---
title: "Compliance for cross-border stablecoin card programs: a country readiness template"
seoTitle: "Cross-border stablecoin card compliance by country"
description: "A country readiness template for stablecoin card programs: onboarding rules, funding rails, and payout rails for the US, LatAm, and the EU."
date: "2026-10-10"
updated: "2026-10-10"
category: "compliance"
author: "BlindPay Team"
faq:
  - q: "What compliance does a cross-border stablecoin card program need?"
    a: "Four layers in every market: licensing for the card issuer and for any virtual asset service, card network program rules, AML and sanctions controls on people, wallets, and transactions, and data protection for the personal data you collect. Each country where cardholders live can add its own rules on top of the country where the card is issued, so the work is done market by market."
  - q: "How do you check if a country is ready for a stablecoin card launch?"
    a: "Fill one row per country with five answers: can cardholders there be onboarded and at what verification level, which local rails can fund the card balance, which rails can pay money back out, which licenses apply, and which data protection law governs the data. A market is ready when every cell has a confirmed answer from a provider or from local counsel, not an assumption."
  - q: "Which local rails can fund a stablecoin card in Latin America?"
    a: "Through BlindPay, a card balance can be funded by Pix or TED in Brazil, SPEI in Mexico, PSE in Colombia, and Transfers 3.0 in Argentina, each converted into USDC or USDT and delivered to a wallet. Pix, SPEI, Transfers, and PSE payins typically arrive within minutes. US-based senders can use ACH, wire, RTP, or a dedicated US virtual account."
  - q: "Do card network rules change for stablecoin card programs?"
    a: "The program rules, dispute rights, and chargeback processes stay the same. What changes is the settlement option: Visa settles with some programs in stablecoins, and Mastercard announced plans in June 2026 for on-chain card settlement that keeps existing dispute processes. Visa also notes that every card program has to fund its daily settlement obligation before it collects from cardholders."
  - q: "Who should review a cross-border stablecoin card program?"
    a: "Counsel in the country where the card is issued, for banking and card rules, and counsel in each country where cardholders live, for virtual asset, consumer protection, and data protection rules. Your sponsor bank and each provider will also run their own reviews. Bring them a completed readiness table so the questions are specific to your markets and rails."
  - q: "Does data protection law apply to stablecoin card programs?"
    a: "Yes. A card program collects identity documents, addresses, selfies, and transaction histories, which are personal data in every market. Brazil's LGPD and the EU's GDPR are the two you will meet first in a Latin America and Europe program. Map which provider receives which data, get consent where the law requires it, and set retention periods before launch."
---

*Reading time: about 8 minutes.*

**Summary:** A cross-border stablecoin card program is compliant country by country, not once. For each market, confirm who can be onboarded and at what verification level, which local rails fund the card balance and pay money back out, which licenses apply to the card and the stablecoin layer, and which data protection law governs cardholder data. A readiness table makes the gaps visible.

**Key takeaways**

- The card is licensed where it is issued. The stablecoin service is often regulated where the cardholder lives.
- Fill one readiness row per country before launch. Empty cells are your counsel's to-do list.
- Funding and payout rails differ by country: Pix in Brazil, SPEI in Mexico, PSE in Colombia, Transfers 3.0 in Argentina.
- Card network rules and dispute rights do not change when settlement moves to stablecoins.
- Sanctions compliance is strict liability in the US, so wallet screening belongs in every market.


This guide is for compliance leads and founders planning a card program across the Americas and Europe. The [card issuing compliance guide](/resources/more/stablecoin-card-issuing-compliance) explains each regulatory regime. This page turns that into a working template you can fill in, with the rail and onboarding cells already completed for six markets from published BlindPay documentation.

## What makes cross-border card compliance different?

Two legal anchors apply at once. Card issuing follows the country where the card is issued, and virtual asset services usually follow the country where the customer is.

So a US-issued card held by a cardholder in Brazil can sit under US banking and card rules and Brazil's virtual asset regime at the same time. Add Mexico and the EU and the same program answers to four sets of stablecoin rules. That is why one license almost never covers a global program, and why the [license guide](/resources/more/stablecoin-payment-licenses-msb-mtl-vasp-emi) starts with "where are your customers?"

