Anti-Money laundering in acquiring: How PayFacs mitigate risk
- Anti‑money laundering in acquiring: How a regulated PayFac operates
- What AML prevention is and why it defines PayFac operations
- The real impact of AML prevention on your merchant settlement
- How AML prevention works inside a PayFac
- Regulatory compliance: Law 10/2010, Directive 2015/849 and EBA guidelines
- AML prevention in action: real alerts by sector
- Regulated acquiring vs. generic models: why the difference matters
- Sources and related reading
Anti‑money laundering in acquiring: How a regulated PayFac operates
A sub‑merchant onboarded at 9:00 begins processing 200 transactions per hour with cards issued in three different jurisdictions. At 11:00, the system withholds settlement. At 14:00, the compliance team blocks the account and files a report with SEPBLAC. That merchant never received a single euro. This scenario can happen to any payment facilitator that is doing its job correctly.
Anti‑money laundering (AML) prevention is not an onboarding formality. It is a live, continuous process that affects every transaction. If you operate under an aggregated acquiring model, you need to understand which controls your facilitator applies, why they may impact your settlement, and how to collaborate to avoid friction.
By the end of this article, you will understand:
- Which AML obligations a regulated payment facilitator must comply with.
- How monitoring works to protect your account and your funds.
- Which alerts trigger fund withholding and how to avoid them.
What AML prevention is and why it defines PayFac operations
Anti‑money laundering prevention is the set of legal obligations and technological controls that prevent illicit funds from entering the financial system. Article 1 of Law 10/2010 defines money laundering as the conversion, transfer, concealment, or acquisition of assets derived from criminal activity.
In a PayFac model, the facilitator aggregates multiple merchants under its umbrella and acts as an intermediary between the sub‑merchant, the regulated acquirer, and the card schemes. This position makes the facilitator a “obliged entity” under Article 2.h) of Law 10/2010, which includes payment institutions and the entities referenced in Royal Decree‑Law 19/2018.
The dual responsibility of the PayFac model
The facilitator is responsible for applying AML controls to every sub‑merchant: due diligence at onboarding, continuous monitoring, and reporting to SEPBLAC when indicators arise. If a sub‑merchant launders money through the platform, regulatory liability falls on both the facilitator and the financial institution acting as the acquirer.
The real impact of AML prevention on your merchant settlement
Every euro processed by a facilitator passes through a risk filter before reaching the merchant’s account. When the filter detects an anomaly, funds are withheld. Law 10/2010 requires obliged entities to abstain from executing suspicious operations and to report them to SEPBLAC.
A merchant billing €80,000 per month who faces a 10‑day withholding experiences an immediate liquidity issue. Common triggers include: volumes tripling the declared turnover, concentration of payments from cards issued in non‑cooperative jurisdictions, and refund ratios above the 1% threshold imposed by card schemes.
The other side of the equation: a merchant with complete documentation and activity aligned with its profile receives settlements in 24–48 hours with fewer holds. Well‑managed AML from onboarding is not a barrier—it is what enables funds to flow.
How AML prevention works inside a PayFac
Compliance operates in three phases that run continuously from the moment a merchant applies for onboarding until the moment it stops operating on the platform.
Phase 1: KYC and KYB during sub‑merchant onboarding
Article 3 of Law 10/2010 requires formal customer identification before establishing a business relationship. In a PayFac, this translates into an onboarding process that includes:
- Document verification of the legal representative using optical recognition and facial biometrics.
- Identification of the beneficial owner: any natural person holding more than 25% of the share capital.
- Analysis of the business model and expected transaction volume to assign the correct category code.
- Screening against international sanctions lists, politically exposed persons lists, and high‑risk registries.
An automated process approves low‑risk merchants within minutes. Profiles requiring enhanced due diligence (Articles 11 to 16) undergo manual review.
Phase 2: Continuous transactional monitoring
Article 6 of Law 10/2010 requires ongoing monitoring of the business relationship. In practice, every transaction is analyzed in real time against the sub‑merchant’s profile. Rule engines generate alerts when detecting:
- Volumes significantly exceeding the range declared during onboarding.
- Multiple unrelated cards operating on the same sub‑merchant within abnormal intervals.
- Structuring patterns designed to evade control thresholds (below‑the‑radar laundering).
- Requests to change the settlement bank account without documented justification.
- Concentration of operations from high‑risk jurisdictions or anonymous prepaid cards.
