Introduction
Payment processors occupy a uniquely vulnerable position in the global financial system. Unlike traditional banks, which spend decades building compliance infrastructure, many third-party payment processors (TPPPs) approve merchants in minutes and process billions in transactions for clients they may barely know.
That speed creates real efficiency for commerce. It also makes processors a prime target for money launderers, fraudsters, and other bad actors seeking to move illicit funds through legitimate payment channels.
A payment processor is an intermediary that facilitates electronic fund transfers between buyers, merchants, and financial institutions. The processor sits between the merchant and the acquiring bank, handling the technical and operational aspects of payment acceptance. Because the bank does not have a direct relationship with each merchant, it relies heavily on the processor's due diligence — which is where the compliance risk becomes acute.
This guide covers what AML requirements apply to payment processors, how the regulatory landscape differs across the US, EU, and Canada, and how fintech compliance teams can build programs that hold up under scrutiny — from the five foundational pillars to red flags, transaction monitoring, and SAR filing.
TLDR
- US law doesn't universally require AML programs for payment processors, but the gap is closing — and banking partners already expect equivalent controls.
- The Five Pillars of AML compliance (compliance officer, written policies, training, audit, and risk assessment) form the baseline every payment processor should build from.
- Effective programs combine KYC merchant onboarding, sanctions and PEP screening, transaction monitoring, and timely SAR filing.
- Technology alone isn't enough — experienced BSA/AML professionals remain the most defensible investment a processor can make.
Why AML Compliance is Non-Negotiable for Payment Processors
Payment processors face a structural vulnerability that most traditional banks do not: speed without visibility. While banks typically conduct extensive due diligence before opening accounts, many payment processors onboard merchants in minutes, relying on automated verification and limited manual review. This model enables rapid growth but creates a compliance blind spot.
The FFIEC BSA/AML Examination Manual explicitly warns that "payment processors pose greater money laundering and fraud risk if they do not have an effective means of verifying their merchant clients' identities and business practices." The practical risk is straightforward: a payment processor can unknowingly become a conduit for transaction laundering, fraud, or sanctions violations because it lacks direct visibility into the ultimate source or destination of funds.
This risk takes several distinct forms:
- Transaction laundering: A merchant approved as an e-commerce clothing retailer secretly processes payments for online gambling — activity never disclosed during onboarding
- Structuring: Large transactions are broken into smaller amounts specifically to avoid reporting thresholds
- Unauthorized debits: Unusually high ACH return rates often signal that merchants are pulling funds without customer authorization
The scale of exposure is significant. According to the UNODC, money laundered globally each year equals roughly 2–5% of global GDP — approximately $800 billion to $2 trillion.
Beyond regulatory risk, weak AML controls carry direct business consequences. Banking partners conduct periodic compliance reviews of the processors they sponsor, and inadequate programs can result in terminated relationships — an outcome that is often existential for a payment processor. Chargebacks, merchant fraud, and reputational damage compound the problem by eroding margins and client trust.
Enforcement penalties add another layer of exposure. FinCEN assessed a $184 million penalty against Western Union in 2017 for willful AML program failures — a case that set the benchmark for what regulators consider acceptable due diligence from money services businesses.
Payment processors that can demonstrate strong, documented AML controls gain a tangible advantage: better banking partnerships, lower fraud losses, and the ability to attract merchants that more permissive platforms turn away.
Global AML Regulatory Requirements for Payment Processors
AML obligations for payment processors vary significantly by jurisdiction, but the direction is consistent: regulators are tightening requirements across the board. Even where formal AML mandates don't yet exist, banking partners increasingly expect equivalent controls. For fintechs operating cross-border or serving international merchants, knowing where you stand in each market is a compliance prerequisite.
US Requirements (BSA and FFIEC Guidance)
Under the Bank Secrecy Act (BSA), payment processors are generally not subject to direct AML program requirements. The FFIEC BSA/AML Manual explicitly states that "processors generally are not subject to BSA/AML regulatory requirements." However, the regulatory gap is narrower than it appears.
The FFIEC classifies third-party payment processors as high-risk bank customers. Banks that service processors scrutinize their AML controls closely — and can terminate the relationship if controls are inadequate. Under FFIEC guidance, those banks are expected to:
- Conduct background checks on processors and their merchant clients
- Monitor for high return rates on ACH debits
- Review processor promotional materials
- Investigate suspicious activity
- File Suspicious Activity Reports (SARs), noting "payment processor" in the narrative
Legislative efforts to formally extend AML obligations to payment processors are ongoing. The ENABLERS Act, which would bring certain gatekeepers (including payment processors) within the scope of AML regulations, was included in the House's FY2023 NDAA package but did not become law. As of 2025, no federal AML mandate specifically targets payment processors, but the regulatory direction is clear.
