Cross-border payments are regulated at every hop, by different authorities, under different regimes. Businesses reasonably conclude they need to understand all of it, which is neither achievable nor necessary.
What is achievable is being able to answer four questions about any provider you use, and to recognise when the answer should worry you.
1. Under what authorisation does this provider operate?
Every entity that moves money for others does so under some registration, authorisation or licence, granted by a named authority, with a scope.
Three things are worth separating, because providers sometimes blur them:
Registration means an entity has met a legal requirement to be recorded with an authority and is subject to its supervision — typically for anti-money- laundering purposes. It is a legal obligation fulfilled. It is not an endorsement, and it is not a licence to do everything.
Authorisation or licensing means an authority has assessed the entity against prudential and conduct requirements and permitted it to carry on a specified activity. The permitted activities are defined and public.
Passporting or partnership means an entity relies on someone else's permission — operating through a licensed partner, or under a regional regime. This is common and legitimate, and it means the entity you contract with and the entity holding the permission may not be the same.
The question to ask is not "are you regulated" — everyone says yes. It is which entity, under which authority, with which reference number, for which activities. All four are matters of public record and any provider should state them without hesitation.
2. Where do the funds sit, and what happens if the provider fails?
Different regimes handle this differently, and the differences matter most in the scenario nobody plans for.
Ask: which entity holds the funds, in what kind of arrangement, and what is the position if that entity becomes insolvent? Are funds held separately from the provider's own money, and are they covered by any protection scheme — noting that deposit protection schemes generally apply to banks and not to other kinds of provider.
Answers vary legitimately. What should concern you is vagueness, a description that changes depending on whom you ask, or a provider that reaches for the language of deposit protection without saying which scheme, which entity and which limit.
3. What data travels with the payment?
Since the Financial Action Task Force's recommendations were implemented into regional law, payments carry mandatory originator and beneficiary information — the "travel rule" in most descriptions of it. The details vary by region; the principle does not.
The practical consequence is that incomplete party data is now a reason a payment stops. Not a formatting inconvenience — a hold, a request for information, and a delay measured in days.
For a business, this is mostly about hygiene: complete and correctly formatted party details, a payment purpose that matches the underlying transaction, and references that let the receiving institution understand what it is looking at.
4. What is screened, and against what?
Every payment is screened against sanctions lists, and the screening looks through to beneficial ownership rather than stopping at the named counterparty.
Two consequences businesses underestimate:
Sanctions regimes apply extraterritorially. A payment in USD is generally within scope of US sanctions programmes regardless of where the parties are. Currency choice carries regulatory consequences, not just cost.
Screening is continuous. A counterparty that cleared at onboarding may not clear next quarter. Ongoing screening of your own customer base is what stops you being the last to know.
What this means operationally
Most of the burden that lands on a business is administrative rather than legal:
- Keep KYC current rather than waiting to be asked.
- Give complete, correctly formatted party details on every payment.
- State a payment purpose that matches the underlying transaction.
- Screen your own counterparties.
- Tell your provider before your pattern changes — new markets, new products, a step change in volume. See why business accounts get frozen.
- Keep evidence for what you claimed at onboarding, because you will be asked to substantiate it later.
None of this is exotic and none requires a compliance department. It requires the documents being current and somebody owning the relationship.
How this works with 2PayApp
2PAYAPP LIMITED is incorporated in British Columbia, Canada and registered with FINTRAC — the Financial Transactions and Reports Analysis Centre of Canada — as a Money Services Business under registration number M23468538. The current registration status can be verified through the official FINTRAC Money Services Business Registry.
FINTRAC registration is a legal registration requirement; it is not a banking licence and does not constitute an endorsement by FINTRAC. 2PayApp is not a bank. Depending on the service, regulated financial institutions and payment providers may be involved in providing account details, holding funds or executing payments. Full legal entity details are on the company and regulatory information page, and how funds are handled is set out under compliance and safeguarding.
Accounts, currencies, payment rails, account details, virtual IBANs, transaction limits and acquiring settlement capabilities are subject to onboarding, compliance approval, provider availability and the customer's approved account configuration.
This article is general information about how payment regulation works. It is not legal advice, and it does not describe the regulatory position of any provider other than as stated above.
FAQ
Is a registered provider the same as a licensed one? No. Registration records an entity with an authority and brings it under supervision. Authorisation permits specified activities after an assessment. Ask which one applies, and to which entity.
Does my money have deposit protection? Deposit protection schemes generally apply to banks. Ask any provider which entity holds the funds, under what arrangement, and what protection — if any — applies.
Why do payments get held for information? Most often incomplete party data, a purpose that does not match the transaction, or a screening match requiring review.
Does the currency I pay in have regulatory consequences? Yes. USD payments are generally within scope of US sanctions programmes wherever the parties are located.