Introduction
Wire transfers move money fast. Very fast. And once funds leave, they rarely come back.
The Fedwire Funds Service processed over 217 million transfers in 2025, with an average transfer value of $5.28 million — compare that to roughly $64 per card payment. That gap in value, combined with near-instant settlement and practical irreversibility, makes wire transfers one of the highest-risk payment types in any compliance program.
For financial institutions, fintechs, and money transmitters offering wire services, the regulatory burden matches the risk. Multiple overlapping frameworks apply simultaneously:
- Bank Secrecy Act (BSA) and FinCEN's Travel Rule
- UCC Article 4A (US funds transfer law)
- UK SI 2017/692 (UK wire transfer regulations)
- EU Transfer of Funds Regulation
- OFAC sanctions requirements
This guide covers the regulatory frameworks across the US, UK, and EU; the specific fraud, AML, and sanctions risks inherent to wires; the controls that reduce liability; and what a proportionate compliance program actually looks like.
TL;DR
- Wire transfers average $5.28M per transaction on Fedwire — controls must scale to match that exposure
- US rules trigger BSA recordkeeping and Travel Rule obligations at $3,000; CTRs apply only when wire transfers are funded with cash over $10,000
- BEC fraud drove $3.05 billion in reported losses in 2025 — wire transfers were the primary vector
- OFAC sanctions violations can cost $377,700 per transaction or twice the transaction value, whichever is greater
- A fractional BSA Officer fills the named, examiner-facing role without the cost of a full-time hire
Why Wire Transfers Carry Elevated Compliance Risk
Three characteristics set wire transfers apart from every other payment method — and each one compounds the others.
- Speed eliminates the review windows that exist in other payment rails. A wire can be irrevocably settled before a compliance alert even surfaces.
- Finality means there's no chargeback mechanism, no dispute window, no practical recall once funds reach the beneficiary account.
- Scale (that $5.28M average on Fedwire) means a single fraudulent or non-compliant transaction can represent a material loss or a significant regulatory exposure.
Together, these characteristics make wire transfers the preferred vehicle for money laundering and sanctions evasion — high value, fast, and irreversible.
The Tension Compliance Teams Face
Regulators are pushing for stronger AML/KYC oversight at the same time that customers and competitors are pushing for faster settlement. It's a genuinely difficult operating condition with no clean resolution.
A compliance team that adds friction to every wire loses business to competitors — but stripping friction to stay competitive creates regulatory exposure. The organizations that navigate this well build controls that work in the background — behavioral monitoring, pre-populated beneficiary verification, out-of-band confirmation — rather than adding manual review steps to every transaction.
Wire Transfer Regulations: US, UK, and EU Frameworks Explained
US Framework
The Bank Secrecy Act (BSA) is the foundational law. Under 31 CFR 1020.410(a), banks must collect and retain specified information for each payment order of $3,000 or more. Required data elements include:
- Originator name and address
- Payment amount and execution date
- Payment instructions
- Beneficiary bank identity
The obligation applies at every point in the chain — originating bank, intermediary bank, and beneficiary bank each carry distinct recordkeeping duties.
FinCEN's Travel Rule (31 CFR 1010.410(f)) adds an information-passing requirement: for transmittals of $3,000 or more, the transmitting institution must include originator and beneficiary information in the transmittal order sent forward through the payment chain. This is separate from the recordkeeping rule — it's about ensuring the next institution receives the data, not just that you retain it.
Currency Transaction Reports (CTRs) are frequently misunderstood in the wire context. Under 31 CFR 1010.311, CTR obligations are triggered by cash transactions exceeding $10,000 — not by electronic wire transfers themselves. A wire funded with cash over that threshold creates CTR exposure; a standard bank-to-bank wire does not.
Deliberately structuring transactions to stay below the $10,000 threshold is a federal crime under 31 U.S.C. § 5324, regardless of whether the underlying activity is lawful.
