Compliance for cross-border stablecoin card programs: a country readiness template

Reading time: about 8 minutes.

Summary: A cross-border stablecoin card program is compliant country by country, not once. For each market, confirm who can be onboarded and at what verification level, which local rails fund the card balance and pay money back out, which licenses apply to the card and the stablecoin layer, and which data protection law governs cardholder data. A readiness table makes the gaps visible.

Key takeaways

• The card is licensed where it is issued. The stablecoin service is often regulated where the cardholder lives.
• Fill one readiness row per country before launch. Empty cells are your counsel's to-do list.
• Funding and payout rails differ by country: Pix in Brazil, SPEI in Mexico, PSE in Colombia, Transfers 3.0 in Argentina.
• Card network rules and dispute rights do not change when settlement moves to stablecoins.
• Sanctions compliance is strict liability in the US, so wallet screening belongs in every market.

This guide is for compliance leads and founders planning a card program across the Americas and Europe. The card issuing compliance guide explains each regulatory regime. This page turns that into a working template you can fill in, with the rail and onboarding cells already completed for six markets from published BlindPay documentation.

What makes cross-border card compliance different?

Two legal anchors apply at once. Card issuing follows the country where the card is issued, and virtual asset services usually follow the country where the customer is.

So a US-issued card held by a cardholder in Brazil can sit under US banking and card rules and Brazil's virtual asset regime at the same time. Add Mexico and the EU and the same program answers to four sets of stablecoin rules. That is why one license almost never covers a global program, and why the license guide starts with "where are your customers?"

The practical effect is a matrix: every country where you onboard cardholders is a row, and every compliance layer is a column.

What goes into a country readiness table?

Five columns per country. Two are about people, two are about money, and one is about law.

Fill the first three from provider documentation. Fill the last two with counsel. A row is ready only when every cell has a confirmed source.

What does a filled-in table look like?

Here are the first three columns for six markets, filled in from BlindPay's documentation. BlindPay assigns each country a verification tier, lists its payment methods by direction, and publishes typical arrival times per rail.

Sources for each cell: supported countries, payment methods, and cut-off times. Two details from those pages are worth copying into your own notes. In high-risk tier countries a driver's license is not accepted as an ID document, so ask for a passport or national ID. And SEPA payouts to a few countries, including France and Portugal, are limited to individual beneficiaries.

The underlying rails are national infrastructure, so their hours are set by central banks: Banco Central do Brasil launched Pix on November 16, 2020 and runs it 24/7, and Banco de México operates SPEI 24 hours a day, 365 days a year.

How do you fill the licensing and data protection columns?

With counsel, one market at a time. These are the questions to bring.

Licensing. Who is the legal card issuer, and under which regulator? Does any party in your stack exchange, custody, or transfer stablecoins for residents of this country, and does that need registration or authorization? In Brazil the answer runs through the PSAV regime (PSAV explainer); in the EU through MiCA (MiCA explainer). The regulation tracker keeps the country list current.

Card network rules. The networks set program rules, brand standards, and dispute processes, and those travel with the card into every market. Mastercard's June 2026 announcement on stablecoin settlement says it keeps existing dispute processes. Visa's September 2026 guidance on stablecoin-linked programs notes that every card program has to fund its daily settlement obligation before it collects from cardholders, which shapes your treasury plan in every country.

AML and sanctions. Who screens cardholders, business owners, and wallet addresses, and who files suspicious activity reports in each country? OFAC says civil penalties generally apply on a strict liability basis, so any US person in the chain screens regardless of where the cardholder lives. For stablecoin transfers between providers, the Travel Rule guide covers what originator data must move with the funds.

Data protection. Which law governs cardholder data, where may it be stored, and which providers receive it? Brazil's LGPD and the EU's GDPR are the first two you will meet in this footprint. Map each data field to each provider before launch.

How do you build the table for your program?

Six steps, roughly one working session per market once the providers are chosen.

1. List target markets in launch order. Start with the two where most cardholders live.
2. Copy the onboarding cell from each provider. Confirm tier, verification level, accepted ID documents, and review time. Note where providers disagree.
3. Fill funding and payout rails. Use the provider's published rail list, by direction, with timing. Mark any rail that needs a separate feature or approval.
4. Send the licensing and data rows to counsel. One memo per country, with your stack diagram attached.
5. Add network rule checks. Confirm with your card provider which card types, currencies, and settlement options apply per market.
6. Review quarterly. Rules, rails, and country tiers change. Put a date on every cell.

What are the common gaps teams miss?

Three show up in almost every review.

• Assuming one tier everywhere. A country in a higher verification tier changes your onboarding flow, your review time, and your accepted documents. Colombia is the example in the table above.
• Funding without payout. A program that lets users fund in a country but cannot pay them back out locally ends up with stuck balances and support tickets. Fill both columns.
• No owner for data residency. Two providers plus your own systems means three copies of identity data. Decide retention and deletion before launch.

The card issuing compliance guide covers who runs each verification across the program.

Where does BlindPay fit?

BlindPay is the funding and payout layer for the countries in your table. It turns local bank money into USDC or USDT for the balance behind a card, over ACH, wire, RTP, and SWIFT in the US, Pix and TED in Brazil, SPEI in Mexico, PSE in Colombia, and Transfers 3.0 in Argentina. It pays stablecoins back out as local currency over Pix, SPEI, ACH Colombia, Transfers 3.0, ACH, RTP, SEPA, and SWIFT (POBO/COBO) with UETR tracking and MT103 confirmations.

The onboarding cells come with it. Each country has a published verification tier, KYC and KYB run inside the API before any payment moves, and BlindPay is registered with FinCEN as a Money Services Business, with licenses on the licenses page. Every quote shows the fee breakdown and exact amount before execute, so the timing and cost columns in your table come from live data. Read the payment methods reference or talk to the team.

What to read next

• Compliance for stablecoin card issuing
• Stablecoin cards in Latin America
• The GENIUS Act explained for businesses
• BIN sponsor vs. issuer-processor vs. program manager
• Build vs. buy a stablecoin card program, for the partner decision before a country rollout

Sources

• Banco Central do Brasil: Pix
• Banco de México: SPEI
• Mastercard: expanding settlement capabilities to include stablecoins, June 3, 2026
• Visa: financing stablecoin-linked card programs, September 8, 2026
• OFAC: Sanctions compliance guidance for the virtual currency industry, October 2021

This article is for general information only and is not legal, tax, or financial advice.