Which rules reach your payments
Whether a business needs a license often depends on whether it holds or transmits money for others rather than simply paying its own bills. Businesses that do may be money services businesses under federal rules, which brings registration with FinCEN and an anti-money laundering program, and many states, including New York through its Department of Financial Services, separately require a money transmitter license. Sanctions compliance runs on its own track: OFAC rules apply to U.S. persons whether or not the business needs a money transmitter license, and civil liability can arise even without knowledge of the violation. Banks and payment partners impose their own KYC and screening requirements by contract, and those often reach further than the law strictly requires.
What changed in 2025 and 2026
Legislation and rulemaking in this area have moved quickly. Federal stablecoin legislation enacted in 2025 created a framework for payment stablecoin issuers, with implementing rules being written in stages. FinCEN narrowed beneficial ownership reporting so that it focuses on foreign companies registered to do business in the United States, and other FinCEN rules have been delayed or revisited. Sanctions programs change frequently, and screening lists and country risk assessments have to be refreshed accordingly. Because several of these changes are still being implemented or challenged, a cross-border payments compliance plan written in 2025 should be checked against current requirements in 2026 rather than assumed to be up to date.
Building or testing your program
In a first review we look at how funds actually flow through your product, who your customers and counterparties are, and which countries are involved. We compare that against the licenses you hold or rely on through partners, and against your onboarding, transaction monitoring, and sanctions screening. Gaps often appear at the edges, such as new corridors, new payout methods, or agents and resellers abroad. We also review the contracts with banks and processors, since a partner's decision to end the relationship can be as disruptive as an enforcement action. If a possible violation has already been found, the response includes preserving records, reporting where the rules require it, and deciding whether a voluntary disclosure makes sense.
