` or `declined`) of an Owned Payment Method application.