Cross-Border Payment Compliance Review

Cross-Border Payment Compliance Review

Cross-border payments are subject to overlapping and sometimes conflicting regulatory frameworks — domestic licensing, sanctions, AML/CFT obligations, FX controls, and prudential requirements — all of which must be navigated simultaneously. A compliance review produces a structured analysis of what the company must have in place in each jurisdiction it touches.

When to use this

• A FinTech or payments company is launching a cross-border payment product and needs to map its regulatory obligations.
• An existing payments business is expanding into new MENA jurisdictions and needs to understand new licensing and compliance obligations.
• A correspondent banking relationship has been terminated ("de-risking") and the company needs to understand the compliance gaps that triggered it.
• A regulatory examination or AML audit is imminent and the company needs a gap analysis.
• A company is acquiring a payments business and conducting regulatory due diligence.
• An investor is conducting due diligence on a FinTech payments company and needs a compliance risk assessment.

Required inputs

Optional inputs

• SWIFT BIC and correspondent banking relationships.
• Whether the company processes payments for high-risk sectors (gambling, crypto, high-value goods).
• Whether the company offers crypto-linked or virtual asset payment services.
• Existing AML/CFT program documentation.
• Whether the company is seeking to list or has institutional investors with compliance requirements.

Compliance review framework

1. Licensing analysis

For each jurisdiction of operation, assess:

Key licensing trap: Operating cross-border payment services without a license in the destination jurisdiction — even if licensed in the origin jurisdiction — is a common violation. MENA regulators are increasingly assertive on unlicensed activity by foreign FinTechs.

2. AML/CFT compliance

FATF framework: All MENA GCC countries are FATF members or MENAFATF members. The FATF 40 Recommendations apply; the risk-based approach is mandatory.

Core AML obligations for payment companies:

• Customer Due Diligence (CDD): collect and verify identity for all customers above the relevant threshold; Enhanced Due Diligence (EDD) for high-risk customers.
• Beneficial ownership identification for corporate customers.
• Ongoing transaction monitoring: automated systems to detect unusual patterns.
• Suspicious Transaction Reports (STRs): file with the relevant Financial Intelligence Unit (FIU) — UAE Financial Intelligence Unit (UAEFIU), SAMA AML Center in KSA, Special Investigation Commission (SIC) in Lebanon.
• Cash transaction reporting: report cash transactions above specified thresholds.
• Record-keeping: minimum 5 years for transaction records and CDD documents.

MENA-specific AML requirements:

3. Sanctions screening

US OFAC: Any payment that touches the US financial system (USD correspondent bank, US-incorporated entity in the payment chain) is subject to OFAC sanctions. OFAC SDN list screening is mandatory. Penalties for violations are severe — up to USD 1 million per violation for civil violations, criminal penalties for intentional violations. OFAC's reach is extraterritorial: any payment denominated in USD that clears through a US correspondent bank is within OFAC jurisdiction.

EU sanctions: Apply to EU entities and transactions in EUR.

UN sanctions: Implemented by all UN member states.

UAE/KSA sanctions: Both maintain national sanctions lists in addition to UN implementation. UAE: CBUAE maintains an NST (National Sanctions Table). KSA: Saudi Targeted Financial Sanctions list.

Screening obligations:

• Screen all parties (sender, beneficiary, intermediaries, beneficial owners) against applicable sanctions lists before processing each transaction.
• Use automated screening software with up-to-date list feeds.
• Implement a "block and freeze" process for hits.
• Maintain screening records for the regulatory retention period.

Lebanon warning: Lebanon is subject to enhanced scrutiny. Any payments involving Lebanese entities should be subject to enhanced sanctions screening and AML checks; correspondent banks routinely apply heightened scrutiny.

4. FX regulations

Lebanon FX risk: The Lebanese pound has lost over 90% of its value since 2019. BdL has issued multiple conflicting circulars on USD transfers, Lollar accounts (Lebanese USD), and the Sayrafa exchange platform. Any payment operation involving Lebanese entities requires up-to-date local counsel advice.

5. Correspondent banking

Correspondent banking relationships are critical for cross-border USD, EUR, and GBP payments. De-risking (termination of correspondent relationships) is a significant risk for MENA payment companies, particularly those operating in jurisdictions with high-risk AML profiles.

Key obligations to maintain correspondent relationships:

• Clear ownership and control structure; no opaque UBO structures.
• Robust AML program with documented policies and procedures.
• Adequate technology for transaction screening and monitoring.
• Prompt STR filing history and cooperation with regulatory inquiries.
• Compliance with SWIFT's Know Your Customer Registry (KYC Registry) requirements.

Wolfsberg Principles: The Wolfsberg Group principles for correspondent banking and payment transparency (including SWIFT gpi requirements) are the industry standard. Payment companies should be familiar with the Payment Transparency Standards and the Wolfsberg AML Questionnaire.

6. Regulatory reporting

Output format

Deliver a compliance review report structured as:

1. Executive summary: Key findings, compliance gaps, and priority remediation steps.
2. Licensing gap analysis: For each jurisdiction, what is required vs. what is in place.
3. AML/CFT gap analysis: Comparison of current program against regulatory requirements.
4. Sanctions screening assessment: Systems, coverage, and gaps.
5. FX regulatory assessment: For each relevant jurisdiction.
6. Correspondent banking assessment: Current relationships, de-risking risk, and mitigation.
7. Action plan: Prioritised list of remediation steps with responsible owner and deadline.

Common mistakes

• Operating in a new country without checking whether a separate license is required (assuming home-country license suffices).
• USD payment processing without robust OFAC screening — the CBUAE and US Treasury have both taken enforcement action.
• Ignoring the Lebanon FX situation and processing payments at official rates when the actual rate is materially different — this creates undisclosed losses and potential regulatory exposure.
• Inadequate correspondent banking maintenance — de-risking destroys operational capability; preventive compliance investment is much cheaper than relationship rebuilding.

Related skills

• [[prompt-pack-cryptocurrency-exchange-terms]]
• [[prompt-pack-digital-wallet-terms]]
• [[prompt-pack-data-processing-agreement]]
• [[prompt-pack-aml-compliance-program]]
• [[prompt-pack-client-intake-form]]