Most finance teams price compliance as an onboarding cost, because onboarding is where the paperwork is. The bigger number arrives later, on payments that break no rule and get held anyway. Four things get checked: the business, both parties, the data travelling with the payment, and the pattern it fits. The expensive part is what a hold does to a counterparty who has only your word that the money left.
Four checks run on a cross-border business payment: verification of the sending business, sanctions and politically exposed person screening of both parties, Travel Rule information sharing where a virtual asset service provider is involved, and ongoing transaction monitoring. Above a threshold or on a higher-risk corridor, enhanced due diligence adds a documentary review before release. The checks are cheap and fast. Most of what they cost falls on the legitimate payments they stop.
Why does a payment get held for compliance?
Screening tests the sender, the beneficiary and the banks in the chain against sanctions and watch lists. The matching is deliberately loose, because one name can be transliterated four ways and anyone evading a listing will try a fifth.
Sweden's financial regulator has measured what that looseness costs. In a review published on 6 November 2024, FI supervision ran 5,000 names from the UN and EU sanctions lists through the systems used by 19 banks. Customer screening raised an average of 4 alerts for every hit on the list, and 7.1 once spellings were altered. It then ran 200 people and companies on no list at all. Systems still alerted on 4.9% of them in customer screening and 6% in transaction screening. Across 75 institutions in other countries running the same test, those figures were 6.8% and 9.3%.
So a hold usually means a machine found a resemblance and a person has to rule it out. Your payment sits in a queue with thousands of other clean payments, waiting on an analyst with no reason to suspect you and no way of knowing you are waiting.
|
|
|
| Check |
What it establishes |
What stops a payment |
| Business verification |
The entity is real, its owners identified |
Missing ownership evidence |
| Sanctions and PEP screening |
No party in the chain is listed |
A name resembling a listed one |
| Travel Rule |
Required data travels with the transfer |
Incomplete data, or a counterparty that cannot receive it |
| Monitoring and EDD |
The payment fits its onboarding profile |
Value, velocity or corridor off pattern |
Why won't anyone tell me why my payment is held?
Two different silences get confused here, and only one of them is required.
Where a provider has filed a suspicious transaction report, saying so is a criminal matter. FATF Recommendation 21 requires countries to prohibit institutions and their staff by law from disclosing that such a report is being filed with the financial intelligence unit. The agent answering your ticket may know exactly what happened and be barred from telling you.
Where a routine name match is being cleared, nothing stops anyone explaining. It still rarely happens. On Shopify's merchant community board, separate threads running from 2022 to 2025 describe one shape: funds held, no reason given, no documents requested, support staff who cannot see the case notes.
Then there's your beneficiary, who can be told less than you can. Wise sets out its position in its own help centre: it gives a recipient no details about the sender or the payment, and gives that information only to the sender. Your counterparty has your word that the money went, an empty account, and a provider that will not confirm your version. Every day that gap stays open costs something that appears on no invoice.
What should I ask a payout provider about compliance?
Every provider says yes to "are you compliant". These four produce different answers.
Which checks run, and where in the flow?
Business verification is one obligation per relationship when it's carried properly, and a repeated one when a separate provider handles each corridor. Screening a beneficiary when they are added moves any false positive to a point where no payment waits on it.
Who clears a hit, and how quickly?
Ask for the escalation path and the target time. An alert cleared in an hour and an alert cleared in three weeks come from the same rule.
Where is Travel Rule data captured?
FATF rewrote Recommendation 16 in June 2025, retitled it Payment transparency, kept the threshold at USD/EUR 1,000 and set the deadline for the new requirements at the end of 2030. A platform capturing originator and beneficiary data at onboarding satisfies it without you acting. One that doesn't will come back to you for it mid-payment.
What does the provider tell you, and what does it tell your beneficiary?
Nobody asks this in a first call. Everybody asks it in the third week.
Enhanced due diligence is where the honest answer is unattractive, including ours. A payment under EDD is not instant, and a provider promising otherwise is either not running the check or not mentioning it.
How zPayments runs these checks inside the payout
zPayments screens both parties at onboarding, again before every execution, then daily and on list events, because a party who is clean in March can be listed in May. A beneficiary is validated before any payout is released, and blockchain analytics score the funding wallet before the money moves. Approval is split: whoever prepares a payout never releases it, and no single employee holds onboarding, approval, execution and settlement at once. Originator and beneficiary data is collected and transmitted to the receiving institution where the law requires it. Every payout leaves one record carrying user, timestamp, previous value and new value. zPayments is operated by Zoth Payments Limited, registered with FINTRAC as a money services business.
See the checks that run before a payout leaves
