Why are payment firms rated high risk for money laundering?
- 16 June 2023. The EBA reported that EU supervisors see payment institutions as a sector of high inherent risk, with controls "not always effective" and no EU level common approach to supervising agent networks.
- 17 July 2025. The UK's national risk assessment raised the money laundering risk of electronic money institutions (EMIs) and payment firms from medium to high (para 5.64).
- 10 July 2027. The EU's AML Regulation starts to apply directly to payment institutions and EMIs (art. 90).
Distance explains the ratings. Anti money laundering (AML) rules assume a firm knows who stands behind each payment, yet a payment firm often meets its end user only through a merchant, an agent or a partner bank. The UK assessment names onboarding simpler than at high street banks, agents that run the checks themselves, prepaid cards that move value across borders and virtual IBANs that hide flows from the partner bank (paras 5.66 to 5.74). Volume rose too: UK EMIs and payment firms reported £921 billion of payments in 2020 and £2.06 trillion in 2023 (Box 5.C).
The US 2024 national money laundering risk assessment counts about 26,472 registered money services businesses (15 December 2023); in 2022, depository institutions filed almost 3,580 suspicious activity reports on possibly unlicensed ones.
Who must comply in the payments industry, by jurisdiction?
| Rulebook | Law (in force, November 2026) | Supervisor | Licenses caught |
|---|---|---|---|
| FATF | FATF Recommendations: R.14 (money or value transfer services), R.16 (payment transparency, revised 18 June 2025), R.10 | National authorities, assessed in mutual evaluations | Money or value transfer providers and their agents |
| EU | Directive (EU) 2015/849 art. 2(1)(2) until 9 July 2027; Regulation (EU) 2024/1624 (AMLR) art. 3 from 10 July 2027 (art. 90); PSD2; Directive 2009/110/EC on electronic money; Regulation (EU) 2023/1113 (TFR) | National AML supervisors; AMLA directly supervises selected firms from 2028 | Payment institutions, EMIs, currency exchange; account information services left out (AMLR art. 2(1)(6)(a)) |
| UK: AML in the UK | Money Laundering Regulations 2017 (MLRs, amended by S.I. 2026/621 from 30 June 2026); Payment Services Regulations 2017 (PSRs); Electronic Money Regulations 2011 (EMRs); POCA 2002; SAMLA 2018 | FCA (EMIs, payment institutions); HMRC (UK money service businesses); PSR for the APP rules | Authorized and small payment institutions, EMIs, their agents, money remitters |
| US: AML in the US | Bank Secrecy Act, 31 CFR part 1022; 31 U.S.C. 5330; 18 U.S.C. 1960; state money transmitter licenses | FinCEN (the IRS examines); state regulators; OFAC | Money services businesses (31 CFR 1010.100(ff)): money transmitters, providers and sellers of prepaid access |
| Türkiye: AML in Türkiye | Law No. 5549; Measures Regulation art. 4(1)(e), which also binds their branches, agencies and agents; Law No. 6493 | MASAK (AML); TCMB (licenses) | Payment and electronic money institutions |
| UAE: AML in the UAE | CR 134 (Cabinet Resolution No. 134 of 2025, effective 14 December 2025) under Federal Decree by Law No. 10 of 2025; Retail Payment Services and Card Schemes Regulation (RPSCS, 2021); Stored Value Facilities Regulation (2020) | CBUAE; the UAE FIU | Payment service providers, payment aggregators, merchant acquirers, stored value facilities, exchange houses |
Every rulebook catches the firm that moves the money, and most reach its agents. The EU line moves on 10 July 2027, when the AMLR binds payment institutions and EMIs directly; a firm that only provides account information falls outside its definition of a financial institution. In the UK, the FCA supervises EMIs and payment institutions and HMRC supervises money service businesses; on 21 April 2026 HM Treasury answered its consultation on consolidating the PSR into the FCA. Türkiye splits the work: TCMB licenses under Law No. 6493, MASAK supervises AML under Law No. 5549.
Is a payment processor a money transmitter in the US?
