AML on a stablecoin payout is not one check. It is three sets of checks running on three different clocks: identity and ownership checks that run once when you onboard, sanctions and wallet screening that run on every payment before funds move, and monitoring that runs continuously whether or not you are sending anything. Your provider runs all three. The obligation is theirs. The delay is yours.
Key takeaways
- Sanctions screening carries no minimum amount. OFAC liability is strict, which means a provider screens every payment regardless of size, including small test payments.
- Recordkeeping and travel rule data obligations begin at USD 3,000 in the United States under 31 CFR 1010.410(f), and at zero in the European Union.
- Beneficial ownership checks reach anyone holding 25 per cent or more of your company, plus whoever controls it, under the FinCEN customer due diligence rule.
- If your provider files a suspicious activity report, telling you is against the law. A payment held with no explanation can be exactly that.
- A FIRC is not an AML check. It is a certificate an authorised dealer bank issues after the money has landed.
What AML means on a stablecoin payout
Anti-money laundering is a program obligation, and it belongs to regulated institutions rather than to their customers. Under the FinCEN customer due diligence rule, a covered institution must identify and verify the identity of its customers, identify and verify the beneficial owners of companies opening accounts, understand the nature and purpose of customer relationships, and conduct ongoing monitoring to identify and report suspicious transactions.
Four requirements, all of them written about the institution. Nothing in that list is addressed to you. What reaches you is the output, because each requirement produces either a question you have to answer or a moment where your payment waits.
So the useful question is not what AML is. It is which of those moments to expect, and when. That timing is the part almost nobody publishes. Checks are normally listed as an inventory: due diligence, sanctions screening, transaction monitoring, suspicious activity reporting, recordkeeping. An inventory tells you what exists in a compliance program. It does not tell you what fires on a Tuesday afternoon when you press send.
AML checks run on three different clocks
Three groups, separated by when they run rather than by what they are called.
| Clock |
Checks on it |
Threshold |
Effect on your payment |
| Once, at onboarding |
Identity verification, beneficial ownership, control person, purpose of the relationship, risk classification |
None. It applies to the relationship, not the amount |
Nothing moves until it clears. Measured in days |
| Every payment, before funds move |
Sanctions screening, wallet analytics, beneficiary validation, travel rule data, recordkeeping |
Sanctions: none. Recordkeeping: USD 3,000 in the US, zero in the EU |
Seconds when clean. An open-ended hold when not |
| Continuously, in the background |
Daily and event-driven rescreening, transaction monitoring, suspicious activity reporting |
SAR filing at USD 2,000 or more for money services businesses |
Can stop a payment without an explanation you are permitted to hear |
Checks that run once, when you onboard
Business verification is the heaviest single step, and it happens before your first payout rather than during it. Your provider establishes who your company is, who owns it, and who controls it. Under the CDD rule, beneficial ownership means any individual who owns 25 per cent or more of a legal entity, and an individual who controls the legal entity. Both halves matter, because a company with no shareholder above 25 per cent still has a control person to identify.
This is the KYB process, covered in full in our explainer on what KYB is and how it differs from KYC. Two things about its timing are worth knowing. The cost is front-loaded, so a slow onboarding does not mean slow payments afterwards. And it re-runs on a trigger rather than on a schedule: a change of ownership, a new director, a step change in volume, or an adverse media hit against a name on your file.
Checks that run on every payment before funds move
Sanctions screening is the check with no exemption for size. There is no minimum amount, and there is no defence in not knowing. OFAC states that it "may impose civil penalties for sanctions violations based on strict liability, meaning that a person subject to U.S. jurisdiction may be held civilly liable even if such person did not have knowledge that it was engaging in a transaction that was prohibited under sanctions laws and regulations administered by OFAC" (OFAC FAQ 65). A provider carrying strict liability screens everything. That is why a USD 40 test payment gets the same treatment as a USD 400,000 invoice.
Next the wallet. Blockchain analytics scores the address on the receiving side, and the funding side too, for exposure to sanctioned entities, darknet markets, mixers and known fraud. A low score clears automatically, a medium score goes to a person, a high score stops.
Then beneficiary validation and travel rule data. Above USD 3,000 in the United States, under 31 CFR 1010.410(f), originator and beneficiary information has to accompany the transmittal. In the European Union, Regulation (EU) 2023/1113 sets no minimum at all. Which fields travel, and why a compliant payment still gets held at the other end, is the subject of our travel rule explainer.
Checks that run continuously in the background
Screening is not a single event. Sanctions lists change, so names on your file are rescreened daily and again whenever an event triggers it. Transaction monitoring works on patterns rather than individual payments: amounts sitting just below a reporting line, volume that does not fit your profile, funds arriving and leaving quickly, geography that does not match your stated business.
