Why did my cross-border payout get an RFI? What compliance asks, and how to answer fast

A cross-border payout gets an RFI when compliance needs more information before it can approve a customer or release a transaction. A request for information (RFI) is a structured list of questions and document uploads. Answer it completely and fast: a customer RFI auto-rejects after 27 days, and a held transaction should be answered within 24 hours.

RFIs are part of why cross-border payments carry compliance cost at all. In the stablecoin sandwich, the on-chain leg is cheap, but the on-ramp and off-ramp still run full KYC, KYB, and monitoring. RFIs are where that work reaches your team.

Key takeaways

• There are three kinds of RFI: about a customer, about a held transaction, and about your own company. Each has its own deadline.
• A customer in compliance_request can't transact. A customer in approved_rfi keeps working while you answer.
• BlindPay emails your team, not your customer. Collecting the answer is your job.
• Submissions are single-shot. Read every section first and match the exact document type requested.
• The fastest RFI is the one you prevent: complete, consistent onboarding data up front.

What are the three kinds of RFI?

They differ by subject, by deadline, and by what they block.

Sources: BlindPay's information requests, on-hold transactions, and instance requests guides.

SWIFT document reviews look similar but aren't RFIs. Every SWIFT payout starts on_hold, and third-party SWIFT payouts wait for a document such as an invoice or contract. How to send a SWIFT payout from USDC covers that flow.

Why do compliance teams send RFIs at all?

Because the rules require them to understand who they serve and why money moves. FinCEN's customer due diligence rule asks covered institutions to "understand the nature and purpose of customer relationships" and, on a risk basis, to "maintain and update customer information." An RFI is how a payment provider closes a gap in that file without rejecting the customer.

Cross-border payments also carry more data than domestic ones. FATF adopted a revised Recommendation 16 on payment transparency in June 2025, with implementation expected by the end of 2030, so expect data requests on cross-border flows to grow, not shrink.

The traditional system duplicates this work. The Federal Reserve's March 30, 2026 FEDS Note notes that compliance checks can run "at multiple points in the chain" of correspondent banks. A stablecoin payout shortens the chain, but the checks at each end stay.

What does a customer RFI usually ask for?

The gaps that block a clean KYC or KYB decision. BlindPay's docs list these common triggers:

• A business description that doesn't match the company's website or industry
• A proof of address that doesn't match the registered address
• An identity document that's expired, blurry, or partially visible
• An ownership structure that needs an updated share register or UBO documentation
• Source of funds or source of wealth that needs evidence

Each RFI arrives as sections. Every section has a title, a description of what compliance needs, and one or more fields: text, a file upload, or a dropdown. One RFI can mix a document upload with a written explanation.

Source of funds is the trigger teams find hardest to answer. Why off-ramps ask for source of funds lists the documents that work and the ones that fail.

What does a transaction hold RFI ask for?

The story behind one payment. When monitoring flags a payin or payout and compliance can't clear it internally, BlindPay sends the transaction details and asks for:

1. The relationship between the sender and the customer
2. The purpose of the transaction
3. The expected outcome of the transaction
4. Anything else that helps explain it

The clock here is short. If the RFI isn't answered within 24 hours, the transaction may be refunded to the sender. Holds in general can last up to 30 days, and a hold that times out without a decision fails the transaction (cut-off times and compliance holds).

Write the answer the way you'd explain it to a new finance hire. "Monthly invoice 2026-091 from our design contractor in Curitiba, per the attached contract" beats "business payment." How to reduce false positives in transaction monitoring explains why vague answers lead to second rounds.

How do you answer an RFI the first time?

Five habits cut most second rounds:

1. Start on day 0. BlindPay sends an Action Required email on day 0, a reminder on day 7, a final notice on day 17, and the rejection on day 27. Most misses happen because the customer wasn't reached in time.
2. Match the format exactly. If a section asks for a utility bill, a bank statement won't satisfy it. Re-read every description before uploading.
3. Keep documents consistent. Names, addresses, and ownership percentages should match across the share register, the IDs, and the application.
4. Submit once, completely. The submission is single-shot, and the dashboard won't send until every required field is filled.
5. Route emails to the right people. RFI emails go to every active member of your instance unless you set dedicated compliance addresses (up to 20) in settings. Remove former teammates.

After you submit, the customer's status returns to verifying and compliance re-reviews. BlindPay's docs say most RFIs resolve within a few business days. If something is still missing, a new RFI opens. Only one can be open per customer at a time.

How do you handle RFIs through the API?

Treat them as a status change, not an email. The flow from BlindPay's RFI API docs:

1. Subscribe to the customer.update webhook.
2. When kyc_status becomes compliance_request or approved_rfi, call GET /v1/instances/{instance_id}/customers/{customer_id}/rfi. It returns the open RFI, or null when none is open.
3. Render the requested fields in your own interface and collect them from your customer.
4. Submit everything in one POST to the same path.
5. Wait for the next customer.update: approved, rejected, or another compliance_request.

The RFI payload includes expires_at, so your system can show the deadline and nudge the customer before day 17. Building this in-product beats forwarding emails, because the person who has the documents sees the request directly. How to automate KYC and KYB covers the onboarding side of the same integration.

How do you prevent RFIs in the first place?

Front-load the data compliance would otherwise ask for. A website that describes the actual business, a proof of address dated within 90 days, a share register that names every UBO with percentages, and IDs that are current and fully visible remove most of the triggers above. BlindPay's KYB documents guide lists the exact requirements.

For transactions, consistency is the prevention. A customer whose payments match the volume and counterparties described at onboarding trips fewer flags than one whose activity drifts.

How does BlindPay handle RFIs?

BlindPay compliance opens an RFI instead of rejecting outright when a customer file or a transaction needs context. You get it in the dashboard, by email to your team or your compliance list, and through the customer.update webhook, with a fetch and submit endpoint for in-product handling. Customer RFIs run 27 days with reminders on days 7 and 17. Non-blocking approved_rfi reviews let approved customers keep sending payouts over Pix, SPEI, ACH, SEPA, or SWIFT (POBO/COBO) while you answer. Held transactions ask for relationship and purpose and should be answered within 24 hours.

What to do next

Check who receives compliance email on your instance today, and set a dedicated compliance address list if it's still going to the whole team. Then subscribe to customer.update on a development instance and wire the RFI fetch into your support tooling before the first real one arrives.