Introduction
Operating a cross-border payment program means navigating one of the most complex regulatory environments in financial services. Unlike domestic payments, which fall under a single national framework, cross-border transactions trigger overlapping obligations in both the originating and receiving countries — plus international standards set by bodies like FATF.
The enforcement record shows what's at stake: FinCEN fined Binance $3.4 billion in 2023 for Bank Secrecy Act violations, and the FCA penalized Starling Bank £29 million in 2024 for sanctions screening failures.
This guide covers what compliance teams need to know to operate across borders without exposure:
- Key regulatory bodies across the US, UK, EU, and Canada
- AML/KYC obligations and sanctions screening requirements
- Transaction reporting thresholds by jurisdiction
- The FATF Travel Rule and its fragmented global implementation
- How to build a compliant cross-border payments program that scales
TL;DR
- No single global compliance standard exists—cross-border payments are governed by multi-jurisdictional regulations that stack on top of each other
- AML programs, KYC verification, and sanctions screening are mandatory across virtually every major regulatory regime
- FATF Travel Rule thresholds vary by jurisdiction: $3,000 in the US, £1,000 in the UK, and no threshold at all for crypto-assets in the EU
- Fintechs and money transmitters must obtain separate licenses in each jurisdiction—MSB registration in the US, FCA authorization in the UK, FINTRAC registration in Canada
- Early compliance investment — CCO, BSA Officer, MLRO — costs far less than post-enforcement remediation
What Is Cross-Border Payment Compliance and Why Does It Matter?
Cross-border payment compliance is the set of legal, regulatory, and operational obligations a business must meet when transmitting funds across national borders. At minimum, that means:
- Obtaining the correct licenses in each operating jurisdiction
- Verifying customer identities through KYC/KYB processes
- Monitoring transactions for suspicious activity
- Reporting large or unusual transfers to regulators
- Meeting data-sharing requirements like the Travel Rule
Why Complexity Multiplies Across Borders
Domestic payments follow a single regulatory framework. Cross-border payments are different — a single transaction can simultaneously trigger obligations in two, three, or more jurisdictions. A payment from a US customer to a UK beneficiary activates:
- US Bank Secrecy Act obligations (MSB registration, AML program, OFAC sanctions screening)
- UK Money Laundering Regulations (FCA authorization, UK sanctions screening)
- FATF Recommendation 16 (Travel Rule data sharing)
- Potential EU regulations if the beneficiary bank is in the EEA
Each jurisdiction imposes its own licensing regime, reporting thresholds, and enforcement standards. What's compliant in one market may violate rules in another.
That regulatory overlap is what makes cross-border compliance genuinely difficult — and what makes non-compliance so costly.
The Cost of Non-Compliance
Regulators in every major market have stepped up enforcement against payment firms. Consequences include:
- Regulatory fines: Multi-million dollar penalties are routine. Bittrex paid $29.2 million in 2022 for AML program failures.
- License revocations: Regulators can strip operating authority entirely.
- Debanking risk: Sponsor banks terminate relationships with non-compliant partners, cutting off payment rails.
- Reputational damage: Public enforcement actions deter customers, investors, and banking partners.
- Criminal liability: Under AMLD6, corporate executives can face personal criminal prosecution for AML failures.
These aren't hypothetical risks. FINTRAC issued a CAD $9.1 million penalty against TD Bank in 2024 for administrative violations — proof that even established institutions aren't exempt from cross-border compliance scrutiny.
Key Regulatory Frameworks Governing Cross-Border Payments
FATF: The International Baseline
The Financial Action Task Force (FATF) sets the foundational international standard through its 40 Recommendations. Over 200 jurisdictions worldwide have committed to FATF standards through direct membership or participation in regional bodies.
Core FATF Principles:
- Risk-based approach: Institutions must assess and mitigate ML/TF risks proportional to their exposure
- Mutual evaluations: FATF peer reviews pressure member countries to align national laws with international standards
- Grey and black lists: FATF publicly identifies high-risk jurisdictions requiring enhanced due diligence — countries on these lists face reputational damage and restricted access to international financial systems
These standards form the baseline every major jurisdiction below has translated into domestic law.