UK Framework
UK wire transfer compliance sits within The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692). These regulations implement the EU transfer-of-funds regime, putting the FATF Recommendation 16 requirement for payer and payee transparency into domestic law.
Firms operating across both US and UK jurisdictions must layer these frameworks — not choose between them.
Key threshold: CDD is required for occasional transfers exceeding EUR 1,000 from outside the UK/EU. Enhanced due diligence applies separately under Regulation 33 for complex, unusually large, or economically unexplained transactions — there's no single statutory cap, but large or unusual transfers will attract scrutiny and may require supporting documentation.
EU Framework
Regulation (EU) 2015/847 requires full originator and beneficiary information to accompany transfers of funds within the EU. The updated Regulation (EU) 2023/1113, effective December 2024, extends equivalent requirements to crypto-asset transfers — meaning VASPs and crypto exchanges now face the same Travel Rule data obligations as traditional payment institutions.
The broader AML context includes two additional directives:
- AMLD5 (Directive 2018/843) — extended AML obligations to virtual currency exchanges and custodian wallet providers
- AMLD6 (Directive 2018/1673) — harmonized criminal sanctions for money laundering offenses across member states
The Key Compliance Risks in Wire Transfers
Fraud: Unauthorized and Socially Engineered Transfers
Wire fraud takes two forms. In unauthorized transfers, a bad actor gains access through malware, phishing, or stolen credentials and initiates a wire without the customer's knowledge. In authorized push payment (APP) fraud, the legitimate customer is deceived — by impersonation, fake invoices, or social engineering — into initiating the wire themselves.
Business Email Compromise (BEC) is the dominant wire fraud typology. The FBI's IC3 reported 24,768 BEC complaints and $3.05 billion in losses in 2025, with the primary payment method being wire transfers. Man-in-the-browser attacks represent a particularly difficult variant: the customer sees a normal transaction screen while malware silently redirects funds to a different beneficiary account.
Money Laundering
Incoming wires carry minimal source-of-funds information. Large sums can move across multiple jurisdictions within a single business day — which makes wire transfers a preferred vehicle for the layering stage of money laundering.
Common typologies include:
- Trade-based money laundering (TBML) — over- or under-invoicing goods to justify wire payments
- Funnel accounts — aggregating deposits then wiring out to apparent business payees
- Real estate purchases — large wires for property transactions that obscure beneficial ownership
Large or unusual wire activity should trigger enhanced CDD review, including understanding the purpose of the transfer and the sender-beneficiary relationship.
OFAC and Sanctions Risk
Every wire transfer — domestic or international — must be screened against OFAC's Specially Designated Nationals (SDN) list and applicable sanctions programs. FFIEC guidance requires institutions to screen funds transfers against OFAC lists before execution.
The penalties are substantial. OFAC civil monetary penalties for IEEPA violations reach up to $377,700 per violation or twice the transaction value, whichever is greater.
To see what enforcement looks like in practice: in 2024, SCG Plastics agreed to pay $20 million for causing US financial institutions to process $291 million in wire transfers tied to Iranian-origin transactions across 467 apparent violations.
OFAC's own FAQ confirms there is no statutory requirement to use specific screening software. The obligation is compliance with sanctions rules — how you achieve that is a risk-based determination, though automated pre-execution screening has become the practical standard.
Operational and Credit Risk
Misdirected wires — caused by incorrect routing or account numbers — are nearly impossible to recover. The beneficiary's bank has no obligation to return funds, and legal recovery is expensive and uncertain.
Internal operational risks include system outages during cut-off windows, dual-control failures, and inadequate irrevocability disclosures to customers. On the credit side, originating institutions face exposure if a wire is sent before available funds are confirmed — a risk some platforms address through a "good funds" model that reserves funds at initiation.
Wire Transfer Compliance Controls: What You Need in Place
Authentication and Authorization
UCC Article 4A-202 provides that a payment order is treated as authorized when verified through a commercially reasonable security procedure. "Commercially reasonable" is judged against customer circumstances and the practices of similarly situated banks, not against any fixed technical standard.
