Key concepts

Every payout touches at least six identities, and most rails check only one of them.

A design agency pays a freelancer in Mexico every month, and one day an email arrives asking to switch to a new CLABE. SPEI will credit the new account without looking at the name, so the check has to live in your own change-of-details flow.

Name checks exist only on some rails: the euro area's Verification of Payee (mandatory since October 9, 2025), the UK's Confirmation of Payee, Pix showing the recipient's name and masked tax ID, India's free lookup (since April 1, 2025, though banks still credit "only on the account number"), and card networks' Account Name Inquiry. SPEI has none and credits on the CLABE alone.

The standard is moving. FATF's revised Recommendation 16 (June 2025) asks for names, an account or reference, and town and country for both parties above USD or EUR 1,000, plus name-and-account checks at the receiving bank, in national law by the end of 2030. The W-8BEN expires on "the last day of the third succeeding calendar year". And in June 2025 the US Justice Department announced actions against North Korean IT workers who used fake identities to land remote jobs.

A payout moves through three separate state machines, and each reports "done" at a different moment.

• Money: quoted, funded, converted, sent, credited or returned (in local currency, at a new rate).
• Compliance: screening hit, request for information, purpose-code hold, then released, rejected or blocked (reported to OFAC within 10 business days).
• Payroll: draft, cut-off, invoiced, funded, calculated, paid, receipted (the CFDI), remitted, reconciled.

Most support tickets come from the gaps between these. Swift says 75% of payments reach beneficiary banks within 10 minutes, but reaching the bank doesn't mean the worker has been credited. A card push outside Fast Funds can take days, and a large SPEI payment can be settled and still not credited. I'd only promise a state you can prove; on many rails "sent" is the last thing you know for sure, while the worker only cares about "usable".

Every fact has an owner, and the payout company owns fewer than its dashboard suggests.

Say a marketplace prefunds MXN 2 million at its Mexican partner on Monday and pays out MXN 1.8 million by Friday. Ledger, partner statement and SPEI receipts should all show MXN 200,000 left; when the statement shows 195,000, the gap is usually a netted partner fee or a return still in flight.

A public remittance company's filing warns that its prefunded balances at disbursement partners earn no interest and could be lost if a partner fails to pay out, because that money sits at the partner rather than in its own bank. I'd reconcile each currency every day against all three records: the partner's statement says what money exists, your ledger says whose it is, and the rail confirmation says whether it moved. Expect breaks from FX rounding, netted partner fees, peso returns against dollar payouts, and time zones.

Regulators test this: US state laws want permissible investments covering what's owed, the UK (PS25/12, since May 7, 2026) daily reconciliations, Canada's RPAA funds in trust or insured. When ledger and banks disagree, end users lose: the 2024 collapse of a banking-as-a-service middleware company (see spend management) left a gap estimated at up to $95M.

The provider writes the routing policy, but six other parties set rules around it.

When rules conflict. Canada's Foreign Extraterritorial Measures (United States) Order, 1992, bars Canadian corporations from complying with US Cuba-embargo measures, and the EU Blocking Statute does the same. A Canadian payout firm still screens OFAC's lists in practice, because its dollars clear through US banks, but must not apply the Cuba measures. Going with "the stricter rule wins" is a business choice; no law says so.

Picture a Toronto payroll provider whose US bank asks it to stop paying staff at a Cuban-owned company's office in Spain. Following the request could breach Canadian law; refusing could cost it the bank.

The tests differ. OFAC's March 31, 2026 guidance calls its 50% ownership rule a floor and points at control; Canada already asks whether property is "owned, held or controlled, directly or indirectly".

Routing policy is where it all lands: a rail per payee by amount, speed, cost and destination limits, a quote window and size cap, and who absorbs slippage.

Quotes expire within seconds or hours, pay dates follow the destination's calendar, and the rules themselves keep moving. India's export realisation period (the time an exporter has to bring the money home) went from 9 to 15 months in November 2025 and back to 9 in June 2026. An Indian software contractor who invoiced a US client in March 2026, when the period was 15 months, and planned around it had to check which rule covered that invoice once it went back to 9.

New rules under FEMA, India's foreign exchange law, notified in January with 15 months, were amended on September 22 to 9 (12 for rupee invoices), days before taking effect on October 1, 2026.

I'd store the rate, the rule version and the calendar each payout used, since a quote can last seconds and, as India showed, a regulation can change twice before it starts.

A payout platform speaks four families of standards, most of them behind a partner's API.

