---
title: "Why did my cross-border payout get an RFI? What compliance asks, and how to answer fast"
seoTitle: "Cross-border payout RFI: what's asked and how to answer"
description: "A request for information pauses a customer or holds a payout until compliance gets answers. The three RFI types, their deadlines, and how to answer."
date: "2026-10-13"
updated: "2026-10-13"
category: "compliance"
author: "BlindPay Team"
howto:
  name: "How to answer a request for information on a cross-border payment"
  steps:
    - name: "Identify which kind of RFI it is"
      text: "Check whether it is about a customer (kyc_status compliance_request or approved_rfi), about a held transaction (payout or payin on_hold), or about your own company (an instance RFI). Each has a different deadline and a different effect on payments."
    - name: "Read every section before collecting anything"
      text: "Each RFI lists sections with a title, a description of what compliance needs, and the fields to fill in. Match the exact document type requested; a bank statement does not satisfy a request for a utility bill."
    - name: "Collect documents from your customer early"
      text: "You, not BlindPay, contact your customer. Start on day 0, since a customer RFI auto-rejects after 27 days and a transaction RFI should be answered within 24 hours."
    - name: "Submit the whole response at once"
      text: "Submissions are single-shot: fill every required field, upload the files, and submit in one action from the dashboard or with POST /v1/instances/{instance_id}/customers/{customer_id}/rfi."
    - name: "Watch for the next status change"
      text: "Listen for the customer.update webhook. The customer moves back to verifying, then to approved, rejected, or a new compliance_request if compliance needs another round."
faq:
  - q: "What is an RFI in cross-border payments?"
    a: "A request for information is how a payment provider's compliance team asks for missing or clarifying details instead of rejecting a customer or a transaction outright. It might ask for an updated proof of address, ownership documents, source of funds, or the purpose of a specific payment. The customer or transaction waits until the answer arrives and compliance reviews it."
  - q: "How long do I have to answer an RFI on BlindPay?"
    a: "A customer RFI gives you 27 days, with reminder emails on days 7 and 17, and auto-rejects a paused customer when the deadline passes. A request about a held transaction should be answered within 24 hours, or the transaction may be refunded to the sender. An instance RFI about your own company also runs 27 days but doesn't block payments."
  - q: "Can a customer keep sending payments while an RFI is open?"
    a: "It depends on the status. A customer in compliance_request can't send or receive funds until the response is reviewed. A customer in approved_rfi keeps full access, including payouts, payins, and virtual accounts, and returns to approved as soon as you submit. The approved_rfi type is typically used for periodic reviews of customers who are already approved."
  - q: "Why does BlindPay email my team instead of my customer?"
    a: "Because collecting the documents is the partner's job. BlindPay emails every active member of your instance, or only the compliance addresses you configure, up to 20. You then reach your customer through your own product and upload the response. Keeping the member list current stops RFIs from landing in a former teammate's inbox."
  - q: "What are the most common reasons for an RFI?"
    a: "BlindPay's docs list a business description that doesn't match the company's website, a proof of address that doesn't match the registered address, an expired or blurry ID, ownership structures that need an updated share register or UBO documents, and source of funds or wealth that needs evidence. Held transactions usually need the sender relationship and purpose."
  - q: "Can I answer an RFI through the API?"
    a: "Yes. Subscribe to the customer.update webhook, fetch the open RFI with GET /v1/instances/{instance_id}/customers/{customer_id}/rfi, collect the fields in your own interface, and submit them in one POST to the same path. Only one RFI can be open per customer, and the payload includes expires_at so your system can track the deadline."
---

A cross-border payout gets an RFI when compliance needs more information before it can approve a customer or release a transaction. A request for information (RFI) is a structured list of questions and document uploads. Answer it completely and fast: a customer RFI auto-rejects after 27 days, and a held transaction should be answered within 24 hours.