Not if it only processes. 31 CFR 1010.100(ff)(5)(ii)(B) excludes a person that only "acts as a payment processor to facilitate the purchase of, or payment of a bill for, a good or service through a clearance and settlement system by agreement with the creditor or seller". Picture a processor (illustrative) that settles card payments for its merchants, then adds a wallet that sends funds between users. Facts and circumstances decide, and the wallet can make it a money services business.
It must then register with FinCEN. A new business has 180 days (31 CFR 1022.380(b)(3)), and state licenses are needed too: 31 states have enacted the Money Transmission Modernization Act in full or in part.
What are the AML requirements for payment service providers?
Nine rules carry most of the work, and each rulebook sets them in its own articles.
| Duty (in force, November 2026; the AMLR applies from 10 July 2027) | FATF | EU | UK | US (31 CFR unless named) | Türkiye | UAE |
|---|---|---|---|---|---|---|
| License and agents | R.14: providers licensed or registered; agents licensed, registered or listed by the provider, and inside its AML program | PSD2 art. 19(1)(b), (2), (4): agent's AML controls notified, agent registered before it acts, refused if the information cannot be confirmed; firm fully liable (art. 20(2)); AMLR arts. 12, 13: agents trained and assessed | PSRs reg. 34 and EMRs reg. 34: agent on the FCA register before it acts, with its AML controls and fit and proper evidence | 1022.380: register by day 180 for a new business, renew every two years; agent list revised each 1 January (380(d)) | TCMB Regulation of 1 December 2021 art. 18(1), (2): agent listed with the Association within 15 business days of the contract; firm stays liable (18(9)) | RPSCS art. 15: yearly report on each agent's AML controls and managers |
| Due diligence triggers | R.10: occasional above USD/EUR 15,000; wire transfers (R.16) | AMLR art. 19(1)(b): occasional from €10,000, single or linked, or a lower value AMLA sets; 19(2): occasional transfers of funds from €1,000; payment initiation: the merchant is the customer (19(6)(d)) | MLRs reg. 27(2): occasional £12,000 or more; 27(1)(b): transfers of funds above £800 | 1022.210(d)(1)(iv): ID for prepaid access; sellers verify buyers above $10,000 a day | Measures Regulation art. 5(1)(b), (c): 370,000 TL, single or linked; wires 30,000 TL (both from 7 October 2026) | CR 134 art. 7(2): occasional AED 55,000, single or linked; occasional wires AED 3,500 |
| Electronic money exemption | R.10: simplified measures only where risk is lower | Directive 2015/849 art. 12 as amended in 2018: up to €150 stored, not reloadable or a €150 monthly limit in one Member State, never for cash or remote payments above €50; AMLR art. 19(7): up to €150, not reloadable, four conditions in all | MLRs reg. 38: up to £150 stored, not reloadable or a £150 monthly limit usable only in the UK, goods and services only, no anonymous funding; never for cash or remote payments above £50; the issuer still monitors | Not a prepaid program: closed loop up to $2,000 a day, or up to $1,000 a day with no international transfers, no transfers between users and no non bank loads (1010.100(ff)(4)(iii)) | No electronic money exemption in the Measures Regulation; art. 26 lets the Ministry allow simplified measures | SVF Regulation art. 14: risk factors per product |
| Beneficial owner | R.10, R.24 | AMLR art. 52: 25% or more | MLRs reg. 5: more than 25%, or control by other means | 1010.230: 25% or more, for banks, brokers, futures commission merchants and mutual funds only (1010.605(e)(1)); MSBs risk based | Measures Regulation art. 17/A: more than 25%; else the person in control; else the top manager | CR 134 art. 10: 25% or more |
