Neobank compliance checklist for stablecoin rails: 20 items, owners, and evidence

A neobank on stablecoin rails needs a written AML program, KYC and KYB, sanctions and wallet screening, transaction monitoring, Travel Rule data, records, licensing review, consumer disclosures, and vendor due diligence. A provider such as BlindPay covers screening and checks inside its own payment flow. The program around it, and the evidence that proves it works, stays with you.

This checklist turns those duties into 20 items, each with an owner and the evidence an examiner or partner bank will ask for. It is part of our guide to building a neobank. For the licensing question that comes first, read do you need a banking license.

This is educational content, not legal advice. Rules differ by country and by what your product does, so confirm each item with counsel.

Key takeaways

• Compliance is a program, not a vendor. A provider can run checks; it can't own your policies.
• Most items are shared. Write down who does what on each side.
• Evidence matters as much as the control. If it isn't logged, it didn't happen.
• Every end user who moves money should be onboarded at the provider. Pooling them is nesting.
• Stablecoins add wallet screening, Travel Rule data, and crypto-specific licensing.

What is in a neobank compliance program?

A US money services business needs a written AML program. Under 31 CFR 1022.210, it must be commensurate with the business's risks, incorporate policies, procedures, and internal controls, designate a person for day-to-day compliance, train staff, and provide for independent review.

Other countries use different words for the same pillars. Those pillars are the backbone of the checklist below.

What is on the 20-item checklist?

Here is the full list. "Both" means you and your provider each own part of it.

Which items does a provider cover, and which stay with you?

A provider covers what happens inside the transactions it processes. You cover the program and everything your app does around it.

Items 1 to 5 are always yours: risk assessment, policy, officer, training, and review. Items 10 and 13, wallet screening and Travel Rule data, usually sit with the provider for transfers it executes. Items 6 to 9, 11, 12, 14, and 19 are shared, because both sides see part of the customer and part of the activity.

The compliance map for card and payout programs breaks this split down per check if you also run cards.

What do the US rules require?

Four rules shape most of a US checklist:

• Registration. Money services businesses file FinCEN Form 107 within 180 days of establishment and renew every two years. Many states add their own money transmitter licenses.
• Crypto scope. FinCEN's guidance on business models involving convertible virtual currencies explains when accepting and transmitting stablecoins counts as money transmission.
• Suspicious activity. An MSB files each SAR no later than 30 calendar days after first detecting the facts, and keeps a copy with supporting documents for five years.
• Travel Rule. 31 CFR 1010.410 applies recordkeeping and travel requirements to transmittals of funds of $3,000 or more. Our guide to the Travel Rule on stablecoin off-ramps covers the data fields.

What changes in Brazil, Mexico, and the EU?

The pillars stay the same. The licenses and reports change.

• Brazil. Virtual asset service providers need Central Bank authorization under the PSAV regime. Transfers to self-custody wallets of US$10,000 or more carry a COAF reporting rule, covered in our self-custody wallet declaration guide.
• Mexico. Electronic payment fund institutions (IFPEs) are authorized by the CNBV under the Fintech Law.
• EU. Crypto-asset service providers need MiCA authorization, and payment or e-money institutions operate under PSD2. See MiCA stablecoin rules.

Each of these needs a local legal opinion. Put it on item 15.

Worked example: filling in the owner column

Illustrative scenario. A neobank lets US users hold a dollar balance and send money to family in Mexico over SPEI, using a payout provider for the transfer.

The gap that teams miss: activity the provider never sees. Peer-to-peer transfers inside the neobank's own ledger, or balance changes between users, are only visible to the neobank. Monitoring them is item 11 on your side.

What are common compliance mistakes?

• Treating the provider's MSB registration as your own.
• Running KYC through the provider but never writing your own risk assessment.
• Pooling users under one company account at the provider, which is nesting.
• Monitoring payouts but not transfers inside your own ledger.
• Keeping alerts without written dispositions.
• Writing the policy once and never updating it after new products or countries.

How does BlindPay fit?

BlindPay is registered with FinCEN as a money services business, and its API runs KYC and KYB, sanctions screening, and Travel Rule checks inside every payin and payout. For a neobank, that covers items 10 and 13 for BlindPay transfers and BlindPay's half of items 6 to 9, 11, 12, and 14.

• Customer-level onboarding. Each end user becomes a BlindPay customer with their own KYC, which keeps you clear of nesting.
• Tiered KYC and limits, with Enhanced review for high-risk countries. See neobank KYC and KYB onboarding.
• Non-custodial payouts from customer-controlled wallets, which keeps funds under your control. The custody model you pick changes items 14 and 16, as covered in where neobanks hold customer funds.
• Published policies: the prohibited activities list and the licenses page for your vendor file.

Items 1 to 5 and 15 to 18 remain yours.

What to do next

Copy the 20-row table into your compliance tracker and fill in the owner column with your provider before launch. Then pull BlindPay's licenses and prohibited activities list into your vendor file (item 18) and test the onboarding flow on a development instance from the BlindPay docs.