The practical effect is a matrix: every country where you onboard cardholders is a row, and every compliance layer is a column.

## What goes into a country readiness table?

Five columns per country. Two are about people, two are about money, and one is about law.

| Column | Question it answers | Who confirms it |
|---|---|---|
| Onboarding rules | Can people here be onboarded, at what verification level, with which ID documents? | Card provider and funding provider |
| Funding rails | How does money from this country reach the card balance? | Funding provider |
| Payout rails | How does money get back out to a local bank account? | Payout provider |
| Licensing | Which card and virtual asset licenses apply to each party? | Local counsel |
| Data protection | Which law governs cardholder data, and where may it be stored? | Local counsel |

Fill the first three from provider documentation. Fill the last two with counsel. A row is ready only when every cell has a confirmed source.

## What does a filled-in table look like?

Here are the first three columns for six markets, filled in from BlindPay's documentation. BlindPay assigns each country a verification tier, lists its payment methods by direction, and publishes typical arrival times per rail.

| Market | Onboarding (BlindPay tier) | Funding rails into stablecoins | Payout rails to local accounts | Typical timing |
|---|---|---|---|---|
| United States | Standard: automated KYC for eligible individuals | ACH, ACH Pull (Plaid), domestic wire, RTP, SWIFT (with an approved US virtual account) | ACH, domestic wire, RTP, SWIFT (POBO/COBO) | RTP instant; same-day ACH same business day; ACH 1 to 3 business days |
| Brazil | Standard | Pix, TED (enabled per instance) | Pix, PIX Safe, TED | Pix payins up to 5 minutes |
| Mexico | Standard | SPEI (CLABE) | SPEI | SPEI payins up to 10 minutes |
| Colombia | High-risk tier: individuals use KYC Enhanced, manual review up to 1 business day | PSE (payment link) | ACH Colombia | PSE payins up to 10 minutes; ACH Colombia payouts about 1 business day |
| Argentina | Standard | Transfers 3.0 (CBU) | Transfers 3.0 | Payins up to 10 minutes |
| EU (SEPA zone, for example Germany, France, Spain) | Standard | SWIFT in USD to a US virtual account | SEPA in EUR | SEPA about 1 to 2 business days |

Sources for each cell: [supported countries](/docs/kb/supported-countries), [payment methods](/docs/kb/payment-methods), and [cut-off times](/docs/kb/cut-off-times). Two details from those pages are worth copying into your own notes. In high-risk tier countries a driver's license is not accepted as an ID document, so ask for a passport or national ID. And SEPA payouts to a few countries, including France and Portugal, are limited to individual beneficiaries.

The underlying rails are national infrastructure, so their hours are set by central banks: Banco Central do Brasil launched Pix on November 16, 2020 and runs it 24/7, and Banco de México operates SPEI 24 hours a day, 365 days a year.

## How do you fill the licensing and data protection columns?

With counsel, one market at a time. These are the questions to bring.

**Licensing.** Who is the legal card issuer, and under which regulator? Does any party in your stack exchange, custody, or transfer stablecoins for residents of this country, and does that need registration or authorization? In Brazil the answer runs through the PSAV regime ([PSAV explainer](/resources/more/psav-brazil-explained)); in the EU through MiCA ([MiCA explainer](/resources/more/mica-stablecoin-rules-explained)). The [regulation tracker](/resources/more/stablecoin-regulation-tracker-2026) keeps the country list current.

**Card network rules.** The networks set program rules, brand standards, and dispute processes, and those travel with the card into every market. Mastercard's June 2026 announcement on stablecoin settlement says it keeps existing dispute processes. Visa's September 2026 guidance on stablecoin-linked programs notes that every card program has to fund its daily settlement obligation before it collects from cardholders, which shapes your treasury plan in every country.