| Sanctions screening | R.6 | AMLR art. 20(1)(d), including entities controlled or more than 50% owned by a listed person; Regulation (EU) 2024/886 art. 5d: instant payment users checked daily and on each new or amended listing, with no second check of payer and payee during each transfer for EU targeted measures (5d(2)) | Sanctions regulations under SAMLA 2018, enforced by OFSI | OFAC; 31 CFR 501.603: blocked property reported within 10 business days | Law No. 6415; MASAK Communiqué 34 (23 September 2026) arts. 3, 5: obliged parties, agents included, report and defer at once any transaction a UN listed person seeks | RPSCS art. 12: systems to screen all parties to a transaction against the UN lists and CBUAE notices |
| Transfer data | R.16; INR.16: de minimis up to USD/EUR 1,000; card purchases carry the card number (para 16) | TFR arts. 4, 5, 7, 8 | Regulation (EU) 2015/847 as retained in UK law, arts. 4 to 8 | 1010.410(e), (f): $3,000 | Measures Regulation art. 24: verified payer data from 30,000 TL; names and accounts below it | CR 134 art. 28(1), (3), (4): originator data verified on international wires from AED 3,500, carried unverified below it unless there is a suspicion, and carried on domestic wires unless available by other means; art. 30: beneficiary firms identify wires missing data |
| Ongoing monitoring | R.10 | AMLR art. 26(2): customer data updated within 1 year for higher risk customers, within 5 years for all others | MLRs reg. 28(11) | 1022.210(d): risk based program with internal controls | Measures Regulation art. 19; enhanced measures art. 26/A | CR 134 art. 8; RPSCS art. 12: periodic risk profiling |
| Suspicious transaction report | R.20: promptly | AMLR art. 69(1): promptly, attempts included; FIU requests answered in 5 working days unless the FIU sets another deadline | POCA s. 330: as soon as practicable | 1022.320: $2,000 or more; 30 calendar days from initial detection | Measures Regulation arts. 27(2), 28(2): any amount; 10 business days from the suspicion | CR 134 art. 18(1): any value, immediately, through the FIU's system |
| Records | R.11: at least 5 years | AMLR art. 77(3): 5 years after the relationship ends or the occasional transaction is carried out | MLRs reg. 40(3): 5 years, counted the same way | 1010.430(d): 5 years | Law No. 5549 art. 8: 8 years | CR 134 art. 25(1): no less than 5 years after the transaction is completed or the relationship ends |
Three rows matter most for a payment firm. The agent row: every rulebook lets a firm use agents and none lets it hand over the liability. The due diligence row: under the AMLR, a payment initiation service treats the merchant, not the shopper, as its customer, so merchant files carry the weight. The transfer row: the travel rule sends payer and payee data with each transfer, and in the EU the payee's firm must detect transfers that arrive with data missing and decide what to do with them (TFR arts. 7, 8).
Which money lines apply to payment firms in 2026?
Picture an EU payment institution (illustrative) that sends €900 abroad for a walk in customer under the AMLR. The occasional transfer line is €1,000, so art. 19(2) does not yet call for due diligence. If a second €400 transfer that week is linked to the first, together they reach it; AMLA's standards are to set the linking criteria (art. 19(9)(d)). No AMLR exemption ever covers a suspicion (art. 19(1)(d)).
| Line (in force, November 2026) | Amount | Basis |
|---|---|---|
| EU occasional transaction | €10,000 | AMLR art. 19(1)(b), from 10 July 2027 |
| EU occasional transfer of funds | €1,000 | AMLR art. 19(2) |
| EU electronic money exemption | €150, not reloadable, four conditions | AMLR art. 19(7) |
| UK occasional transaction; transfer | £12,000; above £800 | MLRs reg. 27(2), 27(1)(b) |
| UK electronic money exemption | £150 | MLRs reg. 38(1) |
| US funds transfer records | $3,000 | 31 CFR 1010.410(e), (f) |
| US prepaid program exclusion | $1,000 a day; $2,000 closed loop | 31 CFR 1010.100(ff)(4)(iii) |
| US MSB suspicious activity report | $2,000 | 31 CFR 1022.320(a)(2) |
| Türkiye occasional; wire | 370,000 TL; 30,000 TL | Measures Regulation art. 5(1)(b), (c), from 7 October 2026 |
| UAE occasional; wire | AED 55,000; AED 3,500 | CR 134 art. 7(2)(a), (b) |
How many days does a payment firm have to file a suspicious transaction report?