EU Requirements (AMLD and PSD2)
The EU takes a more direct approach. Payment institutions authorized under PSD2 are explicitly classified as obliged entities under AMLD4, subject to customer due diligence (CDD), transaction monitoring, and suspicious transaction reporting requirements.
The European Banking Authority (EBA) has raised concerns about ML/TF risks in the payments sector. A 2023 EBA report found that "AML/CFT supervisors across Europe consider that payment institutions, as a sector, represent high inherent ML/TF risks," and that "ML/TF risks in the payment institutions sector may not be assessed and managed effectively." The report highlighted weaknesses in transaction monitoring, STR reporting, governance, and supervisory gaps involving agents and passporting.
The EU's 6th Anti-Money Laundering Directive (6AMLD) introduced stricter rules, including tighter controls on anonymous prepaid cards.
The new EU AML Authority (AMLA), seated in Frankfurt, will directly supervise selected high-risk cross-border financial institutions and coordinate national supervisors — a structural shift that began in 2025.
Canada Requirements (FINTRAC)
Canada closed a significant regulatory gap in 2022. Previously, many payment processors were exempt from AML requirements. On April 27, 2022, amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations brought merchant servicing and payment processing providers into scope as money services businesses (MSBs) or foreign money services businesses.
Payment processors in Canada are now subject to FINTRAC obligations including registration, compliance program development, electronic fund transfer (EFT) reporting, KYC/CDD, and record keeping. FINTRAC emphasizes that "understanding who you are doing business with" is now a legal requirement for payment processors — a direct mandate that mirrors the expectations long placed on traditional financial institutions.
The Core AML Compliance Pillars for Payment Processors
Regulators and banking partners look for five foundational elements in every effective AML program. These are known as the Five Pillars of AML compliance:
- Designated Compliance Officer
- Written Policies and Procedures
- Employee Training
- Independent Testing and Auditing
- Risk Assessment
The fifth pillar — risk assessment — was formally added in 2018 through FinCEN's Customer Due Diligence (CDD) Final Rule, reflecting the evolving threat landscape. Payment processors should understand each pillar not as a compliance formality but as an operational requirement.
Designated Compliance Officer
This is not a title to assign casually. Regulators and banking partners expect a qualified BSA/AML professional with real authority, accountability, and seniority.
The compliance officer owns the AML program end-to-end and serves as the primary contact for regulators, auditors, and banking partners. For early-stage fintechs, this often means hiring someone with direct experience in payment processing compliance, not just general bank compliance.
KYC and Merchant Verification
Payment processors must verify both end customers and the merchants they onboard. Verification covers:
- Identity checks and government-issued ID validation
- Business registration and licensing documentation
- Ownership structure, including Ultimate Beneficial Owners (UBOs)
- Business practices and stated merchant category
This process is not static. Risk profiles change, so ongoing monitoring — periodic re-verification, merchant site reviews, and transaction pattern analysis — is required to catch shifts in business models that may introduce compliance risk.
Sanctions and PEP Screening
Real-time screening against OFAC sanctions lists, global watchlists, and Politically Exposed Persons (PEP) databases is mandatory under federal law. Sanctions lists update constantly, so batch or periodic screening creates unacceptable gaps. Individual transaction screening must check both the payer and the payee in real time, before each payment clears.
Transaction Monitoring and SAR Filing
Payment processors must monitor transaction patterns and flag anomalies before they become enforcement problems. Common red flags include:
- Unusual transaction volumes or sudden spikes in activity
- Structuring patterns designed to stay below reporting thresholds
- High ACH return rates signaling potential fraud or chargebacks
- Geographic anomalies inconsistent with the merchant's stated business
Accurate record-keeping underpins all of this. Currency Transaction Reports (CTRs) are required for cash transactions above $10,000. Suspicious Activity Reports (SARs) must be submitted to FinCEN when activity warrants, documenting both the nature of the suspicion and the parties involved.
AML Red Flags and High-Risk Transaction Patterns
Payment processors must train their teams to recognize five major red flags:
Unusual transaction volumes or structuring — Breaking up transactions to avoid reporting thresholds is a classic money laundering tactic. Watch for merchants whose transaction patterns change abruptly without corresponding business growth.
High rates of chargebacks or ACH returns — Return rates exceeding NACHA's thresholds (0.5% for unauthorized returns, 3% for administrative returns, 15% overall) signal fraud or unauthorized debits.
High-risk industries without enhanced due diligence — Merchants operating in online gambling, cryptocurrency, telemarketing, or other high-risk categories require enhanced scrutiny. Approving these merchants without deeper verification creates compliance exposure.
