Cross-Border Payments Regulation: A Guide for Payment Companies

At first glance, cross-border payments can look like a straightforward extension of an existing service: add a currency, connect a payout partner and open a new payment route.

But expanding into cross-border payments also introduces regulatory requirements that vary depending on where your business operates, where payments are sent and received, and which firms are involved in processing them.

As a payment company, you’ll need to consider:

• Licensing and authorisation: Do you need regulatory approval or registration in the countries where you operate or facilitate payments?
• Third-party responsibilities: Which regulatory obligations apply to your business, and which apply to your banking, acquiring or payout partners?
• Operational compliance: How do local requirements affect customer due diligence, transaction monitoring, payment information, disclosures and consumer protections?

These questions become more complex as you scale, and add payment routes, legal entities and differing customer types. 

To help you understand what you need to do to remain compliant, this guide will look at key cross-border payments regulation in the UK, EU, US, and APAC, with practical steps for understanding different requirements and managing regulatory change.

Book a demo to see how Vixio helps payment teams research global requirements and manage regulatory change.

Why is cross-border payments compliance so challenging?

Cross-border payments compliance is challenging because different rules can apply across jurisdictions, depending on the type of payment and the role each business plays in processing it.

For example, a consumer remittance may be subject to different requirements than a business payout. Even within the same payment route, the companies involved may have different regulatory obligations.

Say your company is a UK fintech planning to offer consumer payments to Germany through a bank and local payout partner.

Your compliance team needs to work out:

• Authorisation: Does your existing UK authorisation cover the service, or could your activities require additional permissions in the EU? What permissions does your German payout partner need?
• Financial crime: Who's responsible for verifying customers, monitoring transactions and screening payments against sanctions lists: your business, the bank or the German payout partner?
• Payment information: What sender and recipient details must you pass to the bank and German payout partner to complete each transfer?
• Consumer protection: Who's responsible for disclosing transfer fees and exchange rates, and handling refunds or complaints if something goes wrong?

Working with regulated partners doesn't automatically cover your own obligations. You still need to understand which requirements apply to your business and where each partner's responsibilities begin and end.

These requirements can also change as regulations evolve, you enter new markets or switch payment partners. This means compliance teams must continually monitor developments across jurisdictions, assess which changes affect their business and update their processes to remain compliant.

Key cross-border payments regulations across the UK, EU, US, and APAC

UK: FCA authorisation and safeguarding

Key regulations in the UK include:

• Payment Services Regulations 2017: The FCA oversees authorisation and registration for regulated payment services. Firms must check whether their permissions cover the cross-border services they plan to offer.
• FCA safeguarding requirements: Relevant customer funds must be protected in line with the applicable rules. Updated requirements took effect in May 2026, including changes to reconciliations, third-party due diligence and reporting for firms in scope.

What you need to know

• UK authorisation no longer provides EU passporting rights. However, paying a recipient in the EU doesn’t automatically require a separate EU licence. What matters is where the regulated service is provided and which firm provides it.
• A new payment route may require changes to safeguarding controls if it affects how relevant customer funds are received or held.
• HM Treasury's July 2026 payments consultation and the Payment Systems Regulator's October 2026 system-access consultation concern possible future changes, not rules already in force.

EU: PSD2 and instant euro payment rules

Key regulations in the EU include:

• PSD2 (soon to be PSD3): The main framework for payment services. Appropriately authorised EU payment and e-money institutions can generally passport eligible services across member states.
• Instant Payments Regulation: Covered instant euro credit transfers are subject to verification-of-payee and specific sanctions-control requirements.
• Cross-border payment and currency-conversion rules: Qualifying cross-border euro payments are subject to rules on charges, while applicable currency-conversion services must meet disclosure requirements.

What you need to know

• Instant-payment deadlines vary by provider type and location. Most PSPs in the euro area faced the main receiving and sending deadlines in 2025; certain payment and e-money institutions and providers outside the euro area have later deadlines in 2027.
• PSD3 and the proposed Payment Services Regulation could change licensing and fraud-prevention obligations, but should be tracked separately from the PSD2 rules currently in force.