The FATF Travel Rule (Recommendation 16)
FATF Recommendation 16 requires payment service providers to collect and transmit originator and beneficiary information for wire transfers. The FATF baseline sets a minimum threshold of USD/EUR 1,000—but national implementations vary significantly:
| Jurisdiction | Threshold | Notes |
|---|---|---|
| United States | $3,000 | Applies to funds transmittals and convertible virtual currency |
| European Union | €0 (no threshold) | Transfer of Funds Regulation eliminated the threshold for crypto-assets |
| United Kingdom | €1,000 | Part 7A of the MLRs requires full information above €1,000 |
| Canada | CAD $1,000 | Record-keeping required for virtual currency transfers |
Required Information Above Threshold:
- Originator: name, account number, address (or national identity number, customer ID, date/place of birth)
- Beneficiary: name, account number, address (or equivalent identifiers for legal persons)
The fragmented Travel Rule creates real operational complexity. Firms serving multiple markets must reconcile different data requirements, transmission protocols, and verification standards— and that's before accounting for privacy regulations like GDPR, which impose competing obligations on the same data.
US: Bank Secrecy Act and FinCEN
The US Travel Rule threshold of $3,000 sits within a broader domestic framework. The Bank Secrecy Act (BSA) is the primary US AML law, enforced by FinCEN (Financial Crimes Enforcement Network), which issues regulatory guidance and processes compliance filings.
Key BSA Requirements:
- Written AML program covering policies, a designated compliance officer, staff training, and independent testing
- Suspicious Activity Reports (SARs) filed when transactions suggest money laundering or fraud
- Currency Transaction Reports (CTRs) for cash transactions exceeding $10,000
- MSB registration with FinCEN required within 180 days of establishment, renewed every two years
FinCEN processes over 1 million CTRs and SARs using advanced data analytics to identify non-compliant institutions.
EU: AMLD6 and PSD2/PSD3
The EU's Anti-Money Laundering Directive framework has evolved through six iterations. AMLD6 (transposition deadline December 2020) expanded criminal liability to legal persons, meaning companies themselves—not just individuals—can face prosecution for AML failures.
PSD2 (Payment Services Directive 2) introduced:
- Strong Customer Authentication (SCA): multi-factor authentication for electronic payments, with exemptions for low-value transactions under €30
- Open banking requirements giving third parties access to customer account data with consent
- Passporting rights allowing payment institutions licensed in one EU member state to operate across the EEA
PSD3 and the Payment Services Regulation (PSR) reached provisional agreement in November 2025. Once published, PSR will apply directly across all member states 20 days later, while PSD3 requires national transposition within 18 months.
These reforms also bring structural change to enforcement. From 2028, AMLA will directly supervise the 40 most complex high-risk financial institutions in the EU, centralizing AML oversight that was previously fragmented across national competent authorities.
UK: Post-Brexit Independent Regime
Where EU passporting once simplified cross-border access, Brexit ended that arrangement. The UK now maintains its own framework, independent of EU law and enforced by the FCA and HMRC.
UK Regime Components:
- FCA Authorization as an Authorized Payment Institution (API) or Electronic Money Institution (EMI)
- Money Laundering Regulations (MLRs) covering CDD, transaction monitoring, and suspicious activity reporting
- Wire Transfer Regulations implementing the Travel Rule at a €1,000 threshold
- HMRC MSB registration required separately, unless the firm is already FCA-supervised
- Passporting ended December 31, 2020. UK firms can no longer passport into the EU, and EU firms cannot passport into the UK — cross-border operations now require dual licensing in each jurisdiction.
Cross-Border Payment Regulations by Jurisdiction
United States: Layered Federal and State Licensing
The US operates a dual regulatory system: federal requirements plus state-by-state licensing.
Federal Level:
- MSB registration with FinCEN (required for all money services businesses)
- OFAC sanctions compliance (mandatory for all US persons and entities)
- BSA compliance obligations
State Level:
- 49 states require Money Transmitter Licenses (Montana is the sole exception)
- Each state maintains unique requirements for capital, bonding, reporting, and examinations
- 31 states have adopted the CSBS Money Transmission Modernization Act (MTMA) to standardize requirements across states
- The Multistate MSB Licensing Agreement (MMLA) allows coordinated review across participating states
Operating without an MTL in a state where you have customers is a serious violation. Fines can reach $1 million or more per violation in some states, and unlicensed operation has triggered criminal referrals in jurisdictions like New York and California.
European Union: Centralized Passporting with National Oversight
The EU passport system allows a payment institution licensed in one member state to operate across the EEA without obtaining separate licenses in each country.