RFIs are part of why cross-border payments carry compliance cost at all. In the [stablecoin sandwich](/resources/more/what-is-a-stablecoin-sandwich), the on-chain leg is cheap, but the on-ramp and off-ramp still run full KYC, KYB, and monitoring. RFIs are where that work reaches your team.

**Key takeaways**

- There are three kinds of RFI: about a customer, about a held transaction, and about your own company. Each has its own deadline.
- A customer in `compliance_request` can't transact. A customer in `approved_rfi` keeps working while you answer.
- BlindPay emails your team, not your customer. Collecting the answer is your job.
- Submissions are single-shot. Read every section first and match the exact document type requested.
- The fastest RFI is the one you prevent: complete, consistent onboarding data up front.

## What are the three kinds of RFI?

They differ by subject, by deadline, and by what they block.

| RFI type | What it's about | Effect while open | Deadline | If you miss it |
| --- | --- | --- | --- | --- |
| Customer RFI, blocking | One of your customers' KYC or KYB | Customer can't send or receive (`compliance_request`) | 27 days | Customer auto-rejected |
| Customer RFI, non-blocking | Periodic review of an approved customer | Customer keeps full access (`approved_rfi`) | 27 days | Compliance reviews the case manually |
| Transaction hold RFI | One flagged payin or payout | That transaction stays `on_hold` | 24 hours | Transaction may be refunded to the sender |
| Instance RFI | Your own company | No effect on your account or payments | 27 days | Request expires, compliance follows up |

Sources: BlindPay's [information requests](/docs/kb/information-requests), [on-hold transactions](/docs/kb/on-hold-transactions), and [instance requests](/docs/kb/instance-requests) guides.

SWIFT document reviews look similar but aren't RFIs. Every SWIFT payout starts `on_hold`, and third-party SWIFT payouts wait for a document such as an invoice or contract. [How to send a SWIFT payout from USDC](/resources/more/how-to-send-swift-payout-from-usdc) covers that flow.

## Why do compliance teams send RFIs at all?

Because the rules require them to understand who they serve and why money moves. FinCEN's [customer due diligence rule](https://www.fincen.gov/resources/statutes-and-regulations/cdd-final-rule) asks covered institutions to "understand the nature and purpose of customer relationships" and, on a risk basis, to "maintain and update customer information." An RFI is how a payment provider closes a gap in that file without rejecting the customer.

Cross-border payments also carry more data than domestic ones. FATF adopted a [revised Recommendation 16](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/update-Recommendation-16-payment-transparency-june-2025.html) on payment transparency in June 2025, with implementation expected by the end of 2030, so expect data requests on cross-border flows to grow, not shrink.

The traditional system duplicates this work. The Federal Reserve's [March 30, 2026 FEDS Note](https://www.federalreserve.gov/econres/notes/feds-notes/payment-stablecoins-and-cross-border-payments-benefits-and-implications-for-monetary-policy-20260330.html) notes that compliance checks can run "at multiple points in the chain" of correspondent banks. A stablecoin payout shortens the chain, but the checks at each end stay.

## What does a customer RFI usually ask for?

The gaps that block a clean KYC or KYB decision. BlindPay's docs list these common triggers:

- A business description that doesn't match the company's website or industry
- A proof of address that doesn't match the registered address
- An identity document that's expired, blurry, or partially visible
- An ownership structure that needs an updated share register or UBO documentation
- Source of funds or source of wealth that needs evidence

Each RFI arrives as sections. Every section has a title, a description of what compliance needs, and one or more fields: text, a file upload, or a dropdown. One RFI can mix a document upload with a written explanation.

Source of funds is the trigger teams find hardest to answer. [Why off-ramps ask for source of funds](/resources/more/source-of-funds-crypto-off-ramps) lists the documents that work and the ones that fail.

