Cross-border banking refers to financial services and transactions between individuals, businesses, or financial institutions in different countries.
According to the Bank for International Settlements (BIS), the global cross-border payments market was estimated at over $190 trillion and could grow to more than $300 trillion over the coming five to ten years.
As cross-border activity grows, you must navigate different regulatory requirements, payment rules, data-sharing restrictions, and fraud and compliance obligations throughout multiple jurisdictions.
In this article, we will explore the main cross-border banking regulatory challenges and ways to address them.
Banks need to account for differences in fraud classification, liability, reimbursement, reporting deadlines, privacy requirements, and payment-rail rules when a case spans multiple jurisdictions.
Banks should share only the intelligence needed to prevent fraud and mule account activity, in line with local laws. Privacy-enhancing technologies limit what each bank can see, while legal requirements and agreed rules determine what information can be shared.
Assessing previous recipient activity, fraud reports, account connections, and movement of received funds can help banks identify mule accounts and suspicious networks that may not be apparent from a single transaction.
Acoru combines Continuous Account Intelligence, recipient risk assessment, dynamic account classification, and privacy-preserving consortium sharing to help institutions identify fraud and mule risk across their own accounts, external recipients, and broader account networks.
Cross-border banking regulatory challenges arise when a payment or customer activity falls under the rules of more than one country or regulatory framework. Banks may need to follow different requirements based on:
This becomes especially difficult for banks managing fraud and determining liability because jurisdictions can define unauthorized and authorized payments, reporting deadlines, customer protections, and reimbursement rules differently.
The UK, EU, and US apply different rules to payments and payment fraud. Some govern specific domestic payment systems, while others also cover cross-border transfers. The table below explains the main frameworks and where they apply.
|
Market |
Main framework |
Cross-border rules and developments |
|
UK |
The Payment Systems Regulator's PS23/4 policy, consolidated in PS25/5, sets APP scam reimbursement requirements for eligible payments through the UK's Faster Payments and CHAPS systems. |
International payments are excluded from the APP reimbursement scheme, though other payment protections may still apply. The UK’s funds transfer information requirements, part of its wider anti-money-laundering framework, implement FATF Recommendation 16. |
|
EU |
PSD2 covers payment authentication and customer protections, while the Instant Payments Regulation governs euro instant payments. SEPA is cross-border by law but works like a domestic market, governed by EU legislation and common EPC rulebooks. |
FATF Recommendation 16 is applied through the EU Transfer of Funds Regulation. PSD3 and the new Payment Services Regulation (PSR) have been politically agreed and are in the final stages of adoption. They will add further fraud-prevention and liability requirements. |
|
US |
The Electronic Fund Transfer Act and Regulation E provide consumer electronic payment protections. Nacha Operating Rules govern domestic ACH payments and the US ACH leg of international transactions. |
The Remittance Transfer Rule (Regulation E, Subpart B, 12 CFR §§ 1005.30–1005.36) covers international consumer remittances. Separately, the Bank Secrecy Act Travel Rule (31 CFR § 1010.410(f)) requires sender and recipient information to accompany qualifying funds transfers, domestic and international, in line with FATF Recommendation 16. |
The SEPA Regulation applies directly and uniformly across the EU, but it sets the technical and business rules for euro credit transfers and direct debits, not everything that governs a payment. Customers’ refund and liability rights come from PSD2, which each Member State transposes into national law, and national authorities supervise and enforce the rules.
Switzerland, though part of SEPA, is not bound by the Regulation and applies its own law. The Payment Services Regulation would move PSD2’s rules on customer rights and liability into a directly applicable regulation, leaving less room for national differences.
Under the November 2025 provisional agreement, payment service providers would have to share fraud-related information, verify that a payee’s name matches the IBAN, and refund customers in defined impersonation scam cases. The package is not yet adopted, and the Commission’s proposal also asks the European Banking Authority to set binding standards for fraud reporting.
