YooMoney has published a detailed technical overview of YuScan, its internal service for automated risk assessment of e-commerce websites. The tool helps banks and payment organizations detect merchants that attempt to mask prohibited or high-risk activities behind seemingly legitimate storefronts.
Since its launch in 2020, YuScan has analyzed more than 550,000 merchant applications. During this period YooKassa has not received any regulatory fines related to servicing prohibited business activities.
The service is intended for organizations that process over 10,000 pages daily, work with acquiring, marketplaces, KYC/AML checks, or must comply with Russian Federal Law 152-FZ. Manual analysis of such volumes quickly becomes a bottleneck, so YuScan was developed to perform deep, automated audits at scale.
From URL to Report in Minutes
YuScan starts from a merchant’s homepage and recursively crawls the entire site structure. It behaves like a real browser by executing JavaScript, waiting for dynamic elements, and scrolling through pages. This approach reveals content that would remain hidden under simple HTTP requests.
Asynchronous processing allows the system to handle up to 1,000 sites per hour. For modern sites that rely heavily on JavaScript, the crawler uses the Playwright library. When standard automation is blocked by advanced anti-bot systems such as Cloudflare, YuScan switches to Camoufox, which modifies browser behavior at the C/C++ level to produce cleaner fingerprints and avoid detection.
Technology Stack and Architecture
The service is written in Python. The API layer is built with FastAPI, data is stored in PostgreSQL, and the crawling core is based on the open-source Scrapy framework. Playwright handles browser automation while custom scaling and risk-scoring logic sit on top of Scrapy’s queue and pipeline system.
After data collection, multiple analysis stages begin. Text, images, reviews, external links, and registration details are examined. Images are converted into vector embeddings and compared against sensitive categories such as alcohol, tobacco, and online gambling. Large language models evaluate context to reduce false positives.
External Signals and Final Scoring
YuScan also checks whether a domain appears in Roskomnadzor registries, reviews third-party feedback, analyzes WHOIS records, and looks for signs of cloned or fraudulent sites. Extracted company details (INN, KPP, OGRN, contacts, and legal documents) help distinguish real businesses from temporary or opaque operations.
Since the introduction of automated checks, merchant onboarding times have improved significantly: simple cases are completed in under three hours, half of all companies begin processing payments within one day, and seven out of ten finish the process within two days.