A layered authentication approach should include:
- MFA for all wire initiation channels
- Out-of-band confirmation for high-value transfers (desktop initiation confirmed via mobile)
- Callback verification using the customer's phone number on file, not a number provided in the wire request
- Dual-control approval for business customers — one user initiates, a separate user approves
The callback step is particularly important for BEC scenarios, where a fraudster may have compromised email and is impersonating a vendor or executive.
Transaction Monitoring and Velocity Limits
Behavioral monitoring systems should flag:
- Unusual amounts relative to account history
- Transfers to new or unverified beneficiaries
- High-frequency transfers within short windows
- Geographic patterns inconsistent with the customer profile
Set maximum daily transaction limits, velocity thresholds, and escalation triggers for enhanced review. Monitoring should cover both outgoing and incoming wires — incoming wires with no clear business purpose, or rapid inbound-then-outbound movement, are AML red flags.
CDD/EDD and Written Policies
Large wire transfers should trigger CDD review: understanding the transfer's purpose, the sender-beneficiary relationship, and supporting documentation (invoices, contracts, or proof of purchase). This is especially critical near reporting thresholds and for newly onboarded customers.
Documented wire policies must cover:
- Initiation channels and authentication steps
- Approval thresholds and cut-off times
- Cancellation procedures and irrevocability disclosure
Wire authorization records — capturing explicit customer consent with transaction details — must be retained for a minimum of five years under BSA requirements and be retrievable by name and account number.
Customer Education
Pre-transfer scam warnings are underused as a compliance control. Informing customers about BEC, real estate wire fraud, romance scams, and impersonation fraud before the wire is initiated reduces APP fraud losses and creates a documented risk disclosure. A simple confirmation screen — "Are you sure you initiated this request independently?" — introduces enough friction to interrupt the social engineering cycle before the transfer completes.
BSA/AML, the Travel Rule, and Recordkeeping Requirements
Recordkeeping by Role
Under 31 CFR 1020.410(a), obligations differ by position in the wire chain:
| Role | Key Obligations |
|---|---|
| Originating bank | Collect and retain transmitter name, address, amount, date, payment instructions, and beneficiary institution |
| Intermediary bank | Retain a copy of the payment order; pass through all information received |
| Beneficiary bank | Retain the payment order; for non-established customers, verify and record identity |
All records must be retained for five years and be retrievable within a reasonable period by name and, where applicable, account number per 31 CFR 1010.430.
The Travel Rule in Practice
The transmitting institution must include originator and beneficiary information in the transmittal order forwarded to the next institution. The obligation extends beyond internal recordkeeping — what you transmit forward matters as much as what you retain.
FATF has extended the Travel Rule concept to virtual asset transfers globally, and the EU's Regulation 2023/1113 codifies equivalent requirements for crypto-asset transfers effective December 2024. If your platform handles both wire and crypto transactions, your Travel Rule program needs to cover both rails.
Suspicious Activity Reports
Travel Rule gaps and SAR obligations often overlap — a failure to transmit required information can itself be a red flag. Wire activity should trigger SAR consideration when you observe:
- Structuring patterns around reporting thresholds
- Rapid movement of funds through multiple accounts
- Wires to high-risk jurisdictions without clear business purpose
- Activity inconsistent with the customer's stated profile or transaction history
Under 31 CFR 1020.320, banks must file a SAR no later than 30 calendar days after initial detection of reportable facts. If no suspect is identified, the filing deadline can extend to 60 days total. When a suspect is identified, that extension does not apply — and tipping off the subject of a SAR is prohibited under any circumstance.
