Multi-country payment compliance. 7 chapters and a final quiz.

Chapter 1. Business model classification before licensing.

An international expansion project does not start with a license application. It starts with a flow map showing where the money comes in, where it stops, who controls it, and when it moves on to its recipient. Draw that map country by country and service by service, because two neighboring markets sometimes classify the same product in opposite ways. Classification comes first. The choice of license follows from it, never the other way around.

The funds-holding test, applied flow by flow

• The collection account: whose name is it in, and who gives the debit instructions?
• How long the funds sit: under most regimes, a single night is enough to tip the classification
• The legal owner of the funds before payout: the end customer, the merchant, or the provider
• Discharge of the debt: at exactly what moment is the customer released from their debt to the merchant?
• What happens to the funds in bankruptcy: the answer has to hold up before a liquidator, not a sales director

The classification memo is the deliverable for this step: one page per country, dated, signed by the compliance officer, and binding within the group. It describes the service in the terms of the local law rather than in marketing language, cites the article that supports the classification, and names the entity that will bear the obligation. Finally, it lists the assumptions that would force a new analysis if they changed, such as a shorter payout period. The date ties the analysis to the assumptions that held when it was written.

Chapter 2. Passporting: what it carries and what it leaves behind.

The European passport carries a license, not compliance. A payment institution licensed in one member state can serve the others, either by establishing a presence there or under the freedom to provide services. That right exempts it from nothing else. The host country retains control over several areas, and those areas are what keep a compliance team busy day to day.

PSD2 clocks, as they actually run

• License: the authority informs the applicant within 3 months of receiving the application or, if the application was incomplete, all the required information (Directive (EU) 2015/2366, Article 12)
• Agent: the home authority says within 2 months whether the agent has been entered in the register (Article 19(2))
• Passport, transmission: the home authority forwards the file to the host country within one month; the host country assesses the information within the following month (Article 28(2))
• Passport, decision: the home authority communicates its decision within 3 months of receiving the information (Article 28(3))
• Proof of operation: an agent may operate only once it is entered in the register. The register entry is binding; the agency contract is not

The freedom to provide services is attractive because it looks light, and it has a blind spot that supervisors know well. As soon as an employee, an agent, or an office is located in the host country, the analysis shifts to establishment, with all the local obligations that come with it. Authorities look at the facts, not at the box ticked on the notification form. A billing address does not make a branch; a sales team on the ground often does. Document your actual presence in each country, and update that record every quarter.

Chapter 3. KYC, market by market.

Onboarding is not designed as one flow translated into several languages. It is designed market by market, and the reason is practical more than legal. Each country has built its own identity infrastructure, and none of it crosses borders: an Indian registry cannot verify a Nigerian customer. A flow designed for one market is rewritten for the next, from the first screen to the archived evidence.

Identity infrastructure: the flow’s non-exportable foundation

The Indian case deserves a closer look, because it affects system architecture, not just the content of a form. CKYCR is a central registry of KYC records: an institution uploads the records it creates and can download others with the customer’s consent. Two practical consequences follow. The flow must handle explicit, logged consent before any retrieval from the registry. And V-CIP video recordings stay on Indian soil, which rules out centralizing them in a European data center.

The deliverable: a matrix, not a manual

• Accepted documents: a closed list, by customer type, with the accepted validity period for each
• Remote verification: allowed, restricted, or prohibited, and in what technical form
• Beneficial owner: numerical threshold, definition of control, and how far up ownership chains you must trace
• Refresh: required frequency, trigger events, and what happens to customers whose records are not refreshed
• Retention: period, format, and permitted storage location; this column links to Chapter 5
• Evidence: what an examiner will ask to see, and exactly where it sits in the system

Chapter 4. Sanctions: list coverage, screening, and alerts.

Sanctions screening follows a different logic from AML, because there is no risk-based approach to the prohibition itself. A transaction with a designated person is prohibited, whatever the amount and however long the customer has been with you. The risk-based approach applies to the means of detection, never to the expected outcome. That distinction drives the entire design of the program.