## What does a transaction hold RFI ask for?

The story behind one payment. When monitoring flags a payin or payout and compliance can't clear it internally, BlindPay sends the transaction details and asks for:

1. The relationship between the sender and the customer
2. The purpose of the transaction
3. The expected outcome of the transaction
4. Anything else that helps explain it

The clock here is short. If the RFI isn't answered within 24 hours, the transaction may be refunded to the sender. Holds in general can last up to 30 days, and a hold that times out without a decision fails the transaction ([cut-off times and compliance holds](/docs/kb/cut-off-times)).

Write the answer the way you'd explain it to a new finance hire. "Monthly invoice 2026-091 from our design contractor in Curitiba, per the attached contract" beats "business payment." [How to reduce false positives in transaction monitoring](/resources/more/reduce-false-positives-transaction-monitoring) explains why vague answers lead to second rounds.

## How do you answer an RFI the first time?

Five habits cut most second rounds:

1. **Start on day 0.** BlindPay sends an Action Required email on day 0, a reminder on day 7, a final notice on day 17, and the rejection on day 27. Most misses happen because the customer wasn't reached in time.
2. **Match the format exactly.** If a section asks for a utility bill, a bank statement won't satisfy it. Re-read every description before uploading.
3. **Keep documents consistent.** Names, addresses, and ownership percentages should match across the share register, the IDs, and the application.
4. **Submit once, completely.** The submission is single-shot, and the dashboard won't send until every required field is filled.
5. **Route emails to the right people.** RFI emails go to every active member of your instance unless you set dedicated compliance addresses (up to 20) in settings. Remove former teammates.

After you submit, the customer's status returns to `verifying` and compliance re-reviews. BlindPay's docs say most RFIs resolve within a few business days. If something is still missing, a new RFI opens. Only one can be open per customer at a time.

## How do you handle RFIs through the API?

Treat them as a status change, not an email. The flow from BlindPay's [RFI API docs](/docs/learn/rfi):

1. Subscribe to the `customer.update` webhook.
2. When `kyc_status` becomes `compliance_request` or `approved_rfi`, call `GET /v1/instances/{instance_id}/customers/{customer_id}/rfi`. It returns the open RFI, or `null` when none is open.
3. Render the requested fields in your own interface and collect them from your customer.
4. Submit everything in one `POST` to the same path.
5. Wait for the next `customer.update`: `approved`, `rejected`, or another `compliance_request`.

The RFI payload includes `expires_at`, so your system can show the deadline and nudge the customer before day 17. Building this in-product beats forwarding emails, because the person who has the documents sees the request directly. [How to automate KYC and KYB](/resources/more/how-to-automate-kyc-kyb-stablecoin-payments) covers the onboarding side of the same integration.

## How do you prevent RFIs in the first place?

Front-load the data compliance would otherwise ask for. A website that describes the actual business, a proof of address dated within 90 days, a share register that names every UBO with percentages, and IDs that are current and fully visible remove most of the triggers above. BlindPay's [KYB documents guide](/docs/kb/kyb-documents) lists the exact requirements.

For transactions, consistency is the prevention. A customer whose payments match the volume and counterparties described at onboarding trips fewer flags than one whose activity drifts.

## How does BlindPay handle RFIs?

BlindPay compliance opens an RFI instead of rejecting outright when a customer file or a transaction needs context. You get it in the dashboard, by email to your team or your compliance list, and through the `customer.update` webhook, with a fetch and submit endpoint for in-product handling. Customer RFIs run 27 days with reminders on days 7 and 17. Non-blocking `approved_rfi` reviews let approved customers keep sending payouts over Pix, SPEI, ACH, SEPA, or SWIFT (POBO/COBO) while you answer. Held transactions ask for relationship and purpose and should be answered within 24 hours.

## What to do next

Check who receives compliance email on your instance today, and set a dedicated compliance address list if it's still going to the whole team. Then subscribe to `customer.update` on a development instance and wire the RFI fetch into your support tooling before the first real one arrives.