The AMLR asks for reports "promptly"; answers to an FIU request are due within five working days, a deadline the FIU can cut or lengthen (art. 69(1)). The UK says as soon as practicable (POCA s. 330). A US money services business files within 30 calendar days of initial detection once $2,000 or more is involved. Türkiye allows 10 business days from the suspicion; the UAE wants a report immediately. Picture a suspicion formed on Monday 2 March 2026 (illustrative): the Turkish report is due by 16 March, the US one by 1 April. The case record should date the alert, the decision and the filing.
How should payment firms monitor merchants and agents?
Picture an acquirer (illustrative) that signs an online shop selling phone accessories with expected card volume of £40,000 a month. Six weeks later the shop processes £400,000, mostly at night, on cards from countries it does not ship to, with refunds to cards that never bought anything. The pattern fits transaction laundering: the shop's account is carrying payments for a business the acquirer never onboarded.
Two controls address it. At onboarding, the file needs more than company documents: the website, the expected card volume and the chargeback history, which a merchant onboarding form asks for. After go live, merchant monitoring compares each merchant's real traffic with what it declared and rescreens its owners when lists change. The CBUAE counts merchants in high risk activities, such as gaming, among the risk factors of a stored value product (SVF art. 14).
Alerts then need an owner and a deadline. New York's financial regulator found that Block's fast growth in 2019 and 2020 left a severe alert backlog, one of the findings behind its $40 million settlement.
Which red flags point to payment gateway laundering or fraud?
Some are product features the regulators rate as risk factors; others come from enforcement files.
| Red flag (in force, November 2026) | What it looks like | Source |
|---|---|---|
| Agents running the checks | The agent conducts due diligence on the customers it brings | UK NRA para 5.67 |
| Outsourced AML | A provider runs checks without knowing the product | UK NRA para 5.68 |
| Virtual IBANs | Flows the partner bank cannot see | UK NRA para 5.74 |
| Prepaid cash access | Cards loaded, carried abroad and withdrawn as cash | UK NRA para 5.73; SVF art. 14, 3.5 |
| Anonymous funding | Cash or unverified third parties load the account | SVF art. 14, 3.2 |
| Person to person transfers | Value moves between users with little trace | SVF art. 14, 3.4 |
| Many cards, one customer | Several accounts or cards per person, or several cards on one account | SVF art. 14, 3.6, 3.7 |
| High risk merchants | Gaming and similar activity | SVF art. 14, 3.8 |
| Volume beyond the declared profile | The transaction laundering pattern above | Merchant file |
| Sanctioned locations | Card redemptions from IP addresses in sanctioned regions | OFAC, daVinci, 6 November 2023 |
| Unregistered transmission | Bulk cash moved for an unlicensed foreign transmitter | FinCEN, Brink's, 31 January 2025 |
| Shops as transmitters | Grocery stores, gas stations or liquor stores that may be moving money without a license | US NMLRA 2024 |
Who answers for an agent's checks?
The firm does, in every rulebook here. The UK assessment notes that when an agent brings a customer, the agent often runs the checks, yet the firm "retains responsibility" for its AML compliance (para 5.67). PSD2 keeps a payment institution "fully liable" for its agents (art. 20(2)), and the RPSCS says the same in the UAE (art. 16). Türkiye's TCMB Regulation makes the agent responsible without lifting the firm's liability, and the firm cannot escape it by showing it chose the agent with care (art. 18(9)). A US money services business and its agent may agree who writes the policies, procedures and controls, but each stays solely responsible for carrying them out (31 CFR 1022.210(d)(1)(iii)).
How does APP fraud reimbursement change AML work for payment firms?
Since 7 October 2024, UK payment firms reimburse victims of authorized push payment (APP) fraud who are consumers, microenterprises or charities, on transfers over Faster Payments or CHAPS, up to £85,000 a claim.