When monitoring reaches a conclusion, the output is a suspicious activity report. For a money services business the threshold is USD 2,000 or more, filed within 30 calendar days of initial detection. And here is the fact that explains more unexplained holds than anything else on this page. FinCEN's guidance for money services businesses states that "it is against the law to inform anyone other than an appropriate law enforcement or supervisory agency that a Suspicious Activity Report has been filed" (FinCEN, Reporting Suspicious Activity).
A provider that will not tell you why your payment stopped is not necessarily stonewalling. It may be complying.
AML, CFT, the travel rule and FIRC are four different things
These get used interchangeably, and they are not the same.
AML looks backwards. It asks where the money came from, and whether it is the proceeds of crime.
CFT looks forwards. Countering the financing of terrorism asks where the money is going. The distinction has a practical edge: funds of entirely clean origin can be stopped on a CFT basis because of the destination, which is why an audit trail proving your revenue is legitimate does not by itself clear a payment.
The travel rule is neither a screen nor an investigation. It is a data transmission requirement, FATF Recommendation 16, and it governs what information accompanies a payment rather than whether the payment is allowed.
A FIRC is not a check at all. A foreign inward remittance certificate is a document an authorised dealer bank issues to the beneficiary after funds have landed, as evidence that money came from abroad. It proves a payment happened. It does not screen one. Indian exporters need it for audit and benefit claims rather than for clearance, and we cover exactly when in our FIRC explainer.
Why a clean payment still gets held
Four causes, roughly in order of how often they occur.
Beneficiary data that does not match. A trading name where the receiving bank holds a registered name. The most common cause, and the cheapest to fix.
A wallet with upstream exposure. Your funds can be clean and still have arrived from an address a couple of hops from something flagged. Analytics scores the path, not only the counterparty.
A name collision on a sanctions list. Common names produce false positives. Strict liability means a provider resolves the match before releasing the payment, not after.
An open monitoring case. The one you will not be told about.
The asymmetry is worth naming plainly. For the first three, your provider can tell you what it needs and should. For the fourth, it legally cannot. Asking a prospective provider which category a hold falls into, and what it is able to disclose in each, is a reasonable question and a revealing one.
What the 2026 United States rules add
Three proposed rules moved this year, and all of them are aimed at stablecoin issuers rather than at businesses sending payouts.
FinCEN and OFAC issued a joint proposed rule on 10 April 2026 setting AML/CFT and sanctions compliance program requirements for permitted payment stablecoin issuers under the GENIUS Act, with comments closing 9 June 2026. It specifies six AML program elements, including a United States based AML/CFT officer and independent testing of the program, alongside five sanctions program elements. The FDIC followed on 5 June and the OCC on 24 June, the latter stating that each permitted payment stablecoin issuer "must comply with the Bank Secrecy Act, sections 4(a)(5) and 4(a)(6)(B) of the GENIUS Act, and applicable regulations at 31 CFR chapters V and X."
None of this places a new obligation on a business sending a payout. It matters because it standardises what the issuer of the stablecoin you are holding has to do, which moves one layer of counterparty risk from convention to rule.
What to give your provider before the first payout
Four things. Assembling them once removes most of the friction above.
- Entity documents matched to your registration, with every beneficial owner at 25 per cent and above identified, plus the person who controls the company.
- Beneficiary legal names exactly as the receiving bank holds them, with complete account details. This single field stops more payments than the rest combined.
- The source of your stablecoins and the wallets you will fund from, declared and verified once rather than per payment.
- A stated purpose and an expected volume. Monitoring compares what you do against what you said. A payment that fits your profile passes quietly. One that does not gets looked at.
Then ask two questions. Which checks run at onboarding and which run on every payment, and when a payment is held, what are you able to tell me.
How zPayments runs these checks
Screening, travel rule handling where in scope, and ongoing monitoring run on the platform rather than on the sender. Your own regulatory obligations remain your own, which is the reason the distinction in this article matters: no provider can absorb a duty that the law places on you.
Onboarding and beneficiary data are captured once and reused on every payment to the same counterparty rather than re-requested each time. No single individual controls onboarding, approval, execution and settlement, so every payout passes a second pair of hands before it reaches the rail. zPayments is registered as a Money Services Business with FINTRAC, which is a registration rather than a licence, and works with a network of licensed partners regulated in each corridor, with stablecoin payouts to 171 countries.
Settlement is instant across supported corridors, and next business day where the local rail clears on a cycle.
Start with zPayments.
Read next: Are stablecoin payment rails actually compliant
Last reviewed: 28 September 2026. This article describes regulatory frameworks in general terms and is not legal advice.