• Swift, in ISO 20022 since coexistence with MT ended on November 22, 2025. pacs.008 carries the customer transfer (formerly the MT103), pacs.009 COV the cover between banks, camt.056 a cancellation request, pacs.004 a return. The charge field says OUR (the sender pays every charge), SHA (each side pays its own bank; intermediaries may deduct) or BEN (the beneficiary pays, out of the principal). Every gpi payment carries a 36-character UETR.
• Local rails, through partners: CLABE plus RFC or CURP for SPEI; Pix keys; account, IFSC and purpose code in India; account or wallet in the Philippines; sort code and account in the UK; IBAN for SEPA.
• Card pushes: network messages based on ISO 8583.
• Government formats, the real payroll interfaces: Mexico's CFDI payroll complement; Brazil's FGTS Digital, which takes the 8% severance-fund deposit only by Pix; India's Form 143 (since April 1, 2026); the UK's Full Payment Submission by payday.

Where payee data breaks

1. Onboarding takes one address line. From November 14, 2026, Swift stops accepting fully unstructured addresses (town and country need their own tags), and non-compliant messages "may be rejected or delayed".
2. A partner strips or truncates structured fields.
3. The purpose code is missing or wrong. In India it decides whether a receipt is a services export or a salary.
4. The tax ID the rail now wants was never collected: RFC or CURP on SPEI, phased in by February 23, 2026.

Swift's Payment Pre-validation (2021) checks the account and format before sending; nobody publishes how widely it's used. Swift itself can now carry structured data end to end, so the failures tend to come from your own onboarding form or a partner's API.

Any of the parties below can stop a payout.

Correspondents are disappearing: active correspondent banks fell about 22% between 2011 and 2019 while payment values grew. The Fed is leaving too: FedGlobal ACH, which credited pesos in Mexico the next banking day, takes its last forward items on November 20, 2026, citing "steep declines in transaction volumes".

Local access is gated. A foreign payout company needs a regulated Mexican participant to reach SPEI; Pix is for central-bank-authorized institutions, with a R$15,000 cap for the rest; India's FX runs only through authorized dealer banks. Some doors are opening: Faster Payments has almost doubled its direct participants since 2018, and RPAA-registered providers may join Payments Canada since September 29, 2025. But the Fed's May 2026 proposal leaves out state money transmitters, so US payout fintechs still need a bank.

That makes the local partner the dependency I'd watch most closely, since it holds the licence, the rail connection and your prefunded money.

Two countries' law, two sets of licences and at least two partners' policies sit on every payout.

• US money transmission follows the sender. Model laws license "receiving money for transmission from a person located in this state". The model act (in about 33 states) and Texas law include payroll processing. New exemptions (Nevada, Nebraska, Maryland from October 1, 2026) are written around wages. I'm not a lawyer, but as I read it, a contractor platform that holds funds needs licences, a bank-agent structure, or never to touch the money.
• Holding the money is the trigger. A US startup that collects client funds on Monday and pays contractors abroad on Friday holds other people's money for those four days, and that's what brings in state licences.
• Consumer rules miss B2B. The CFPB Remittance Rule covers transfers "primarily for personal, family, or household purposes"; the 1% remittance excise tax and FinCEN's border order cover only cash-type funding. An account-funded payout escapes all three.
• Canada: the RPAA covers providers based in Canada or serving Canadian users from abroad: a fintech holding a company's funds is in, the company's own bank is not.
• The EU has no passport for third countries. I'm least sure here: paying into recipients' own EU accounts through an EU partner bank seems to need no EU licence; holding balances for EU contractors does.

Most cross-border exceptions run on someone else's clock and end in a request that can be refused.

A logistics company that pays a Mexican carrier MXN 150,000 over SPEI and mistypes one digit of the CLABE can land the money in someone else's valid account. Its bank can ask for the money back, but it returns only if that stranger agrees.

Consumer protections don't reach business payouts. Reg E's error rights are consumer-only, and the UK's push-payment fraud reimbursement (up to £85,000 a claim) covers only transfers between UK accounts. In the euro area, a provider that ran Verification of Payee isn't liable for a credit to the wrong IBAN; one that didn't must refund.

Contracts move most losses to the customer; laws and sanctions move some back.

An architecture firm wires a $5,000 invoice to a Philippine supplier on SHA. An intermediary and the supplier's bank each take a fee, the supplier sees a short payment, and the firm ends up sending the difference.

Law puts employer duties on the EOR, contracts push them back to the client, and courts look through both: Brazilian courts can declare the client the employer under "primacy of reality" (substance over form), Philippine law makes the principal jointly liable, and in Germany unlicensed labour leasing makes the client the employer. A certified US PEO (professional employer organization) is the one legal shield: the IRS treats it as the only employer for wages it remits. And sanctions ignore contracts: in 2021 OFAC fined a public payout company about $1.4M for 2,220 apparent violations after weak screening.