[{"data":1,"prerenderedAt":917},["ShallowReactive",2],{"content-\u002Fresources\u002Fmore\u002Fneobank-compliance-checklist-stablecoin-rails":3,"resources-category-neobank-compliance-checklist-stablecoin-rails":711},{"id":4,"title":5,"authors":6,"body":7,"categories":6,"category":681,"categoryType":6,"compare":6,"contributors":6,"date":682,"description":683,"extension":684,"faq":685,"howto":6,"isBlog":701,"isChangelog":701,"meta":702,"navigation":704,"path":705,"pillar":701,"products":6,"rawbody":706,"role":6,"seo":707,"seoTitle":708,"stem":709,"thumbnail":6,"updated":682,"__hash__":710},"content\u002Fresources\u002Fmore\u002Fneobank-compliance-checklist-stablecoin-rails.md","Neobank compliance checklist for stablecoin rails: 20 items, owners, and evidence",null,{"type":8,"value":9,"toc":668},"minimark",[10,14,28,31,37,56,61,71,74,78,81,370,374,377,380,388,392,395,450,454,457,490,493,497,500,572,575,579,599,603,606,654,657,661],[11,12,13],"p",{},"A neobank on stablecoin rails needs a written AML program, KYC and KYB, sanctions and wallet screening, transaction monitoring, Travel Rule data, records, licensing review, consumer disclosures, and vendor due diligence. A provider such as BlindPay covers screening and checks inside its own payment flow. The program around it, and the evidence that proves it works, stays with you.",[11,15,16,17,22,23,27],{},"This checklist turns those duties into 20 items, each with an owner and the evidence an examiner or partner bank will ask for. It is part of our ",[18,19,21],"a",{"href":20},"\u002Fresources\u002Fmore\u002Fhow-to-build-a-neobank","guide to building a neobank",". For the licensing question that comes first, read ",[18,24,26],{"href":25},"\u002Fresources\u002Fmore\u002Fdo-you-need-a-banking-license-for-a-neobank","do you need a banking license",".",[11,29,30],{},"This is educational content, not legal advice. Rules differ by country and by what your product does, so confirm each item with counsel.",[11,32,33],{},[34,35,36],"strong",{},"Key takeaways",[38,39,40,44,47,50,53],"ul",{},[41,42,43],"li",{},"Compliance is a program, not a vendor. A provider can run checks; it can't own your policies.",[41,45,46],{},"Most items are shared. Write down who does what on each side.",[41,48,49],{},"Evidence matters as much as the control. If it isn't logged, it didn't happen.",[41,51,52],{},"Every end user who moves money should be onboarded at the provider. Pooling them is nesting.",[41,54,55],{},"Stablecoins add wallet screening, Travel Rule data, and crypto-specific licensing.",[57,58,60],"h2",{"id":59},"what-is-in-a-neobank-compliance-program","What is in a neobank compliance program?",[11,62,63,64,70],{},"A US money services business needs a written AML program. Under ",[18,65,69],{"href":66,"rel":67},"https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F31\u002F1022.210",[68],"nofollow","31 CFR 1022.210",", it must be commensurate with the business's risks, incorporate policies, procedures, and internal controls, designate a person for day-to-day compliance, train staff, and provide for independent review.",[11,72,73],{},"Other countries use different words for the same pillars. Those pillars are the backbone of the checklist below.",[57,75,77],{"id":76},"what-is-on-the-20-item-checklist","What is on the 20-item checklist?",[11,79,80],{},"Here is the full list. \"Both\" means you and your provider each own part of it.",[82,83,84,103],"table",{},[85,86,87],"thead",{},[88,89,90,94,97,100],"tr",{},[91,92,93],"th",{},"#",[91,95,96],{},"Requirement",[91,98,99],{},"Owner",[91,101,102],{},"Evidence to keep",[104,105,106,121,134,147,160,173,187,200,213,226,240,253,266,279,292,305,318,331,344,357],"tbody",{},[88,107,108,112,115,118],{},[109,110,111],"td",{},"1",[109,113,114],{},"Business-wide risk assessment",[109,116,117],{},"You",[109,119,120],{},"Dated assessment, approval, update log",[88,122,123,126,129,131],{},[109,124,125],{},"2",[109,127,128],{},"Written AML and sanctions policy",[109,130,117],{},[109,132,133],{},"Board or management approval, version history",[88,135,136,139,142,144],{},[109,137,138],{},"3",[109,140,141],{},"Named compliance officer",[109,143,117],{},[109,145,146],{},"Appointment record, reporting line",[88,148,149,152,155,157],{},[109,150,151],{},"4",[109,153,154],{},"Staff training",[109,156,117],{},[109,158,159],{},"Training materials, attendance, dates",[88,161,162,165,168,170],{},[109,163,164],{},"5",[109,166,167],{},"Independent review of the program",[109,169,117],{},[109,171,172],{},"Reviewer report, findings, remediation",[88,174,175,178,181,184],{},[109,176,177],{},"6",[109,179,180],{},"Customer KYC at onboarding",[109,182,183],{},"Both",[109,185,186],{},"Customer files, check results, tier",[88,188,189,192,195,197],{},[109,190,191],{},"7",[109,193,194],{},"Business KYB and beneficial owners",[109,196,183],{},[109,198,199],{},"Formation and ownership documents, owner KYC",[88,201,202,205,208,210],{},[109,203,204],{},"8",[109,206,207],{},"Sanctions screening at onboarding",[109,209,183],{},[109,211,212],{},"Screening results, match decisions",[88,214,215,218,221,223],{},[109,216,217],{},"9",[109,219,220],{},"Ongoing rescreening",[109,222,183],{},[109,224,225],{},"Rescreen logs, list update dates",[88,227,228,231,234,237],{},[109,229,230],{},"10",[109,232,233],{},"Wallet screening on stablecoin transfers",[109,235,236],{},"Provider (in its flow)",[109,238,239],{},"Provider reports, your exception log",[88,241,242,245,248,250],{},[109,243,244],{},"11",[109,246,247],{},"Transaction monitoring rules",[109,249,183],{},[109,251,252],{},"Rule list, alerts, dispositions",[88,254,255,258,261,263],{},[109,256,257],{},"12",[109,259,260],{},"Suspicious activity reporting",[109,262,183],{},[109,264,265],{},"Investigation notes, file or no-file decision",[88,267,268,271,274,276],{},[109,269,270],{},"13",[109,272,273],{},"Travel Rule data on transfers",[109,275,236],{},[109,277,278],{},"Originator and beneficiary data per transfer",[88,280,281,284,287,289],{},[109,282,283],{},"14",[109,285,286],{},"Record retention",[109,288,183],{},[109,290,291],{},"Retention policy, storage proof",[88,293,294,297,300,302],{},[109,295,296],{},"15",[109,298,299],{},"Registration and licensing review",[109,301,117],{},[109,303,304],{},"Legal