Building a Wire Transfer Compliance Program for Fintechs and Money Transmitters
A proportionate wire transfer compliance program has five core components:
- Written wire transfer policy approved at board or senior leadership level, covering initiation channels, authentication, approval thresholds, cut-off times, and irrevocability
- Risk-based controls framework encompassing authentication, behavioral monitoring, and CDD/EDD triggers
- OFAC/sanctions screening integrated into the wire initiation workflow, prior to execution
- SAR/CTR filing process with documented escalation paths and filing timelines
- Ongoing compliance hygiene — periodic audits, staff training, and documented change management
Under 31 CFR 1022.210, money services businesses must maintain a written AML program that designates a person responsible for day-to-day compliance and provides for independent review commensurate with the MSB's risk profile.
The Compliance Officer Question
A designated BSA Officer or CCO needs to own wire transfer compliance oversight — conducting periodic policy reviews, managing SAR workflows, and serving as the point of contact with regulators and sponsor banks. For early-stage fintechs and money transmitters, a full-time hire often doesn't make economic sense.
Fraxtional provides director-level BSA/AML oversight — including named BSA Officer status on regulatory filings and sponsor bank agreements — without the overhead of a full-time hire. Full-time compliance officers earn a median salary of $78,420 annually per BLS data, before benefits and recruitment costs. Fractional engagements provide comparable seniority on a flexible retainer, with the ability to scale as the business grows.
Fraxtional's BSA Officers handle the full scope of wire transfer compliance:
- SAR/CTR workflows and filing timelines
- Transaction monitoring calibration and tuning
- OFAC screening oversight
- Policy and procedure development
- Regulator and sponsor bank communications
Ryan Cimo, Fraxtional's founder and a Top 100 Leader in Finance, holds CAMS certification and has served as BSA/AML Officer at institutions ranging from M&T Bank to high-growth fintech and crypto platforms. The team's frameworks align with FFIEC, FinCEN, and FATF standards — the same benchmarks wire transfer examiners use.
Frequently Asked Questions
What are the wire transfer regulations?
In the US, wire transfers are governed by the Bank Secrecy Act, FinCEN's Travel Rule (31 CFR 1010.410(f)), and UCC Article 4A. In the UK, SI 2017/692 applies. In the EU, Regulation 2015/847 (updated by Regulation 2023/1113) governs funds and crypto-asset transfers. OFAC sanctions requirements apply as an overlay across all jurisdictions for US persons and institutions.
What happens if you wire transfer more than $10,000?
In the US, a CTR is triggered only when a transaction involves currency (cash) exceeding $10,000 — not electronic wires by themselves. Transfers of $3,000 or more trigger BSA recordkeeping and Travel Rule requirements regardless of the amount. Deliberately structuring transfers to avoid the $10,000 cash threshold is a federal crime under 31 U.S.C. § 5324.
Why are wire transfers subject to compliance requirements?
Wire transfers are fast, high-value, and irreversible. That combination makes them a preferred vehicle for money laundering, fraud, and sanctions evasion. Regulators require compliance controls to prevent financial crime, protect consumers, and ensure funds cannot be used to finance illegal activity.
Is there a limit on wire transfers from the UK?
There is no fixed statutory cap on wire transfer amounts from the UK. However, CDD is required for occasional transfers exceeding EUR 1,000 involving non-UK/EU counterparties under SI 2017/692. Large or economically unexplained transfers trigger enhanced due diligence and may require supporting documentation from the customer.
What is the Travel Rule for wire transfers?
The Travel Rule (31 CFR 1010.410(f)) requires US financial institutions to include originator and beneficiary information in transmittal orders for wire transfers of $3,000 or more, passing this data forward through the payment chain. Equivalent requirements exist in the UK and EU, with the EU's Regulation 2023/1113 extending coverage to crypto-asset transfers from December 2024 following FATF's global guidance on virtual assets.
What records do you need to keep for wire transfers?
Under BSA regulations, originating banks must retain key transmittal data — including transmitter name, address, amount, date, and beneficiary details — for transfers of $3,000 or more. Records must be kept for five years and be retrievable by name and account number per 31 CFR 1010.430.
