Cross-border acquiring: How do regulators and banks "see" you?

Cross-border acquiring has three lifelines: fund flow, information flow and currency flow. Each lifeline has its own compliance requirements, which together constitute the compliance framework for cross-border acquiring business.

（1）Fund Flow

Whether the source, purpose and path of funds are clear and traceable has become the core standard for judging compliance. Article 6 of the Anti-Money Laundering Law of the People's Republic of China clearly requires financial institutions and certain non-financial institutions to establish internal control systems for anti-money laundering and to fulfill anti-money laundering obligations such as customer due diligence, preservation of customer identity information and transaction records, reporting of large and suspicious transactions, and special anti-money laundering prevention measures. The purpose of these systems is to ensure that every transaction is "traceable". Many risks do not stem from the amount of money involved, but from the inability to explain why the funds are transferred abroad. If relevant personnel or platforms cannot explain why the funds are transferred abroad, or if the flow of funds does not correspond to real trade or services, it is very easy to be identified as illegal cross-border fund transfer and trigger an anti-money laundering investigation. The company should ensure that every incoming, cleared, settled, and outgoing fund can answer three questions: who the funds come from, who the funds are ultimately given to, and why the funds are transferred in this way. (2) Information Flow Information flow is another line closely corresponding to the flow of funds. This refers to non-financial information accompanying transactions, including the identities of both parties, the nature of the transaction, descriptions of goods or services, and the timeframe. In scenarios with relatively high criminal risks, such as cross-border acquiring, information leakage control is often a significant contributing factor to risk spillover. This is especially true when internal company personnel leak information, leading to regulatory scrutiny and even criminal charges. Employees are key nodes in the information flow, having access to highly sensitive information such as merchant transaction data and fund settlement paths. Therefore, having employees sign comprehensive and enforceable confidentiality agreements is a crucial component of information flow compliance. Confidentiality agreements should clearly define the specific scope of protected information, such as merchant identity information, transaction and settlement data, payment system architecture, and cross-border data flow information, and clearly and specifically stipulate prohibited behaviors for employees, avoiding vague statements. Furthermore, confidentiality agreements alone are insufficient; reasonable job authority settings, internal processes, and dispute resolution mechanisms should also be implemented to reduce information compliance risks arising from labor disputes. At the technology outsourcing level, you must firmly remember: technology outsourcing is not the same as responsibility outsourcing. Whether it's system development, cloud services, or risk control support, as long as a third party has access to transaction or customer information, the institution engaged in cross-border acquiring business remains the primary responsible party for compliance. Therefore, contracts involving external technologies should clearly define data boundaries and prevent third parties from directly controlling the complete information flow through methods such as desensitization, encryption, and permission isolation. (3) Currency Flow Currency flow is also a line of high regulatory attention. From a compliance perspective, the core of currency flow management lies in clear paths, well-defined nodes, and explainable logic. Where virtual currencies come from, through which addresses or platforms they circulate, and where they are exchanged or settled—every key node should be able to be reconstructed and explained. Any attempt to weaken traceability through multi-layered address splitting, frequent conversions, or complex structural designs, or to "circumvent regulation" through design, will be considered a high-risk behavior and will attract significant regulatory attention. Once the currency flow path is designed to be overly complex and does not match the actual business logic, it is often suspected of being intended to circumvent regulations, thereby amplifying the overall compliance risk. From the perspective of regulators and banks, cross-border acquiring is not a matter of "looking at the technology," but rather a matter of consistency and reproducibility. Many practitioners mistakenly believe that cross-border acquiring occurs overseas and that regulations can be circumvented through VPNs or cloud servers, which is a very dangerous misconception. Regardless of where the business takes place, as long as funds pass through domestic systems, information is stored domestically, or transactions involve domestic entities, it falls within the scope of regulatory attention. The flow of funds, information, and currency must be consistent to truly form a complete compliance defense. The core of compliance work in cross-border acquiring is not "hiding," but "aligning."