Not as easily as you make it sound to be. Whitelisting merchants surely will require, a whitelist. Given merchants generate brand new addresses to receive transactions, that'll be tough.