memo per market, registrations",[88,306,307,310,313,315],{},[109,308,309],{},"16",[109,311,312],{},"Consumer disclosures and complaints",[109,314,117],{},[109,316,317],{},"Disclosure versions, complaint log",[88,319,320,323,326,328],{},[109,321,322],{},"17",[109,324,325],{},"Data privacy",[109,327,117],{},[109,329,330],{},"Privacy notice, data map, processor agreements",[88,332,333,336,339,341],{},[109,334,335],{},"18",[109,337,338],{},"Vendor due diligence",[109,340,117],{},[109,342,343],{},"Questionnaires, provider licenses, audit reports",[88,345,346,349,352,354],{},[109,347,348],{},"19",[109,350,351],{},"No nesting: end users onboarded at the provider",[109,353,183],{},[109,355,356],{},"Customer mapping between your ledger and the provider",[88,358,359,362,365,367],{},[109,360,361],{},"20",[109,363,364],{},"Audit readiness",[109,366,117],{},[109,368,369],{},"Index of all the above, sample walkthroughs",[57,371,373],{"id":372},"which-items-does-a-provider-cover-and-which-stay-with-you","Which items does a provider cover, and which stay with you?",[11,375,376],{},"A provider covers what happens inside the transactions it processes. You cover the program and everything your app does around it.",[11,378,379],{},"Items 1 to 5 are always yours: risk assessment, policy, officer, training, and review. Items 10 and 13, wallet screening and Travel Rule data, usually sit with the provider for transfers it executes. Items 6 to 9, 11, 12, 14, and 19 are shared, because both sides see part of the customer and part of the activity.",[11,381,382,383,387],{},"The ",[18,384,386],{"href":385},"\u002Fresources\u002Fmore\u002Fstablecoin-card-and-payout-compliance-map","compliance map for card and payout programs"," breaks this split down per check if you also run cards.",[57,389,391],{"id":390},"what-do-the-us-rules-require","What do the US rules require?",[11,393,394],{},"Four rules shape most of a US checklist:",[38,396,397,409,421,433],{},[41,398,399,402,403,408],{},[34,400,401],{},"Registration."," Money services businesses file ",[18,404,407],{"href":405,"rel":406},"https:\u002F\u002Fwww.fincen.gov\u002Fmoney-services-business-msb-registration",[68],"FinCEN Form 107"," within 180 days of establishment and renew every two years. Many states add their own money transmitter licenses.",[41,410,411,414,415,420],{},[34,412,413],{},"Crypto scope."," FinCEN's ",[18,416,419],{"href":417,"rel":418},"https:\u002F\u002Fwww.fincen.gov\u002Fresources\u002Fstatutes-regulations\u002Fguidance\u002Fapplication-fincens-regulations-certain-business-models",[68],"guidance on business models involving convertible virtual currencies"," explains when accepting and transmitting stablecoins counts as money transmission.",[41,422,423,426,427,432],{},[34,424,425],{},"Suspicious activity."," An MSB files each SAR ",[18,428,431],{"href":429,"rel":430},"https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F31\u002F1022.320",[68],"no later than 30 calendar days"," after first detecting the facts, and keeps a copy with supporting documents for five years.",[41,434,435,438,439,444,445,449],{},[34,436,437],{},"Travel Rule."," ",[18,440,443],{"href":441,"rel":442},"https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F31\u002F1010.410",[68],"31 CFR 1010.410"," applies recordkeeping and travel requirements to transmittals of funds of $3,000 or more. Our guide to the ",[18,446,448],{"href":447},"\u002Fresources\u002Fmore\u002Ftravel-rule-stablecoin-off-ramps","Travel Rule on stablecoin off-ramps"," covers the data fields.",[57,451,453],{"id":452},"what-changes-in-brazil-mexico-and-the-eu","What changes in Brazil, Mexico, and the EU?",[11,455,456],{},"The pillars stay the same. The licenses and reports change.",[38,458,459,474,480],{},[41,460,461,464,465,469,470,27],{},[34,462,463],{},"Brazil."," Virtual asset service providers need Central Bank authorization under the ",[18,466,468],{"href":467},"\u002Fresources\u002Fmore\u002Fpsav-brazil-explained","PSAV regime",". Transfers to self-custody wallets of US$10,000 or more carry a COAF reporting rule, covered in our ",[18,471,473],{"href":472},"\u002Fresources\u002Fmore\u002Fbrazil-self-custody-wallet-declaration","self-custody wallet declaration guide",[41,475,476,479],{},[34,477,478],{},"Mexico."," Electronic payment fund institutions (IFPEs) are authorized by the CNBV under the Fintech Law.",[41,481,482,485,486,27],{},[34,483,484],{},"EU."," Crypto-asset service providers need MiCA authorization, and payment or e-money institutions operate under PSD2. See ",[18,487,489],{"href":488},"\u002Fresources\u002Fmore\u002Fmica-stablecoin-rules-explained","MiCA stablecoin rules",[11,491,492],{},"Each of these needs a local legal opinion. Put it on item 15.",[57,494,496],{"id":495},"worked-example-filling-in-the-owner-column","Worked example: filling in the owner column",[11,498,499],{},"Illustrative scenario. A neobank lets US users hold a dollar balance and send money to family in Mexico over SPEI, using a payout provider for the transfer.",[82,501,502,515],{},[85,503,504],{},[88,505,506,509,512],{},[91,507,508],{},"Item",[91,510,511],{},"Neobank",[91,513,514],{},"Payout provider",[104,516,517,528,539,550,561],{},[88,518,519,522,525],{},[109,520,521],{},"KYC",[109,523,524],{},"Collects data in the app, keeps the file",[109,526,527],{},"Verifies the sender before any payout",[88,529,530,533,536],{},[109,531,532],{},"Sanctions",[109,534,535],{},"Screens at signup",[109,537,538],{},"Screens each sender and recipient in the payout",[88,540,541,544,547],{},[109,542,543],{},"Monitoring",[109,545,546],{},"Watches balance and transfer patterns across the app",[109,548,549],{},"Monitors the payouts it executes",[88,551,552,555,558],{},[109,553,554],{},"Travel Rule",[109,556,557],{},"Supplies sender and recipient data",[109,559,560],{},"Carries the data with the transfer",[88,562,563,566,569],{},[109,564,565],{},"Disclosures",[109,567,568],{},"Shows rate, fees, and arrival time",[109,570,571],{},"Returns the locked quote the app displays",[11,573,574],{},"The gap that teams miss: activity the provider never sees. Peer-to-peer transfers inside the neobank's own ledger, or balance changes between users, are only visible to the neobank. Monitoring them is item 11 on your