Phase 3: Reporting to SEPBLAC and confidentiality obligations
When indicators of money laundering are confirmed, the facilitator reports the suspicious activity to SEPBLAC. Article 24 prohibits disclosing to the merchant that such a report has been filed. Breaching this confidentiality obligation constitutes a very serious infringement. All documentation must be retained for 10 years.
Regulatory compliance: Law 10/2010, Directive 2015/849 and EBA guidelines
Law 10/2010 is the core regulatory framework. Article 2.h) includes payment institutions as obliged entities. Articles 3 to 6 regulate due diligence, Articles 11 to 16 define enhanced measures for high‑risk sectors, and Articles 26 to 31 require an internal control body and a representative before SEPBLAC. The sanctioning regime (Articles 51 to 58) includes fines of up to €150,000 for serious infringements and €10,000,000 for very serious ones.
At the European level, Directive (EU) 2015/849 (4AMLD) harmonizes obligations and includes payment service providers as obliged financial entities. The EBA Guidelines EBA/GL/2021/02, updated in January 2024, detail the risk factors institutions must assess when onboarding clients: nature of the business, product type, distribution channel, and geographical scope.
AML prevention in action: real alerts by sector
In e‑commerce, the most frequent alerts involve mass purchases with stolen cards, fictitious refunds used as a laundering channel, and structuring below thresholds. The refund‑to‑sales ratio is the key indicator.
In digital service platforms, the risk pattern is a newly created sub‑merchant processing volumes incompatible with its age. An account active for 48 hours with €50,000 in micro‑transactions triggers immediate withholding.
In gaming and betting, Article 11 of Law 10/2010 classifies the sector as high risk. Enhanced due diligence is mandatory: verification of source of funds and intensified monitoring of deposits and withdrawals.
Regulated acquiring vs. generic models: why the difference matters
A payment facilitator regulated by the Bank of Spain operates through a premium banking acquirer instead of a direct connection to card brands. This model guarantees a robust compliance infrastructure built on three pillars:
Strict validation: Mandatory KYC and KYB processes before activating any account.
Active oversight: Anti‑money laundering prevention with real‑time monitoring by specialized teams.
Financial security: Automatic segregation of funds between merchant net revenue and service fees.
Anti‑money laundering prevention in acquiring is not an isolated department: it is the infrastructure that supports every settlement. Payment facilitators like PayOk execute these controls backed by a premium regulated acquirer so merchants can scale with legal certainty.
Legal and regulatory framework
- Law 10/2010, of 28 April, on the prevention of money laundering and terrorist financing.
- Royal Decree 304/2014, approving the Regulation of Law 10/2010.
- Directive (EU) 2015/849 of the European Parliament and of the Council (4AMLD).
- Directive (EU) 2015/2366 on payment services (PSD2).
- Royal Decree‑Law 19/2018 on payment services.
Guidelines and technical standards
- EBA/GL/2021/02 – Guidelines on money‑laundering and terrorist‑financing risk factors (updated by EBA/GL/2024/01).
- FATF Recommendations.
- SEPBLAC catalogue of risk indicators.
It can be. Payment institutions must stop or review transactions that raise money laundering concerns, and Article 24 of Law 10/2010 forbids them from telling you that an analysis or a report to SEPBLAC is under way. That is why you may get little explanation. What usually happens is that the facilitator asks you for documents to clear up the issue. Send them as soon as possible.
A fraud hold usually affects specific transactions, such as stolen cards or unauthorised payments. An AML hold usually affects your whole account: your activity, your volume and whether they match what you declared at onboarding. Both can happen at the same time.
Up-to-date company documents, valid ID for every beneficial owner (anyone holding more than 25% of the shares or voting rights, or controlling the company by other means), proof of activity such as invoices or supplier contracts, and a live website that matches the activity you declared.
Whenever your circumstances change, when an unusual or large transaction occurs, and periodically according to your risk level. The law does not set a fixed frequency: each institution defines it in its risk policy, and high-risk merchants are reviewed more often. Transaction monitoring is continuous.
This applies if your company is an obliged entity under Law 10/2010, such as a payment institution. Failing to report is a serious infringement, and a very serious one if an executive or employee had already flagged the warning signs internally. Fines for very serious infringements can reach 10 million euros or 10% of annual turnover, whichever is higher, among other criteria.
Was this post useful?
Leave a Comment
Ready to get started?
Create your PayOk account in minutes. No maintenance fees, pay per transaction.