Payments routed through multiple intermediaries — Payments passing through multiple processors, jurisdictions, or entities without clear business purpose introduce layering risk, a defining characteristic of money laundering.
Reluctance to provide identity or ownership information — Legitimate merchants have no reason to withhold business documentation or beneficial ownership details. Resistance is a red flag.
Riskiest Payment Types
Three payment types carry elevated AML risk for high-risk merchants:
- Remotely created checks (RCCs) — The FFIEC warns that RCC use increases fraud and money laundering risk, especially when return levels are high.
- ACH debits — High return rates signal potential unauthorized debits or coordinated fraud schemes.
- Recurring payment arrangements — Predictable charge cycles can mask ongoing laundering activity beneath normal-looking volume.
In each case, the processor's bank has no direct relationship with the merchant, so fraudulent or laundered payments can flow through before anyone detects the scheme.
Third-Party Payment Risks
The same layering risk applies when the payer is a different entity than the account holder. This structure obscures the true origin of funds and makes tracing beneficial ownership significantly harder — which is precisely why regulators treat third-party payment arrangements as a heightened concern.
Building an Effective AML Program: Best Practices for Fintech Payment Processors
Merchant Onboarding Process
A rigorous, multi-step onboarding process is the foundation of AML compliance. Best practice includes:
- Prescreening and initial risk assessment
- Identity and business verification
- Merchant history check (prior processing relationships, chargeback history)
- Business model analysis (revenue sources, customer base, transaction patterns)
- Web content analysis (verifying the merchant's actual business activity)
- Information security compliance review
- Credit risk underwriting
Risk-tiered due diligence ensures higher-risk merchants receive enhanced scrutiny, including additional documentation, site visits, and more frequent transaction monitoring.
Automated, Scalable AML Workflows
Manual compliance processes break down as transaction volumes and merchant counts scale. Automated KYC checks, real-time sanctions screening, and AI-assisted transaction monitoring allow payment processors to maintain compliance quality without proportionally scaling headcount.
For early-stage fintechs with fast growth trajectories, investing in automation early prevents the compliance bottlenecks that slow growth or draw regulatory attention.
Independent Testing and Audit
Independent testing is where many AML programs fall short — and where regulators look first. Periodic internal or third-party audits of the AML program are required under FFIEC guidance. A thorough audit covers:
- Merchant client list review
- Due diligence obligation testing
- Transaction monitoring effectiveness
- SAR filing accuracy and timeliness
Testing frequency should be risk-based. Most programs are audited every 12–18 months, with higher-risk programs reviewed more frequently.
Hiring the Right AML Talent
Technology handles volume. People handle judgment. Experienced AML professionals are still essential to design, interpret, and oversee compliance programs — no automation replaces a qualified BSA/AML officer who understands payment sector risk.
For fintechs scaling quickly, that hire is often harder to make than it looks. The candidate pool for payment-experienced compliance officers is shallow, and competition is high. Specialized recruiters with deep financial crime networks — like Wayoh, which has placed 500+ compliance and financial crime professionals across fintech and payments over the past decade — can shorten that search considerably.
Frequently Asked Questions
What are the requirements for payment processors in AML?
Payment processors aren't universally required to follow AML rules under the US Bank Secrecy Act, but the EU and Canada impose formal requirements — and US banking partners effectively enforce equivalent standards as a condition of access. In practice, the Five Pillars framework (compliance officer, written policies, training, auditing, and risk assessment) is the baseline regulators and banking partners expect to see in place.
What is payment screening in AML KYC?
Payment screening is the real-time process of checking individual transactions and the parties involved against sanctions lists, PEP databases, and OFAC watchlists before processing. It is distinct from customer-level KYC screening, which happens at onboarding.
What are the risks of accepting payment from a third party?
Third-party payments introduce layering risk — the payer's identity differs from the account holder's, obscuring the origin of funds and making it harder to trace beneficial ownership. This structure can facilitate money laundering if not flagged and investigated promptly.
What are the five red flags in AML?
Key red flags include unusual transaction structuring, high chargeback or return rates, high-risk merchant categories without enhanced due diligence, payments through multiple opaque intermediaries, and reluctance by customers or merchants to provide identity information.
What is the riskiest type of payment to receive money laundering?
Remotely created checks (RCCs) and ACH debits processed on behalf of high-risk merchants are among the riskiest. Without a direct bank-merchant relationship, fraudulent or laundered funds can move through the system before detection, especially when return rates are elevated.
What is the $3,000 rule in banking?
The $3,000 rule requires financial institutions to collect and retain records on purchasers of monetary instruments — money orders and cashier's checks — paid with cash between $3,000 and $10,000. This recordkeeping requirement creates a paper trail that investigators can use to identify structuring and money laundering patterns.