US: federal and state rules for money transmission

Key regulations in the US include:

• FinCEN and the Bank Secrecy Act: Payment firms may need federal money services business registration and must meet applicable anti-money laundering obligations.
• State money transmitter licensing: Separate state licences may be required depending on where and how the firm operates. NMLS supports licence applications; it is not a nationwide licence.
• CFPB Remittance Transfer Rule: Qualifying consumer remittances can trigger requirements for exchange-rate and fee disclosures, cancellations and error resolution.
• OFAC and the FTC Safeguards Rule: Firms must meet applicable sanctions restrictions and, where in scope, information-security and breach-notification requirements.

What you need to know

• Federal registration doesn’t replace state licences. Entering a new state can require another assessment even if the payment service itself stays the same.
• Consumer remittance rules do not necessarily apply to ordinary business payouts. Proposed cyber-incident reporting measures should also be distinguished from requirements already in force.

Singapore: MAS licensing and AML/CFT rules

Key regulations in Singapore include:

• Payment Services Act 2019: MAS regulates payment services, including cross-border money transfers. Depending on its activities and volumes, a firm may need a Standard Payment Institution (SPI) or Major Payment Institution (MPI) licence.
• MAS AML/CFT requirements: Rules including Notice PSN01 affect customer due diligence for payment service providers.

What you need to know

• For many covered services, SPI thresholds include S$3 million in monthly transactions for one service or S$6 million across multiple services, subject to other applicable limits. Exceeding a relevant threshold may require an MPI licence and additional safeguards.
• Licensing needs to be reviewed as volumes rise or services change. Firms must also address applicable local presence and director requirements.
• A UK or EU licence does not replace the permissions required to provide regulated payment services in Singapore.

Australia: AUSTRAC, ASIC and AML/CTF reforms

Key regulations in Australia include:

• AUSTRAC remittance registration: Remittance service providers generally need to register with AUSTRAC.
• ASIC financial services licensing: Certain additional payment products, such as some wallet arrangements, may require an Australian Financial Services licence.
• AML/CTF requirements and 2026 reforms: Where the travel rule applies, firms need to collect and pass on required payer and payee information. Customer due diligence obligations are also changing.

What you need to know

• New ongoing customer due diligence requirements took effect on 31 March 2026. Eligible existing reporting entities have transitional arrangements for initial CDD, and the move to international value transfer service (IVTS) reporting has been deferred.
• Broader payments licensing proposals are not yet current law. Digital asset reforms enacted in 2026 are due to apply from April 2027, where relevant to a firm's products.

How Vixio helps payment teams manage cross-border requirements

As you can tell, cross-border payments bring a long list of regulatory obligations: and getting them wrong can be expensive. 

In 2024, the FCA fined authorised e-money institution CB Payments Limited £3.5 million for repeatedly breaching restrictions on serving high-risk customers. 

And fines are only part of the cost of non-compliance. Firms can also face restrictions on their services, independent reviews, remediation costs, delayed expansion and damage to customer trust. And when you operate across several countries, missing a new requirement or deadline becomes easier.

This is where regulatory change management comes in. Rather than treating compliance as a one-off check before launch, it gives teams a repeatable process to identify the rules that apply, monitor new developments, assess their impact and track the work needed to respond.

Vixio's unified regulatory change management platform brings that research, monitoring and follow-through into one place. 

Here's how it helps payment teams manage cross-border requirements:

Get clear on the requirements before you launch

Before opening a new payment route, you need to know which permissions and obligations apply to your service and where a local banking or payout partner fits in. For instance, Singapore and Australia have different licensing and registration requirements, even for similar payment activities.

Vixio Jurisdiction Reports provide structured regulatory information across more than 200 jurisdictions. You can compare Singapore's MAS licensing requirements with AUSTRAC remittance registration, giving your team a clearer starting point for planning market entry.