side.",[57,576,578],{"id":577},"what-are-common-compliance-mistakes","What are common compliance mistakes?",[38,580,581,584,587,590,593,596],{},[41,582,583],{},"Treating the provider's MSB registration as your own.",[41,585,586],{},"Running KYC through the provider but never writing your own risk assessment.",[41,588,589],{},"Pooling users under one company account at the provider, which is nesting.",[41,591,592],{},"Monitoring payouts but not transfers inside your own ledger.",[41,594,595],{},"Keeping alerts without written dispositions.",[41,597,598],{},"Writing the policy once and never updating it after new products or countries.",[57,600,602],{"id":601},"how-does-blindpay-fit","How does BlindPay fit?",[11,604,605],{},"BlindPay is registered with FinCEN as a money services business, and its API runs KYC and KYB, sanctions screening, and Travel Rule checks inside every payin and payout. For a neobank, that covers items 10 and 13 for BlindPay transfers and BlindPay's half of items 6 to 9, 11, 12, and 14.",[38,607,608,618,628,638],{},[41,609,610,613,614,27],{},[34,611,612],{},"Customer-level onboarding."," Each end user becomes a BlindPay customer with their own KYC, which keeps you clear of ",[18,615,617],{"href":616},"\u002Fdocs\u002Fkb\u002Fnested-payments","nesting",[41,619,620,623,624,27],{},[34,621,622],{},"Tiered KYC and limits,"," with Enhanced review for high-risk countries. See ",[18,625,627],{"href":626},"\u002Fresources\u002Fmore\u002Fneobank-kyc-kyb-onboarding-flow","neobank KYC and KYB onboarding",[41,629,630,633,634,27],{},[34,631,632],{},"Non-custodial payouts"," from customer-controlled wallets, which keeps funds under your control. The custody model you pick changes items 14 and 16, as covered in ",[18,635,637],{"href":636},"\u002Fresources\u002Fmore\u002Fwhere-neobanks-hold-customer-funds","where neobanks hold customer funds",[41,639,640,643,644,648,649,653],{},[34,641,642],{},"Published policies:"," the ",[18,645,647],{"href":646},"\u002Fdocs\u002Fkb\u002Fprohibited-activities","prohibited activities list"," and the ",[18,650,652],{"href":651},"\u002Flicenses","licenses page"," for your vendor file.",[11,655,656],{},"Items 1 to 5 and 15 to 18 remain yours.",[57,658,660],{"id":659},"what-to-do-next","What to do next",[11,662,663,664,27],{},"Copy the 20-row table into your compliance tracker and fill in the owner column with your provider before launch. Then pull BlindPay's licenses and prohibited activities list into your vendor file (item 18) and test the onboarding flow on a development instance from the ",[18,665,667],{"href":666},"\u002Fdocs\u002Fintroduction","BlindPay docs",{"title":669,"searchDepth":670,"depth":670,"links":671},"",2,[672,673,674,675,676,677,678,679,680],{"id":59,"depth":670,"text":60},{"id":76,"depth":670,"text":77},{"id":372,"depth":670,"text":373},{"id":390,"depth":670,"text":391},{"id":452,"depth":670,"text":453},{"id":495,"depth":670,"text":496},{"id":577,"depth":670,"text":578},{"id":601,"depth":670,"text":602},{"id":659,"depth":670,"text":660},"compliance","2026-10-16","A 20-item compliance checklist for neobanks on stablecoin rails: AML program, KYC, sanctions, Travel Rule, records, licensing, and evidence to keep.","md",[686,689,692,695,698],{"q":687,"a":688},"What compliance does a neobank need when it uses stablecoin rails?","The same core program as any money business, plus crypto-specific checks. That means a written AML program with a named compliance officer, KYC and KYB, sanctions screening, transaction monitoring and suspicious activity reporting, Travel Rule data on transfers, record keeping, licensing where required, consumer disclosures, and privacy. Stablecoins add wallet screening and crypto-specific rules such as MiCA or Brazil's PSAV regime.",{"q":690,"a":691},"Which compliance items can a payment provider cover for a neobank?","A provider covers its own role: screening and monitoring the transactions it processes, Travel Rule data on its transfers, and KYC or KYB on the customers it onboards. It cannot write your AML program, train your staff, own your consumer disclosures, or license your activity. Most items end up shared, so the checklist should name an owner on each side.",{"q":693,"a":694},"Does a US neobank need its own AML program if its provider is a registered MSB?","Often yes, depending on what the neobank does. If the neobank itself transmits money, holds customer funds, or is otherwise a money services business, FinCEN rules require a written, risk-based AML program with a compliance officer, training, and independent review. A provider's registration covers the provider. Confirm your own status with counsel before launch.",{"q":696,"a":697},"What records should a neobank keep for compliance audits?","Keep the written AML program and risk assessment, customer due diligence files, screening results, alerts and their resolution, suspicious activity report decisions, Travel Rule data, training logs, independent review reports, and vendor due diligence. Under US BSA rules most records are kept for five years, and a SAR copy with supporting documents is kept five years from filing.",{"q":699,"a":700},"What is nesting and why does it matter for a neobank?","Nesting is moving money through your provider account for people the provider never onboarded. Payment providers prohibit it because they lose sight of who owns the funds. For a neobank, it means every end user who sends or receives money should be onboarded as a customer at the provider, not pooled under the neobank's own account. Design your onboarding around that from day one.",false,{"author":703},"BlindPay Team",true,"\u002Fresources\u002Fmore\u002Fneobank-compliance-checklist-stablecoin-rails","---\ntitle: \"Neobank compliance checklist for stablecoin rails: 20 items, owners, and evidence\"\nseoTitle: \"Neobank compliance checklist for stablecoin rails (2026)\"\ndescription: \"A 20-item compliance checklist for neobanks on stablecoin rails: AML program, KYC, sanctions, Travel Rule, records, licensing, and evidence to keep.\"\ndate: \"2026-10-16\"\nupdated: \"2026-10-16\"\ncategory: \"compliance\"\nauthor: \"BlindPay Team\"\nfaq:\n  - q: \"What compliance does a neobank need when it uses stablecoin rails?