Define your list coverage

• Territorial nexus: the lists of the country where the entity is established always apply, unconditionally
• Currency and infrastructure nexus: a flow that touches the US dollar or a US institution falls within OFAC’s reach
• Personal nexus: the nationality of a director or employee can bring a transaction under an additional regime
• United Nations lists, adopted by national regimes on implementation timelines that vary from country to country
• Contractually imposed lists: a correspondent bank or a card network often imposes its own list coverage, broader than the legal requirement

{
  "alert_id": "SCR-2026-004871",
  "generated_at": "2026-03-11T09:24:17Z",
  "screening_point": "payment_message",
  "matched_field": "beneficiary_name",
  "input_value": "<name as it appears in the message>",
  "list_entry": { "regime": "<list>", "uid": "<entry identifier>", "list_version": "2026-03-10" },
  "score": 0.88,
  "threshold_applied": 0.85,
  "discriminants_checked": ["date_of_birth", "country", "national_id"],
  "ownership_review": { "performed": true, "aggregate_blocked_stake": 0.5 },
  "decision": "block",
  "decided_by": "L2-analyst-114",
  "decided_at": "2026-03-11T11:02:40Z",
  "report_filed": { "authority": "<authority>", "reference": "<report reference>" }
}

A screening engine is tuned, not just installed. The team faces two mirror-image errors: a threshold that is too strict lets transliterations and reversed names slip through, and one that is too loose buries analysts in meaningless alerts until processing capacity collapses. Tuning is measured against a hand-built test set. You load it with known designations written ten different ways, then count what the engine finds. The test set is kept and rerun. The Wolfsberg Group describes this approach in its Guidance on Sanctions Screening of January 2019, which treats screening of reference data separately from screening of messages.

Chapter 5. Data localization and transfers.

Data localization is not a contract clause; it is an architecture constraint. An encryption commitment does not satisfy any in-country storage obligation, and neither does an audit clause. An examiner checks the physical location of servers and backups, and backups are exactly what projects forget.

The data flow register: five columns at a minimum

• Collection: where the data is captured, and through which channel
• Processing: where the engines run, including fraud and scoring models
• Primary storage: the country of the system of record
• Backup and replication: the country of the copies, often different and almost always undocumented
• Access: which countries people view the data from; under several regimes, remote access counts as a transfer

In the EU, a transfer to a third country must rest on a specific mechanism, chosen and documented: an adequacy decision, standard contractual clauses, or binding corporate rules. The mechanism is never presumed. The Commission adopted a new set of standard clauses in Implementing Decision (EU) 2021/914, then recognized the adequacy of the EU-US Data Privacy Framework on July 10, 2023. A US provider that is not certified under the framework therefore falls under the standard clauses, along with their supporting assessment.

Chapter 6. Platform and seller reporting.

A marketplace reports not only its own income but also its sellers’. The obligation comes from the OECD Model Rules for digital platforms, since adopted by several jurisdictions. The real work happens at seller registration, where the platform collects the data the annual report will use.

Collect at registration, not in January

• The tax identification number is requested when the seller account is opened, along with the jurisdiction that issued it
• The primary address and country of residence determine the reporting jurisdiction: they are required fields, not optional ones
• The identifier of the financial account used for payouts is part of the required data
• Business sellers must provide a registration number and, where applicable, a VAT number
• Corrections remain possible: build in automatic reminders and a payout hold when data is missing

Under DAC7, a platform may file a single report in one member state. That choice must be documented and notified, and it does not exempt the platform from due diligence on sellers resident in other member states. Tax authorities then share the information through automatic exchange. The UK regime follows the same pattern, because both implement the same OECD Model Rules, so a platform serving both markets builds one data set with two schedules. One model, two filings.

Chapter 7. Timeline: licensing and regulatory deadlines.

A licensing timeline cannot be planned sequentially, because four workstreams move in parallel and the slowest one sets the launch date. That is almost never the regulatory file. The safeguarding account, local governance, and the technical connection often come later, so a backward plan that runs them one after another doubles the length of the project.

The four workstreams and where each one gets stuck

• Regulatory: drafting, then review. The legal clock starts only once the authority considers the application complete
• Banking: opening the safeguarding account requires due diligence by the partner bank, which takes about as long as the regulatory review. Open both files on the same day
• Governance: managers to appoint and qualify, sometimes required to live locally. A fit-and-proper assessment takes weeks and starts over with every change
• Technical: connecting to the national payment rail comes with its own certifications and go-live windows, independent of the license