Sender and receiver split the cost 50:50. The receiving half is the AML point: a firm that holds a fraudster's money mule account now pays for half the loss.
The PSR's dashboard shows 88 percent (£316 million) of APP losses reimbursed on about 438,300 claims from 7 October 2024 to 31 March 2026. Frontier Economics' review for the PSR (1 July 2026) estimates losses fell by £73 million a year.
Picture an EMI (illustrative) whose two week old account receives £6,000 from a scam victim and pays it out within an hour. The victim's bank reimburses and recovers £3,000 from the EMI. The useful steps are AML ones: onboarding checks on new accounts, monitoring for money that passes straight through, and a route from each APP claim into the mule review. Since 30 October 2024, a sending firm with reasonable grounds, found by the end of the next business day, to suspect fraud or dishonesty by someone other than the payer may also hold the payment to make enquiries, no longer than needed and at most until the end of the fourth business day (PSRs reg. 86(2A) to (2C)).
In the EU, euro area firms have offered payee verification since 9 October 2025 (Regulation (EU) 2024/886 art. 5c), and on 27 November 2025 the Council and Parliament reached a provisional agreement on a Payment Services Regulation.
Which payment firms were fined or lost their licenses since 2023?
| Date | Authority | Firm | Outcome | What went wrong |
|---|---|---|---|---|
| 6 November 2023 | OFAC | Swift Prepaid Solutions (daVinci Payments) | $206,213 settlement | 12,391 apparent violations: reward cards redeemed by users apparently in Crimea, Iran, Syria and Cuba, 2017 to 2022; no full geolocation controls |
| 31 January 2025 | FinCEN | Brink's Global Services USA | $37 million ($20 million credited for a DOJ payment) | Ran as an unregistered MSB with no AML program; no SARs on about $800 million of bulk currency |
| 10 April 2025 | NYDFS | Block, Inc. (Cash App) | $40 million settlement and an independent monitor | Weak customer due diligence and monitoring; alert backlog after 2019 and 2020 growth |
| 20 May to 23 December 2025 | CBUAE | Exchange houses | AED 200 million (20 May); AED 100 million (29 May); Omda Exchange license revoked and AED 10 million (23 December); three further releases | Release titles only |
| 2 March 2026 (published 13 July 2026) | DNB | CCV (payment institution) | €2.65 million; objection lodged 6 March 2026 | Transactions not continuously monitored; alerts closed without sufficient reasons (Wwft s. 3(2)) |
| 3 March 2026 | Bank of Lithuania | Paytend Europe UAB (EMI) | License revoked (announced 6 March) | Alerts not analyzed in time; no STRs despite indicators |
| 11 August 2026 | OFSI | Citibank, N.A., London Branch | £4,732,830.58 | Russia and anti corruption sanctions breaches across payment processing, correspondent banking and account restrictions; sanctions alerts reviewed late |
| 22 November 2023 to 10 October 2026 | TCMB (Resmî Gazete) | 23 payment and electronic money institutions, not named here | 24 license revocation decisions | Every decision read cites license grounds under Law No. 6493 art. 16(1) or 21(8), not an AML provision |
Unworked alerts run through the table. Block let a backlog build; in Lithuania, Paytend did not analyze alerts in time; in the Netherlands, CCV closed them without sufficient reasons; and OFSI found Citi's sanctions alerts reviewed late. Brink's shows the other failure: moving money without registering. The Turkish count is of license revocations, not AML fines.
Which payment rules changed in 2025 and 2026, and which dates come next?
- 9 January 2025. EU firms offering instant credit transfers start checking their users against EU targeted sanctions at least daily (Regulation (EU) 2024/886 art. 5d).
- 18 June 2025. The FATF revises R.16 on payment transparency.
- 9 October 2025. Euro area payee verification starts (art. 5c).
- 14 December 2025. The UAE's CR 134 takes effect.
- 30 June 2026. S.I. 2026/621 puts the MLRs' lines in sterling: £12,000 (was €15,000), £800 for transfers (was €1,000), £150 for electronic money.