**AML and sanctions.** Who screens cardholders, business owners, and wallet addresses, and who files suspicious activity reports in each country? OFAC says civil penalties generally apply on a strict liability basis, so any US person in the chain screens regardless of where the cardholder lives. For stablecoin transfers between providers, the [Travel Rule guide](/resources/more/travel-rule-stablecoin-off-ramps) covers what originator data must move with the funds.

**Data protection.** Which law governs cardholder data, where may it be stored, and which providers receive it? Brazil's LGPD and the EU's GDPR are the first two you will meet in this footprint. Map each data field to each provider before launch.

## How do you build the table for your program?

Six steps, roughly one working session per market once the providers are chosen.

1. **List target markets in launch order.** Start with the two where most cardholders live.
2. **Copy the onboarding cell from each provider.** Confirm tier, verification level, accepted ID documents, and review time. Note where providers disagree.
3. **Fill funding and payout rails.** Use the provider's published rail list, by direction, with timing. Mark any rail that needs a separate feature or approval.
4. **Send the licensing and data rows to counsel.** One memo per country, with your stack diagram attached.
5. **Add network rule checks.** Confirm with your card provider which card types, currencies, and settlement options apply per market.
6. **Review quarterly.** Rules, rails, and country tiers change. Put a date on every cell.

## What are the common gaps teams miss?

Three show up in almost every review.

- **Assuming one tier everywhere.** A country in a higher verification tier changes your onboarding flow, your review time, and your accepted documents. Colombia is the example in the table above.
- **Funding without payout.** A program that lets users fund in a country but cannot pay them back out locally ends up with stuck balances and support tickets. Fill both columns.
- **No owner for data residency.** Two providers plus your own systems means three copies of identity data. Decide retention and deletion before launch.

The [card issuing compliance guide](/resources/more/stablecoin-card-issuing-compliance#who-is-responsible-for-what) covers who runs each verification across the program.

## Where does BlindPay fit?

BlindPay is the funding and payout layer for the countries in your table. It turns local bank money into USDC or USDT for the balance behind a card, over ACH, wire, RTP, and SWIFT in the US, Pix and TED in Brazil, SPEI in Mexico, PSE in Colombia, and Transfers 3.0 in Argentina. It pays stablecoins back out as local currency over Pix, SPEI, ACH Colombia, Transfers 3.0, ACH, RTP, SEPA, and SWIFT (POBO/COBO) with UETR tracking and MT103 confirmations.

The onboarding cells come with it. Each country has a published verification tier, KYC and KYB run inside the API before any payment moves, and BlindPay is registered with FinCEN as a Money Services Business, with licenses on the [licenses page](/licenses). Every quote shows the fee breakdown and exact amount before execute, so the timing and cost columns in your table come from live data. Read the [payment methods reference](/docs/kb/payment-methods) or [talk to the team](/contact).

## What to read next

- [Compliance for stablecoin card issuing](/resources/more/stablecoin-card-issuing-compliance)
- [Stablecoin cards in Latin America](/resources/more/stablecoin-cards-latin-america)
- [The GENIUS Act explained for businesses](/resources/more/genius-act-for-businesses)
- [BIN sponsor vs. issuer-processor vs. program manager](/resources/more/bin-sponsor-vs-issuer-processor-vs-program-manager)
- [Build vs. buy a stablecoin card program](/resources/more/build-vs-buy-stablecoin-card-program), for the partner decision before a country rollout

## Sources

- [Banco Central do Brasil: Pix](https://www.bcb.gov.br/en/financialstability/pix_en)
- [Banco de México: SPEI](https://www.banxico.org.mx/services/interbanking-electronic-payme.html)
- [Mastercard: expanding settlement capabilities to include stablecoins, June 3, 2026](https://www.mastercard.com/us/en/news-and-trends/press/2026/june/mastercard-expands-settlement-capabilities-to-include-stablecoin.html)
- [Visa: financing stablecoin-linked card programs, September 8, 2026](https://www.visa.com/en-us/thought-leadership/innovation/financing-stablecoin-linked-card-programs)
- [OFAC: Sanctions compliance guidance for the virtual currency industry, October 2021](https://ofac.treasury.gov/media/913571/download?inline)

*This article is for general information only and is not legal, tax, or financial advice.*