Key Features:
- Single license under PSD2 grants market access across all 27 EU member states plus Iceland, Liechtenstein, and Norway
- National competent authorities (e.g., BaFin in Germany, AMF in France) supervise licensed entities
- Transfer of Funds Regulation imposes Travel Rule obligations with no de minimis threshold for crypto-assets
- AMLA will assume direct supervision of the highest-risk entities from 2028
United Kingdom: FCA Authorization and Dual Registration
UK payment firms must navigate FCA authorization and potentially HMRC registration.
FCA Categories:
- Small Payment Institutions (SPIs): Average monthly payment transactions under €3 million
- Authorized Payment Institutions (APIs): Full authorization for payment services
- Electronic Money Institutions (EMIs): Issue and redeem electronic money
HMRC MSB Registration: Required for money transmission unless already FCA-supervised. Firms supervised by FCA do not need separate HMRC registration.
Cross-Border Consideration: Serving EU customers from the UK now requires separate EU licensing—passporting is no longer available.
Canada: FINTRAC Registration and PCMLTFA Compliance
Canada's regime centers on FINTRAC (Financial Transactions and Reports Analysis Centre of Canada).
Core Requirements:
- FINTRAC Registration: Domestic and foreign MSBs must register before operating in Canada
- Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA): Primary AML/CTF statute
- Travel Rule: Information sharing required for electronic funds transfers above CAD $1,000
- Large Cash Transaction Reports: Required for transactions of CAD $10,000 or more
FINTRAC has increased enforcement activity across the board. Beyond high-profile cases like TD Bank's penalties, FINTRAC imposed CAD $224,235 on Commerciale I.C. - Pacific Inc. in February 2026 for late electronic funds transfer reporting — a signal that smaller operators are no longer flying under the radar.
Navigating Overlapping Obligations
Each jurisdiction's rules are manageable in isolation. The real complexity emerges when your operations span all four — because the regimes don't align neatly, and the gaps between them are where violations happen.
Key tension points include:
- Data Privacy vs. Travel Rule: GDPR restricts data sharing in the EU, but the Travel Rule mandates originator/beneficiary information transmission
- Mismatched Thresholds: A $2,500 payment triggers US Travel Rule obligations but not EU requirements (if non-crypto)
- Sanctions List Divergence: OFAC, EU Consolidated List, and UK Sanctions List contain different designations—screening must cover all relevant lists
- Reporting Complexity: Jurisdictions require different forms, thresholds, and filing timelines for suspicious activity and large transactions
AML, KYC, and Sanctions Screening in Cross-Border Payments
Customer Due Diligence (CDD): The Foundation
All regulated payment firms must verify customer identity at onboarding and assess the nature of the business relationship.
Standard CDD Requirements:
- Full legal name
- Date of birth
- Residential address
- Government-issued ID document verification
- Nature and purpose of the business relationship
Cross-border payments trigger enhanced scrutiny because funds moving across regulatory borders present higher money laundering and terrorist financing risk.
Enhanced Due Diligence (EDD): Higher-Risk Scenarios
EDD applies when standard CDD is insufficient to manage risk. Required for:
Politically Exposed Persons (PEPs):
FATF Recommendations 12 and 22 define PEPs as individuals entrusted with prominent public functions. EDD for PEPs includes:
- Source of wealth verification
- Beneficial ownership identification
- Senior management approval for relationship establishment
- Enhanced ongoing monitoring
High-Risk Jurisdictions:
FATF maintains grey and black lists identifying countries with strategic AML/CTF deficiencies. Transactions involving these jurisdictions require EDD.
Geography alone can trigger the obligation — even when the counterparty itself appears clean.
Unusual Transaction Patterns:
- Transaction size inconsistent with customer profile
- Rapid movement of funds through multiple jurisdictions
- Transactions involving sanctioned sectors or industries
Sanctions Screening: Real-Time Mandatory Checks
Sanctions screening is non-negotiable: every transaction and customer must be checked against active sanctions lists before funds move.
Primary Sanctions Lists:
| List | Authority | Source |
|---|---|---|
| SDN List | US Treasury / OFAC | sanctionslist.ofac.treas.gov |
| EU Consolidated List | European Union | EU Data Portal |
| UK Sanctions List | UK FCDO | gov.uk/government/publications/the-uk-sanctions-list |
| UN Consolidated List | UN Security Council | UN Security Council |
Critical Update: The UK retired the OFSI Consolidated List on January 28, 2026, replacing it with the UK Sanctions List (UKSL) as the sole authoritative source.