- 23 September 2026. MASAK's Communiqué 34 tells obliged parties and their agents to report and defer at once any transaction a UN listed person seeks.
- 7 October 2026. Presidential Decision No. 11845 lifts Türkiye's customer identification line from 185,000 TL to 370,000 TL, and the wire line from 15,000 TL to 30,000 TL.
Next: the AMLR applies on 10 July 2027, AMLA directly supervises selected firms from 2028, and the FATF's R.16 changes come into effect by the end of 2030.
Which controls should a payments AML program show an examiner?
Thirteen lines, each with its source. The last column says where complead, formerly Sanction Scanner, covers the line; "outside the platform" marks policy and governance work that stays with the firm.
| Line (in force, November 2026) | Source | How complead covers it |
|---|---|---|
| Business risk assessment by product, channel, agent and merchant | AMLR art. 10; MLRs reg. 18 | Outside the platform; once it is done, rules can be limited to one product, segment or jurisdiction |
| Agent due diligence and register entry | PSD2 art. 19; PSRs reg. 34; TCMB Regulation art. 18; RPSCS art. 15; 31 CFR 1022.380(d) | The register stays with the firm; agents and their managers can be screened like any customer |
| Merchant KYB to the owners | AMLR arts. 20, 52 | KYB and UBO verification traces owners upward to the natural persons and marks any layer it cannot resolve as unresolved |
| Prepaid and electronic money limits mapped | AMLR art. 19(7); MLRs reg. 38 | Outside the platform |
| Due diligence lines per country | Money lines table | Thresholds set per jurisdiction, in rules written without code |
| Transfer data and missing data handling | TFR arts. 7, 8; 31 CFR 1010.410 | Payment screening screens sender and receiver over the API as the payment is processed |
| Sanctions screening of both parties; daily user screening for euro instant payments | Regulation (EU) 2024/886 art. 5d | 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes |
| Transaction and merchant monitoring with alert service levels | AMLR art. 26 | Transaction monitoring rules tested first on 30, 60 or 90 days of past data, with alert volume, clearance rate and true positives shown |
| Report clock per country | Obligations table | Reporting support within case management |
| APP claims routed to the mule review on the receiving side | PSR reimbursement rules | Outside the platform |
| Records 5 years, 8 in Türkiye | AMLR art. 77; MLRs reg. 40; 31 CFR 1010.430; Law No. 5549 art. 8 | Each screening search is kept with its searcher, query, time and outcome, even when nothing matched |
| Training for staff and agents | AMLR art. 12 | Outside the platform |
| AMLR gap analysis before 10 July 2027 | AMLR art. 90 | Each rule change carries a version, the who, when and why, and a one click rollback |
Where does complead fit in a payment firm's controls?
For payment providers, complead runs onboarding, screening, monitoring and investigation on one AI native engine (AML for payment providers), so each merchant or user carries a single risk score instead of one per tool.
Hepsiburada, one of Türkiye's leading ecommerce companies, picked complead Fusion to run its merchant compliance. Merchants are screened against sanctions and PEP lists at onboarding, rescreened daily after that and given a merchant risk rating, and each action is logged for internal audit.
In monitoring, agents take routine cases to a close and leave on each the evidence, a narrative and their work log. An alert shows which rule fired and on which signals. The MLRO takes every other call, filings included. The record names who decided. complead can run beside the screening tool a firm already uses, with sandbox keys at once and no integration fees.
Three tasks for this week, before the 10 July 2027 rebuild: list every merchant onboarded without owners traced to natural persons; list every agent with no dated review of its AML controls; and add each country's report clock to the case template.
What the 2026 PDF adds. Everything above stays readable here. The download beside it holds the working templates: an agent onboarding and annual review form, a merchant risk scoring sheet, a report clock card covering the six rulebooks, and a sheet that hands an APP claim to the mule review. Each article cited above was read on 4 November 2026 in its official text: the EU Official Journal, legislation.gov.uk, the Code of Federal Regulations, the Resmî Gazete and mevzuat.gov.tr, and the CBUAE Rulebook.