For more specific questions, VIQ, Vixio's AI regulatory assistant, helps you search analyst-verified intelligence and check the supporting sources. That makes it easier to investigate a particular obligation or prepare focused questions for local counsel.

And because VIQ only collects information from inside the platform—and approved by expert human analysts—you can feel confident that you’re getting accurate, up-to-date regulatory data. 

Spot the regulatory updates that matter to your business

Requirements can change after a route goes live. A new safeguarding rule, revised AML guidance or an upcoming implementation deadline could mean changing your processes or systems. The challenge is spotting relevant developments early enough to act.

Horizon Scanning monitors developments from more than 1,400 authorities across 200+ jurisdictions. Watchlists and alerts help you follow the markets and topics relevant to your services, with analyst-backed context to make each update easier to assess.

Triage then helps you decide what needs action. You can dismiss updates that don't affect your business or assign relevant ones to the right person with a due date. This helps teams prioritise genuine obligations instead of treating every consultation or announcement as equally urgent.

Turn regulatory changes into actions you can track

Spotting a change is only the start. If a regulator introduces new sender-information requirements, your team needs to interpret the rule, check the current payment process for gaps, make any necessary changes and document when the work was completed.

Vixio supports that process:

• Requirements Extraction identifies relevant passages in regulatory texts and turns them into obligations your team can review against the original source.
• Regulatory Mapping and Gap Analysis connect obligations to the products, teams and controls they affect, helping identify where existing arrangements need to change.
• Task Management lets you assign owners and deadlines, track progress and record sign-off when the required changes are complete.

The result is a clearer record of what changed, how the firm assessed it and what action was taken. That makes it easier to demonstrate progress to internal stakeholders, auditors or regulators, rather than reconstructing decisions from scattered emails and spreadsheets.

Trusted by payment companies operating across borders

From international money transfers to global payment gateways, leading businesses trust Vixio to turn regulatory complexity into confident decisions.

Take Inpay, a cross-border payments provider operating in more than 45 countries. Vixio has become part of its daily compliance routine, helping the team stay informed and manage regulatory risk.

Or FinteqHub, which relies on Vixio's intelligence and expert support to navigate regulatory uncertainty and make better-informed decisions across international markets.

These partnerships demonstrate why payments businesses choose Vixio as a long-term regulatory intelligence partner, not just another compliance tool.

See why global payments companies trust Vixio:

Read Inpay's customer story | Read FinteqHub's customer story

Keeping cross-border compliance manageable as you grow

Obligations vary by country, payment route and business activity. Early research helps avoid delays and costly last-minute changes.

Vixio brings regulatory intelligence and compliance workflows together so teams can identify changes and manage their response.

Book a demo to see how Vixio can support your international payments strategy.

Cross-border payments regulation FAQs

Are cross-border payments regulated?

Yes. Cross-border payment services can trigger licensing or registration, anti-money laundering (AML), sanctions, payment-information and customer-protection requirements. Which rules apply depends on the service being provided, where it is legally provided, the customer type and each firm's role in handling the transfer.

Do payment companies need a licence for cross-border payments?

Often, but not always. A firm may need authorisation, registration or a locally available exemption, depending on its activities and jurisdiction. For example, US FinCEN registration is separate from state money transmitter licensing, while a UK payment institution licence does not give the firm EU passporting rights. Check the proposed service and each relevant entity before launch rather than assuming a partner's licence covers your business.

What should a PSP check before opening a new payment corridor?

Map the entities, countries, customers and payout partners involved. Confirm who is providing the regulated service, what permissions each firm needs, and who owns customer due diligence, sanctions screening, transfer data, fees, refunds and complaints. Then document required systems changes and assign owners before committing to a launch date.

How do FATF standards relate to national payment rules?

The Financial Action Task Force (FATF) sets international standards for tackling money laundering and terrorist financing. Countries implement these through their own laws and regulations, including requirements relating to customer due diligence and information accompanying transfers. FATF recommendations do not automatically create direct obligations for every payment firm; teams must apply the binding rules in each relevant jurisdiction.