\"\n    a: \"The same core program as any money business, plus crypto-specific checks. That means a written AML program with a named compliance officer, KYC and KYB, sanctions screening, transaction monitoring and suspicious activity reporting, Travel Rule data on transfers, record keeping, licensing where required, consumer disclosures, and privacy. Stablecoins add wallet screening and crypto-specific rules such as MiCA or Brazil's PSAV regime.\"\n  - q: \"Which compliance items can a payment provider cover for a neobank?\"\n    a: \"A provider covers its own role: screening and monitoring the transactions it processes, Travel Rule data on its transfers, and KYC or KYB on the customers it onboards. It cannot write your AML program, train your staff, own your consumer disclosures, or license your activity. Most items end up shared, so the checklist should name an owner on each side.\"\n  - q: \"Does a US neobank need its own AML program if its provider is a registered MSB?\"\n    a: \"Often yes, depending on what the neobank does. If the neobank itself transmits money, holds customer funds, or is otherwise a money services business, FinCEN rules require a written, risk-based AML program with a compliance officer, training, and independent review. A provider's registration covers the provider. Confirm your own status with counsel before launch.\"\n  - q: \"What records should a neobank keep for compliance audits?\"\n    a: \"Keep the written AML program and risk assessment, customer due diligence files, screening results, alerts and their resolution, suspicious activity report decisions, Travel Rule data, training logs, independent review reports, and vendor due diligence. Under US BSA rules most records are kept for five years, and a SAR copy with supporting documents is kept five years from filing.\"\n  - q: \"What is nesting and why does it matter for a neobank?\"\n    a: \"Nesting is moving money through your provider account for people the provider never onboarded. Payment providers prohibit it because they lose sight of who owns the funds. For a neobank, it means every end user who sends or receives money should be onboarded as a customer at the provider, not pooled under the neobank's own account. Design your onboarding around that from day one.\"\n---\n\nA neobank on stablecoin rails needs a written AML program, KYC and KYB, sanctions and wallet screening, transaction monitoring, Travel Rule data, records, licensing review, consumer disclosures, and vendor due diligence. A provider such as BlindPay covers screening and checks inside its own payment flow. The program around it, and the evidence that proves it works, stays with you.\n\nThis checklist turns those duties into 20 items, each with an owner and the evidence an examiner or partner bank will ask for. It is part of our [guide to building a neobank](\u002Fresources\u002Fmore\u002Fhow-to-build-a-neobank). For the licensing question that comes first, read [do you need a banking license](\u002Fresources\u002Fmore\u002Fdo-you-need-a-banking-license-for-a-neobank).\n\nThis is educational content, not legal advice. Rules differ by country and by what your product does, so confirm each item with counsel.\n\n**Key takeaways**\n\n- Compliance is a program, not a vendor. A provider can run checks; it can't own your policies.\n- Most items are shared. Write down who does what on each side.\n- Evidence matters as much as the control. If it isn't logged, it didn't happen.\n- Every end user who moves money should be onboarded at the provider. Pooling them is nesting.\n- Stablecoins add wallet screening, Travel Rule data, and crypto-specific licensing.\n\n## What is in a neobank compliance program?\n\nA US money services business needs a written AML program. Under [31 CFR 1022.210](https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F31\u002F1022.210), it must be commensurate with the business's risks, incorporate policies, procedures, and internal controls, designate a person for day-to-day compliance, train staff, and provide for independent review.\n\nOther countries use different words for the same pillars. Those pillars are the backbone of the checklist below.\n\n## What is on the 20-item checklist?\n\nHere is the full list. \"Both\" means you and your provider each own part of it.\n\n| # | Requirement | Owner | Evidence to keep |\n| --- | --- | --- | --- |\n| 1 | Business-wide risk assessment | You | Dated assessment, approval, update log |\n| 2 | Written AML and sanctions policy | You | Board or management approval, version history |\n| 3 | Named compliance officer | You | Appointment record, reporting line |\n| 4 | Staff training | You | Training materials, attendance, dates |\n| 5 | Independent review of the program | You | Reviewer report, findings, remediation |\n| 6 | Customer KYC at onboarding | Both | Customer files, check results, tier |\n| 7 | Business KYB and beneficial owners | Both | Formation and ownership documents, owner KYC |\n| 8 | Sanctions screening at onboarding | Both | Screening results, match decisions |\n| 9 | Ongoing rescreening | Both | Rescreen logs, list update dates |\n| 10 | Wallet screening on stablecoin transfers | Provider (in its flow) | Provider reports, your exception log |\n| 11 | Transaction monitoring rules | Both | Rule list, alerts, dispositions |\n| 12 | Suspicious activity reporting | Both | Investigation notes, file or no-file decision |\n| 13 | Travel Rule data on transfers | Provider (in its flow) | Originator and beneficiary data per transfer |\n| 14 | Record retention | Both | Retention policy, storage proof |\n| 15 | Registration and licensing review | You | Legal memo per market, registrations |\n| 16 | Consumer disclosures and complaints | You | Disclosure versions, complaint log |\n| 17 | Data privacy | You | Privacy notice, data map, processor agreements |\n| 18 | Vendor due diligence | You | Questionnaires, provider licenses, audit reports |\n| 19 | No nesting: end users onboarded at the provider | Both | Customer mapping between your ledger and the provider |\n| 20 | Audit readiness | You | Index of all the above, sample walkthroughs |\n\n## Which items does a provider cover, and which stay with you?\n\nA provider covers what happens inside the transactions it processes. You cover the program and everything your app does around it.