Third-Party Payment Processors — BSA/AML Manual

A third-party payment processor is a business that accepts, transmits, settles, or facilitates payments on behalf of merchants, customers, platforms, or other businesses. Depending on its activities and relationships, it may face Bank Secrecy Act, anti-money laundering, sanctions, and state money transmitter obligations. Its compliance program should reflect its products, transaction flows, customer base, and partner-bank requirements.

A BSA/AML manual documents how the processor identifies, assesses, monitors, and manages financial crime risk. It should define roles, risk assessments, customer due diligence, transaction monitoring, suspicious activity escalation, sanctions screening, training, recordkeeping, and independent review. A well-structured manual creates consistent operational expectations and provides bank partners, auditors, and examiners evidence of a governed compliance framework.

The manual should include risk-based policies and procedures for governance, designated compliance ownership, customer and merchant onboarding, KYC/KYB, beneficial ownership, transaction monitoring, sanctions screening, suspicious activity investigations, SAR decisioning, record retention, training, independent testing, and program updates. It should also reflect the processor’s specific payment rails, geographies, products, transaction volumes, and third-party relationships.

Review the manual at least annually and whenever material changes occur. Triggering changes can include new payment products, new markets, significant transaction-volume growth, a sponsor-bank requirement, revised monitoring tools, new risk findings, or regulatory developments. The review should confirm that written procedures still match actual operations and that ownership, escalation paths, and controls remain effective.

The enterprise or BSA/AML risk assessment provides the rationale for the manual’s controls. It evaluates risks associated with customers, merchants, products, services, delivery channels, geographies, transaction activity, and partners. The manual should then explain how those risks are mitigated through due diligence, monitoring, screening, escalation, approvals, and periodic review rather than relying on one-size-fits-all procedures.

Transaction monitoring helps identify activity that may be inconsistent with an expected customer or merchant profile, indicate fraud or money laundering, or require investigation. Effective programs establish documented scenarios, thresholds, alert review procedures, evidence standards, escalation routes, and quality controls. Monitoring should be calibrated to the processor’s payment flows so teams can prioritize meaningful alerts without creating unmanageable false positives.

A processor’s SAR responsibilities depend on its legal status, regulatory obligations, and relationship with its sponsor bank or financial institution. Regardless, the BSA/AML manual should define how potentially suspicious activity is identified, investigated, documented, escalated, and communicated to the responsible filing entity. Clear decisioning and thorough case records support timely, consistent reporting and defensible outcomes.

A template can provide a starting structure, but it rarely addresses a processor’s specific products, customer types, transaction patterns, geographic exposure, partner requirements, and operational capabilities. A manual should accurately describe what the organization actually does and how controls work in practice. Customizing procedures to the risk assessment makes implementation more realistic and demonstrates meaningful program governance.