Screening Scope:
- Both originator and beneficiary parties
- Beneficial owners of corporate entities
- Intermediate correspondent banks
- Countries and sectors involved in the transaction
A single sanctions violation can result in multi-million dollar penalties — OFAC has issued fines exceeding $1 billion in individual enforcement actions. Screening after the fact is not a defense.
Transaction Monitoring: Detecting Suspicious Activity
Automated transaction monitoring is the operational backbone of AML compliance — manual review alone cannot keep pace with cross-border payment volumes.
Common Red Flags:
- Structuring: Breaking large transactions into smaller amounts to avoid reporting thresholds
- Unusual corridors: Payments to jurisdictions inconsistent with customer's business
- Rapid transfers: Funds moving in and out of accounts quickly with no economic purpose
- Profile mismatch: Transaction volume or type inconsistent with stated business activity
When monitoring systems flag activity that meets the suspicion threshold, firms have a legal obligation to report. Filing requirements differ by jurisdiction:
SAR/STR Obligations:
- United States: Suspicious Activity Reports (SARs) with FinCEN
- United Kingdom: Suspicious Activity Reports (SARs) with the National Crime Agency
- Canada: Suspicious Transaction Reports (STRs) with FINTRAC
- European Union: Reports to national Financial Intelligence Units (FIUs)
Filing timelines and minimum thresholds vary by jurisdiction, but the obligation to report applies whenever suspicion arises, with no minimum transaction amount required.
Transaction Reporting Thresholds and Data Standards
Key Reporting Thresholds by Jurisdiction
| Jurisdiction | Report Type | Threshold | Form/Authority |
|---|---|---|---|
| United States | Currency Transaction Report (CTR) | >$10,000 | FinCEN Form 112 |
| United States | Currency/Monetary Instrument Report (CMIR) | >$10,000 (cross-border) | FinCEN Form 105 / CBP |
| European Union | Cash Declaration | ≥€10,000 | European Commission |
| Canada | Large Cash Transaction Report | ≥CAD $10,000 | FINTRAC |
| Canada | Cross-Border Currency Report | ≥CAD $10,000 | CBSA |
The $10,000 equivalent threshold (in local currency) remains the global standard for both institutional cash reporting and physical cross-border currency declarations.
ISO 20022: The Global Messaging Standard
ISO 20022 is replacing legacy SWIFT MT formats as the global standard for financial messaging. SWIFT processed 13.4 billion messages in 2024 using ISO 20022 formats.
Compliance Benefits:
- Richer structured data: Supports Travel Rule requirements with dedicated fields for originator/beneficiary information
- Supports Legal Entity Identifiers (LEIs) for exact counterparty identification on OFAC and sanctions screening lists
- Purpose of payment codes: Improves transaction monitoring accuracy and reduces false positives
- End-to-end traceability across the full payment chain for regulatory reporting
SWIFT's mandatory ISO 20022 migration — now fully in effect for cross-border payments — means firms still running legacy MT messages face direct compliance exposure on Travel Rule data transmission.
SWIFT vs. CIPS: Complementary Networks
SWIFT remains the dominant global messaging network. CIPS (Cross-Border Interbank Payment System) operates alongside it, providing RMB-denominated cross-border clearing authorized by the People's Bank of China.
Compliance Perspective:
- CIPS and SWIFT signed a 2016 memorandum enabling CIPS participants to use SWIFT as a secure messaging channel
- Routing payments through CIPS does not exempt firms from home-jurisdiction AML/sanctions obligations
- Firms processing RMB payments through CIPS remain subject to OFAC, FATF, and local regulatory requirements
For compliance teams, the practical implication is the same: CIPS transactions require the same KYC, sanctions screening, and transaction monitoring controls as any other cross-border payment channel.
Building a Cross-Border Compliance Program
Foundational Program Components
Every cross-border payment program requires five core elements:
1. Written AML/BSA Policy
Document your risk assessment methodology, customer onboarding procedures, transaction monitoring thresholds, sanctions screening processes, and SAR/STR filing protocols. Policies must reflect the specific requirements of each jurisdiction where you operate.