\n\nItems 1 to 5 are always yours: risk assessment, policy, officer, training, and review. Items 10 and 13, wallet screening and Travel Rule data, usually sit with the provider for transfers it executes. Items 6 to 9, 11, 12, 14, and 19 are shared, because both sides see part of the customer and part of the activity.\n\nThe [compliance map for card and payout programs](\u002Fresources\u002Fmore\u002Fstablecoin-card-and-payout-compliance-map) breaks this split down per check if you also run cards.\n\n## What do the US rules require?\n\nFour rules shape most of a US checklist:\n\n- **Registration.** Money services businesses file [FinCEN Form 107](https:\u002F\u002Fwww.fincen.gov\u002Fmoney-services-business-msb-registration) within 180 days of establishment and renew every two years. Many states add their own money transmitter licenses.\n- **Crypto scope.** FinCEN's [guidance on business models involving convertible virtual currencies](https:\u002F\u002Fwww.fincen.gov\u002Fresources\u002Fstatutes-regulations\u002Fguidance\u002Fapplication-fincens-regulations-certain-business-models) explains when accepting and transmitting stablecoins counts as money transmission.\n- **Suspicious activity.** An MSB files each SAR [no later than 30 calendar days](https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F31\u002F1022.320) after first detecting the facts, and keeps a copy with supporting documents for five years.\n- **Travel Rule.** [31 CFR 1010.410](https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F31\u002F1010.410) applies recordkeeping and travel requirements to transmittals of funds of $3,000 or more. Our guide to the [Travel Rule on stablecoin off-ramps](\u002Fresources\u002Fmore\u002Ftravel-rule-stablecoin-off-ramps) covers the data fields.\n\n## What changes in Brazil, Mexico, and the EU?\n\nThe pillars stay the same. The licenses and reports change.\n\n- **Brazil.** Virtual asset service providers need Central Bank authorization under the [PSAV regime](\u002Fresources\u002Fmore\u002Fpsav-brazil-explained). Transfers to self-custody wallets of US$10,000 or more carry a COAF reporting rule, covered in our [self-custody wallet declaration guide](\u002Fresources\u002Fmore\u002Fbrazil-self-custody-wallet-declaration).\n- **Mexico.** Electronic payment fund institutions (IFPEs) are authorized by the CNBV under the Fintech Law.\n- **EU.** Crypto-asset service providers need MiCA authorization, and payment or e-money institutions operate under PSD2. See [MiCA stablecoin rules](\u002Fresources\u002Fmore\u002Fmica-stablecoin-rules-explained).\n\nEach of these needs a local legal opinion. Put it on item 15.\n\n## Worked example: filling in the owner column\n\nIllustrative scenario. A neobank lets US users hold a dollar balance and send money to family in Mexico over SPEI, using a payout provider for the transfer.\n\n| Item | Neobank | Payout provider |\n| --- | --- | --- |\n| KYC | Collects data in the app, keeps the file | Verifies the sender before any payout |\n| Sanctions | Screens at signup | Screens each sender and recipient in the payout |\n| Monitoring | Watches balance and transfer patterns across the app | Monitors the payouts it executes |\n| Travel Rule | Supplies sender and recipient data | Carries the data with the transfer |\n| Disclosures | Shows rate, fees, and arrival time | Returns the locked quote the app displays |\n\nThe gap that teams miss: activity the provider never sees. Peer-to-peer transfers inside the neobank's own ledger, or balance changes between users, are only visible to the neobank. Monitoring them is item 11 on your side.\n\n## What are common compliance mistakes?\n\n- Treating the provider's MSB registration as your own.\n- Running KYC through the provider but never writing your own risk assessment.\n- Pooling users under one company account at the provider, which is nesting.\n- Monitoring payouts but not transfers inside your own ledger.\n- Keeping alerts without written dispositions.\n- Writing the policy once and never updating it after new products or countries.\n\n## How does BlindPay fit?\n\nBlindPay is registered with FinCEN as a money services business, and its API runs KYC and KYB, sanctions screening, and Travel Rule checks inside every payin and payout. For a neobank, that covers items 10 and 13 for BlindPay transfers and BlindPay's half of items 6 to 9, 11, 12, and 14.\n\n- **Customer-level onboarding.** Each end user becomes a BlindPay customer with their own KYC, which keeps you clear of [nesting](\u002Fdocs\u002Fkb\u002Fnested-payments).\n- **Tiered KYC and limits,** with Enhanced review for high-risk countries. See [neobank KYC and KYB onboarding](\u002Fresources\u002Fmore\u002Fneobank-kyc-kyb-onboarding-flow).\n- **Non-custodial payouts** from customer-controlled wallets, which keeps funds under your control. The custody model you pick changes items 14 and 16, as covered in [where neobanks hold customer funds](\u002Fresources\u002Fmore\u002Fwhere-neobanks-hold-customer-funds).\n- **Published policies:** the [prohibited activities list](\u002Fdocs\u002Fkb\u002Fprohibited-activities) and the [licenses page](\u002Flicenses) for your vendor file.\n\nItems 1 to 5 and 15 to 18 remain yours.\n\n## What to do next\n\nCopy the 20-row table into your compliance tracker and fill in the owner column with your provider before launch. Then pull BlindPay's licenses and prohibited activities list into your vendor file (item 18) and test the onboarding flow on a development instance from the [BlindPay docs](\u002Fdocs\u002Fintroduction).