Cross-border banking introduces several regulatory challenges that can make it harder for banks to prevent fraud, investigate cases, share information, and determine liability across jurisdictions. Here are the main ones and ways to solve them:
Cross-border fraud becomes more complicated when the countries involved classify the same incident differently. This can create uncertainty about which rules apply and what banks must do.
The classification can depend on factors such as:
Banks can create a clear reference that shows how to handle fraud cases across the countries and payment rails they operate in. It can outline the relevant reporting deadlines, investigation requirements, reimbursement rules, and escalation steps for each situation.
Banks often need to share information with institutions in other countries to investigate fraud, identify connected accounts, and trace suspicious activity. However, transferring customer data across borders can be subject to additional privacy and data-protection rules.
For example, under the EU GDPR, transfers of personal data outside the EEA generally need an approved legal mechanism, such as an adequacy decision, standard contractual clauses, or binding corporate rules. UK GDPR requires restricted transfers to be covered by adequacy regulations, appropriate safeguards, or a permitted exception.
Regulatory developments are also addressing the need for greater fraud intelligence sharing. The proposed EU PSD3/PSR framework would require payment service providers to share fraud-related information, with processing limited to what is strictly necessary for fraud prevention under GDPR Article 6(1)(f). However, the legislation has not yet been formally adopted.
Banks can compare fraud intelligence across institutions and borders without sharing more than they need to. Collaborators decide what is shared, with whom, and for what purpose. Every exchange should be:
A newly opened recipient account may receive payments that look normal when viewed individually. The risk can become much clearer when the account is connected to:
This becomes harder with cross-border mule networks, where activity is spread across different banks and countries. One institution may see only the recipient account, while another sees the sender or a different part of the network.
Banks may use shared blacklists to fill some of these gaps, but static lists of known mule accounts, suspicious IP addresses, phone numbers, or compromised credentials can quickly become outdated and provide limited context. A flagged account may also tell the bank very little about whether the account holder is being exploited, unknowingly facilitating fraud, or deliberately participating in it.
Before approving a payment, banks should assess the recipient as well as the customer sending the funds. Looking at what is already known about the recipient and their connections can reveal risks that may not be visible from the individual payment alone.
This can include:
Worth knowing:
Acoru can assess external accounts that bank customers interact with, using previous encounters and wider account connections to identify potentially risky recipients and mule networks. It can then provide more context about the role a recipient account may be playing by classifying it as:
Acoru's Consortium Manager connects financial institutions through a member-governed intelligence network. Instead of relying solely on static blacklists, it allows you to share actionable fraud intelligence, strengthen fraud and mule account detection, and identify risks beyond your own customer base. Every exchange is designed to be proportionate, permissible, and purpose-bound.
Acoru provides account intelligence across three coverage levels:
Level 1: Accounts within your institution
Level 2: External accounts your customers transact with
Level 3: External accounts with no direct relationship to your customers, covered through optional consortium sharing
Its key capabilities include:
Beyond consortium intelligence, Acoru provides additional capabilities that help you build a more complete view of fraud risk:
Request a demo to see how Acoru strengthens cross-border fraud detection with Continuous Account Intelligence and broader visibility into account risk.
No single rule decides this. Each leg of a payment is governed by the law of the country where its payment service provider is located, plus the rules of the payment rail. Banks should map reimbursement, reporting, payment information, and data-sharing obligations leg by leg rather than assume one framework applies end to end.
Yes, within limits. Shared data needs a lawful basis, which in the EU is typically legitimate interest under Article 6(1)(f) of the General Data Protection Regulation (GDPR). Transfers outside the EU or the UK also need a transfer mechanism, such as standard contractual clauses or the UK’s international data transfer agreement. Keyed tokens and other pseudonymized identifiers are still personal data. Privacy-enhancing technologies reduce what each institution can see, but they do not remove these obligations.
Track the changes that already have dates:
In the UK, the Payment Systems Regulator’s functions are moving to the Financial Conduct Authority. Map each change to the payment legs it affects, then update fraud controls, data-sharing agreements, and investigation procedures.