2. Designated Compliance Officer
Regulators require named accountability:
- United States: BSA Officer
- United Kingdom: Money Laundering Reporting Officer (MLRO)
- European Union: Chief Anti-Money Laundering Officer (CAMLO)
- Canada: Compliance Officer
The designated officer must have authority, resources, and direct access to senior management.
3. Risk-Based Customer Onboarding
Implement tiered CDD procedures based on customer risk profile:
- Standard CDD for low-risk customers
- Enhanced Due Diligence for PEPs, high-risk jurisdictions, and complex corporate structures
- Beneficial ownership verification for legal entities (ownership threshold: 25% in most jurisdictions)
4. Ongoing Transaction Monitoring
Automated monitoring systems should track transactions in real time against risk-based rules, flag unusual patterns for investigation, and document every alert outcome. The audit trail matters as much as the detection itself.
5. SAR/STR Filing Process
Establish clear escalation procedures from alert generation through investigation, decision, and regulatory filing. Document why you filed—and why you didn't file—for every investigated alert.
The Compliance Staffing Challenge for Fintechs
Hiring a full-time Chief Compliance Officer, BSA Officer, or MLRO is expensive. Salaries for qualified executives range from $150,000 to $300,000+ annually, a cost that's prohibitive for most seed-to-Series B companies.
The fractional compliance model addresses this directly. Providers like Fraxtional place experienced CCOs, BSA Officers, CAMLOs, and MLROs on an engagement basis, covering the US, Canada, UK, and EU without requiring a full-time headcount commitment.
For early-stage fintechs, this approach offers several practical advantages:
- Named accountability: Fractional executives can be designated in regulatory filings, audits, and contracts
- Immediate deployment: No 6-12 month executive search process
- Multi-jurisdictional coverage: Single engagement covers all operating jurisdictions
- Sponsor bank credibility: Recognized by banking partners and regulators
- Flexible scaling: Adjust engagement level as funding rounds and transaction volume change
For early-stage fintechs operating cross-border, this structure preserves capital for product development while maintaining the compliance credibility regulators and sponsor banks expect.
Ongoing Compliance Maintenance: The Hidden Burden
Compliance is not a one-time build. Maintaining a cross-border program requires continuous effort across four areas.
Annual risk assessments require evaluating inherent risks across every operating jurisdiction, updating risk ratings as your customer mix and transaction patterns shift, and documenting how you're mitigating identified exposures.
Staff training isn't a checkbox. All employees with compliance responsibilities need initial onboarding training, annual refreshers, and role-specific sessions for higher-risk functions like customer onboarding and transaction review.
Regulatory change monitoring means actively tracking legislative developments across all jurisdictions where you operate. Incoming frameworks like PSD3 and the EU's AMLA regulation carry real implementation deadlines — missed updates create compliance gaps before you realize it.
Sponsor Bank Due Diligence:
Sponsor banks conduct periodic reviews of your compliance program. Be prepared to demonstrate:
- Written policies and procedures current with regulatory requirements
- Evidence of transaction monitoring effectiveness (alert volume, investigation quality, SAR filings)
- Independent audit results
- Training completion records
- Designated compliance officer qualifications
Independent Compliance Audits:
Most sponsor banks and many regulators require periodic independent testing of your AML/BSA program. Third-party audits identify gaps and provide remediation roadmaps — better to find them internally than during a regulatory examination.
Frequently Asked Questions
What are the cross-border financial regulations?
Cross-border financial regulations are the national and international rules governing how money moves between countries. They cover AML/KYC requirements, licensing obligations, sanctions screening, and transaction reporting — enforced by regulators like FinCEN (US), FCA (UK), and FINTRAC (Canada). All are underpinned by FATF standards, which over 200 jurisdictions have adopted.
What is the role of AML and KYC in cross-border B2B payments?
AML programs monitor cross-border payment flows for suspicious activity, while KYC verifies the identity and legitimacy of business customers at onboarding. Both are mandatory in every jurisdiction a transaction touches, including beneficial ownership verification for corporate entities above the 25% threshold.
Is CIPS an alternative to SWIFT?
CIPS is China's payment infrastructure for RMB cross-border transactions and runs parallel to SWIFT — it does not replace SWIFT globally. Most international payments still flow through SWIFT, and using CIPS does not exempt firms from their home jurisdiction's AML or sanctions compliance obligations.