\n",{"title":5,"description":683},"Neobank compliance checklist for stablecoin rails (2026)","resources\u002Fmore\u002Fneobank-compliance-checklist-stablecoin-rails","82Ub9EgaEiWe6-WBsMpzl5wbVM-CYVf0y0ZM3pCqN44",[712,716,720,724,728,732,736,739,743,747,751,755,759,763,767,771,774,778,782,786,790,794,798,802,806,809,812,813,817,820,824,828,831,835,839,843,847,851,855,859,863,867,871,875,879,883,887,891,895,898,902,905,909,913],{"path":713,"title":714,"description":715},"\u002Fresources\u002Fmore\u002Faml-audit-readiness-risk-monitoring","AML audit readiness: what regulators ask for and how to prove your risk monitoring works","The evidence examiners expect from automated risk monitoring: a 10-item evidence table, good vs poor practice, SAR timelines, RFIs, and a 30-day plan.",{"path":717,"title":718,"description":719},"\u002Fresources\u002Fmore\u002Fneobank-remittance-feature-us-rules","Adding remittances to a US neobank: the Remittance Transfer Rule, disclosures, and pricing","How to add a low-fee remittance feature to a US neobank: when the Remittance Transfer Rule applies, disclosures, 30-minute cancellation, and pricing.",{"path":721,"title":722,"description":723},"\u002Fresources\u002Fmore\u002Fare-blockchain-payments-legal","Are blockchain payments legal? Rules in the US, EU, UK, Brazil, and Mexico","Blockchain payments are legal for businesses in the US, EU, UK, Brazil, and Mexico, under different rules. What each country regulates, as of October 2026.",{"path":725,"title":726,"description":727},"\u002Fresources\u002Fmore\u002Fare-stablecoin-card-purchases-taxable","Are stablecoin card purchases taxable? A country-by-country overview of disposals, gains, and records","Why a stablecoin card purchase can be a taxable disposal, how the US, UK, Germany, Spain, the Netherlands, and Brazil differ, and which records to keep.",{"path":729,"title":730,"description":731},"\u002Fresources\u002Fmore\u002Fare-stablecoin-payments-reversible","Are stablecoin payments reversible? Finality, custody, and fraud explained","Stablecoin transfers settle final in minutes and cannot be reversed. That finality proves custody at every step, but it also opens a fraud gap on the fiat side of the payment.",{"path":733,"title":734,"description":735},"\u002Fresources\u002Fmore\u002Fautomated-kyc-kyb-vs-manual-onboarding","Automated KYC\u002FKYB vs. manual onboarding: what actually changes","A side-by-side comparison of automated and manual KYC\u002FKYB for fintechs: onboarding time, false-positive rates, cost per verification, scaling across jurisdictions, and audit-trail quality, plus the cases where a human reviewer is still required.",{"path":472,"title":737,"description":738},"Brazil's self-custody wallet rule: COAF reporting for transfers of US$10,000 or more","Since October 1, 2026, Brazil requires reports to COAF on transfers of US$10,000+ to or from self-custodied wallets. What counts, who reports, what to do.",{"path":740,"title":741,"description":742},"\u002Fresources\u002Fmore\u002Fbuild-vs-buy-automated-risk-monitoring","Build vs. buy automated risk monitoring: a decision framework and 15 provider questions","Build, buy point solutions, or use an integrated provider? Compare three ways to run automated risk monitoring, who stays responsible, and 15 questions.",{"path":744,"title":745,"description":746},"\u002Fresources\u002Fmore\u002Fcompliance-agents-cross-border-stablecoin-payments","Compliance agents for cross-border stablecoin payments: a global regulatory guide","How compliance agents apply FinCEN, MiCA, FCA, MAS, and Banco Central do Brasil rules to cross-border stablecoin payments: jurisdiction table, the FATF Travel Rule, multi-list sanctions screening, the four components of a compliant program, and questions to ask a compliance provider.",{"path":748,"title":749,"description":750},"\u002Fresources\u002Fmore\u002Fcross-border-stablecoin-card-compliance-by-country","Compliance for cross-border stablecoin card programs: a country readiness template","A country readiness template for stablecoin card programs: onboarding rules, funding rails, and payout rails for the US, LatAm, and the EU.",{"path":752,"title":753,"description":754},"\u002Fresources\u002Fmore\u002Fcross-border-stablecoin-payments-risk-register","Cross-border stablecoin payments risk register: a fill-in template with 16 risks, scores, and owners","A copyable risk register for cross-border stablecoin payouts: 16 risks across six categories, a 5x5 scoring method, controls, indicators, and owners.",{"path":756,"title":757,"description":758},"\u002Fresources\u002Fmore\u002Fcrypto-wallet-compliance-checklist","Crypto wallet compliance checklist: KYC, KYT, and Travel Rule","The compliance that comes with crypto wallets and stablecoin payments: KYC and KYB, KYT, the Travel Rule, address screening, MSB rules, and 15 checks.",{"path":760,"title":761,"description":762},"\u002Fresources\u002Fmore\u002Fdirect-vs-indirect-stablecoin-exchange","Direct vs indirect stablecoin exchange: who holds the stablecoin, and who carries compliance","In direct exchange, both parties hold stablecoins and own compliance. In indirect exchange, a provider settles in stablecoins behind a normal bank payment.",{"path":764,"title":765,"description":766},"\u002Fresources\u002Fmore\u002Fdo-merchants-need-a-license-to-accept-stablecoins","Do merchants need a license to accept stablecoin payments? KYC, KYB, and compliance explained","Usually no: the license sits with the provider that moves the funds. What merchants still owe on KYB, sanctions, tax, and records in the US, EU, Brazil.",{"path":768,"title":769,"description":770},"\u002Fresources\u002Fmore\u002Fdo-stablecoin-cards-require-kyc","Do stablecoin cards require KYC? What to expect, what gets checked, and why \"no KYC\" cards fall short","Why stablecoin cards ask for ID even with a permissionless wallet, what KYC and KYB collect, why no-KYC cards fall short, and how to fix a rejection.",{"path":25,"title":772,"description":773},"Do you need a banking license to launch a neobank? Four routes compared","Most neobanks launch without a bank charter. Compare the four routes, from own charter to embedded providers, in the US, Brazil, Mexico, and the EU.",{"path":775,"title":776,"description":777},"\u002Fresources\u002Fmore\u002Fgenius-act-timeline-key-dates","GENIUS Act and MiCA timeline: the key dates for stablecoin payment teams","Every GENIUS Act and MiCA date that matters to a stablecoin payment flow, how the US effective date is calculated, and what to finish before each deadline.",{"path":779,"title":780,"description":781},"\u002Fresources\u002Fmore\u002Fhow-to-automate-kyc-kyb-stablecoin-payments","How to automate KYC and KYB for stablecoin payments","A developer guide to automated KYC and KYB for stablecoin payment flows: how verification runs inside a payment API, step-by-step workflows for individuals and businesses, jurisdiction requirements for the US, EU, UK, Singapore, and Brazil, and what to check before settlement.",{"path":783,"title":784,"description":785},"\u002Fresources\u002Fmore\u002Fhow-to-choose-automated-risk-monitoring-vendor","How to choose an automated risk monitoring vendor for a fintech startup","A buyer's guide to automated risk monitoring vendors for early-stage fintechs: the five criteria that matter (regulatory coverage, integration effort, false-positive rate, pricing model, audit output), the question to ask a vendor on each, a checklist table, and what it costs.",{"path":787,"title":788,"description":789},"\u002Fresources\u002Fmore\u002Freduce-false-positives-transaction-monitoring","How to reduce false positives in transaction monitoring without missing real risk","Cut AML alert noise without losing real cases: a 7-step tuning process, the levers that work, the metrics to watch, and what automation should never close.",{"path":791,"title":792,"description":793},"\u002Fresources\u002Fmore\u002Fhow-to-verify-non-custodial-payment-provider","How to verify a payment provider is really non-custodial: 8 checks you can run yourself","Eight checks that prove whether a blockchain payment provider ever holds your funds: on-chain approvals, stored balances, terms of title, failure tests.",{"path":795,"title":796,"description":797},"\u002Fresources\u002Fmore\u002Fhow-wallet-screening-works-stablecoin-payments","How wallet screening works in stablecoin payments: exposure, risk scores, and frozen addresses","How wallet screening works: OFAC-listed addresses, direct and indirect exposure, risk scores, issuer freezes, and what to do when an address is flagged.",{"path":799,"title":800,"description":801},"\u002Fresources\u002Fmore\u002Fkyc-vs-kyb-vs-kyt","KYC vs KYB vs KYT: what each check covers in blockchain payments","KYC verifies people, KYB verifies businesses and their owners, and KYT watches transactions and wallets. What each covers, when it runs, and who owns it.",{"path":803,"title":804,"description":805},"\u002Fresources\u002Fmore\u002Fstablecoin-payment-licenses-msb-mtl-vasp-emi","MSB vs money transmitter license vs VASP vs EMI: which license does a stablecoin payment flow need?","MSB registration, state money transmitter licenses, VASP, EMI, and PSAV compared: who needs each, what triggers it, and when your provider covers you.",{"path":488,"title":807,"description":808},"MiCA stablecoin rules explained for payment companies","What MiCA means if your business uses stablecoins in the EU: EMTs vs ARTs, issuer requirements, why USDC is compliant and USDT was delisted, and a practical checklist.",{"path":626,"title":810,"description":811},"Neobank KYC and KYB onboarding: screen order, tiered limits, and fewer drop-offs","How to design neobank KYC and KYB onboarding: screen order, which checks run when, tiered limits, rejections, RFIs, and what to log for audits.",{"path":705,"title":5,"description":683},{"path":814,"title":815,"description":816},"\u002Fresources\u002Fmore\u002Fongoing-sanctions-screening-how-often-to-rescreen","Ongoing sanctions screening: how often to rescreen and what to screen","How often to rescreen customers against sanctions lists, what to screen beyond names, and a cadence that holds up under OFAC strict liability.",{"path":467,"title":818,"description":819},"PSAV in Brazil: the Central Bank's virtual asset license explained","PSAV is Brazil's authorization for virtual asset service providers, created by BCB Resolutions 519, 520, and 521 under Law 14.478\u002F2022. What it requires and who needs it.",{"path":821,"title":822,"description":823},"\u002Fresources\u002Fmore\u002Freal-time-transaction-monitoring-stablecoin-payments","Real-time transaction monitoring for cross-border stablecoin payments","Why stablecoin cross-border flows need different monitoring than wires: the signals that get scored (wallet address risk, velocity, corridor risk, on\u002Foff-ramp counterparties), real-time vs. batch monitoring, and a worked example of a flagged pattern from alert to decision.",{"path":825,"title":826,"description":827},"\u002Fresources\u002Fmore\u002Fblockchain-payment-provider-red-flags","Red flags when choosing a blockchain payments provider: 10 warning signs and what to ask","Ten warning signs to catch before you sign with a blockchain payments provider, how each shows up in a sales call or sandbox, and the question to ask.",{"path":385,"title":829,"description":830},"Stablecoin card and payout compliance map: who owns KYC, KYB, sanctions, and the Travel Rule","A compliance map for programs that run stablecoin cards and payouts together: KYC, KYB, monitoring, sanctions, Travel Rule, and records, split by owner.",{"path":832,"title":833,"description":834},"\u002Fresources\u002Fmore\u002Fstablecoin-card-issuing-compliance","Stablecoin card issuing compliance: KYC, KYB, and regulatory coverage explained","What compliance stablecoin card issuing requires: KYC vs. KYB, who is responsible for what, how rules differ in the US, EU, UK, and Latin America, and ongoing monitoring.",{"path":836,"title":837,"description":838},"\u002Fresources\u002Fmore\u002Fstablecoin-cards-europe-mica","Stablecoin cards in Europe: MiCA, euro stablecoins, and what licensing means for cardholders and card programs","How MiCA applies to stablecoin cards in Europe: who needs authorization, how to check a provider on the ESMA register, euro vs dollar stablecoins, SEPA.",{"path":840,"title":841,"description":842},"\u002Fresources\u002Fmore\u002Fstablecoin-cards-united-states-regulation","Stablecoin cards in the United States: the GENIUS Act, sponsor banks, and Visa USDC settlement","How US stablecoin cards are structured and regulated: sponsor bank, program manager, processor, the GENIUS Act, Visa USDC settlement, FDIC coverage, tax.",{"path":844,"title":845,"description":846},"\u002Fresources\u002Fmore\u002Fstablecoin-off-ramp-limits","Stablecoin off-ramp limits: per-transaction, daily, and monthly caps explained","Why off-ramps cap how much you can convert per transaction, day, and month, how the caps map to KYC and KYB tiers, and the documents that raise them.",{"path":848,"title":849,"description":850},"\u002Fresources\u002Fmore\u002Fstablecoin-regulation-tracker-2026","Stablecoin regulation in 2026: MiCA, the GENIUS Act, Brazil, and Japan","Where stablecoin regulation stands in 2026: MiCA in the EU, the GENIUS Act in the US, Brazil's VASP regime, and Japan's issuer rules, compared for payment businesses.",{"path":852,"title":853,"description":854},"\u002Fresources\u002Fmore\u002Fstablecoin-regulation-uk-singapore-hong-kong","Stablecoin regulation in the UK, Singapore, and Hong Kong: where each regime stands in 2026","UK rules start 25 October 2027, Singapore is consulting on its stablecoin law, and Hong Kong licensed its first issuers in April 2026.",{"path":856,"title":857,"description":858},"\u002Fresources\u002Fmore\u002Fgenius-act-for-businesses","The GENIUS Act explained for businesses that use stablecoins","What the GENIUS Act means if your business sends, receives, or holds stablecoins: who it regulates, the dates that matter, and what to do before 2027.",{"path":860,"title":861,"description":862},"\u002Fresources\u002Fmore\u002Ftravel-rule-workflow-hold-return-reject","The Travel Rule in an automated workflow: what to collect, when to hold, when to return","How to automate Travel Rule compliance for stablecoin transfers: what data to collect, the checks before release, and when to hold, reject, or return.",{"path":864,"title":865,"description":866},"\u002Fresources\u002Fmore\u002Ftransaction-monitoring-red-flags-stablecoin-payments","Transaction monitoring red flags for stablecoin payments: 12 rules to automate","The 12 red flags automated transaction monitoring should catch in stablecoin and cross-border payments, with rule logic, actions, and the data each needs.",{"path":868,"title":869,"description":870},"\u002Fresources\u002Fmore\u002Fverification-of-payee-instant-payments","Verification of payee in instant payments: how rails check the recipient before money moves","How EU Verification of Payee, UK Confirmation of Payee, Pix, SPEI, and US payee name checks confirm the recipient before an instant payment becomes final.",{"path":872,"title":873,"description":874},"\u002Fresources\u002Fmore\u002Fvirtual-account-requirements-kyc-kyb","Virtual account requirements: KYC, KYB, and what the bank reviews before it says yes","What you need to open a virtual account: KYC or KYB, the extra fields and source of funds documents the bank reviews, who owns each step, and timelines.",{"path":876,"title":877,"description":878},"\u002Fresources\u002Fmore\u002Fwhat-are-compliance-agents-in-fintech","What are compliance agents in fintech? How they work and what they do for payments","Compliance agents are autonomous software components that run KYC, KYB, sanctions screening, and transaction monitoring inside a payment flow, then document every decision. How they work, what they do for payments, how they differ from traditional compliance software, and how BlindPay embeds them in its API.",{"path":880,"title":881,"description":882},"\u002Fresources\u002Fmore\u002Fwhat-happens-if-a-stablecoin-payment-provider-fails","What happens to your money if a stablecoin payment provider fails?","Issuer, provider, or bank: who fails decides what you get back. What the GENIUS Act and state law protect, where money sits mid-payment, and a runbook.",{"path":884,"title":885,"description":886},"\u002Fresources\u002Fmore\u002Fwhat-is-kyb","What is KYB? Know Your Business verification explained","KYB verifies a company's legal existence, ownership, and control before it can transact. What it checks, who counts as a beneficial owner, and how it differs from KYC.",{"path":888,"title":889,"description":890},"\u002Fresources\u002Fmore\u002Fwhat-is-a-vasp","What is a VASP? Virtual asset service provider explained","A VASP is any business that exchanges, transfers, or custodies virtual assets like stablecoins for customers. FATF's definition and what it requires in practice.",{"path":892,"title":893,"description":894},"\u002Fresources\u002Fmore\u002Fwhat-is-automated-risk-monitoring-fintech","What is automated risk monitoring in fintech?","A reference explainer on automated risk monitoring for fintechs: the four components (KYC\u002FKYB, transaction monitoring, sanctions and watchlist screening, compliance automation), what each one flags, a manual vs. automated comparison, and what FinCEN, FATF, and OFAC actually require.",{"path":447,"title":896,"description":897},"What is the travel rule for stablecoin off-ramps? Thresholds, data, and failed checks","The travel rule makes off-ramps pass sender and receiver data with transfers. Thresholds by country, required data, and what happens when checks fail.",{"path":899,"title":900,"description":901},"\u002Fresources\u002Fmore\u002Fgenius-act-usdt-foreign-stablecoin-issuers","What the GENIUS Act means for USDT and other foreign-issued stablecoins","Can USDT stay available in the US under the GENIUS Act? The foreign issuer path, the 2027 and 2028 deadlines, and what payment companies should ask now.",{"path":636,"title":903,"description":904},"Where does a neobank hold customer funds? FBO accounts, custodial wallets, and non-custodial flows","Pooled FBO bank accounts, custodial stablecoin wallets, or customer-controlled wallets: who holds the money, who reconciles it, and what fails.",{"path":906,"title":907,"description":908},"\u002Fresources\u002Fmore\u002Fcrypto-on-ramp-compliance-who-owns-what","Who owns compliance when you integrate a crypto on-ramp API? KYC, KYB, KYT, and holds","An on-ramp API splits compliance between the provider and you. Who runs KYC, KYB, KYT, sanctions, and the travel rule, and what stays on your side.",{"path":910,"title":911,"description":912},"\u002Fresources\u002Fmore\u002Fcross-border-payout-rfi-how-to-answer","Why did my cross-border payout get an RFI? What compliance asks, and how to answer fast","A request for information pauses a customer or holds a payout until compliance gets answers. The three RFI types, their deadlines, and how to answer.",{"path":914,"title":915,"description":916},"\u002Fresources\u002Fmore\u002Fsource-of-funds-crypto-off-ramps","Why do crypto off-ramps ask for source of funds? Documents, triggers, and on-chain proof","Why off-ramps ask where your stablecoins came from, how source of funds differs from source of wealth, what triggers a request, and which documents pass.",1793136749231]