Wolfsberg Guidance on Banking Non-Bank Payment Providers (2026)

Banks that hold accounts for payment firms face an awkward problem: the bank sees only part of each payment, while the payment firm sees the customers. In 2026 the Wolfsberg Group, an association of thirteen global banks, published Guidance on the Provision of Banking Services to Non-Bank Payment Service Providers (PSPs) to set out a risk-based way of handling that. It is industry guidance rather than law, but it is detailed enough to show what banks are likely to ask a payment firm before opening or keeping an account. If you work at a payment, e-money or money transfer business, it is a useful preview of the questions coming your way. Our guide to US money services business AML rules covers one type of firm the guidance is aimed at.

We read the Wolfsberg Group's own page for the guidance and a copy of the PDF text. Neither states an exact publication day; the document is marked 2026 and builds on the Group's October 2023 Payment Transparency Standards, its 2024 guidance on payment transparency roles, and the June 2025 updates to FATF Recommendation 16.

What counts as a non-bank PSP

The guidance defines a non-bank PSP as any payment service provider that facilitates funds transfers without a banking licence. That includes money service businesses, third-party payment processors, fintechs and electronic money institutions. Covered activities include settling payments for goods and services, domestic and cross-border remittances, and transfers made through cards, e-money, mobile phones or similar digital or prepaid devices.

It excludes firms that only exchange physical currency or cash cheques, software providers with no role in handling funds, activities carried out under a banking licence, corporates making only operational payments for themselves, and entities that are solely digital asset service providers. E-wallets are limited to fiat-currency wallets.

The three main business models

• Business remittance: payments for businesses, including cross-border payments, cash management and foreign exchange.
• Person-to-person remittance: payments between individuals, which often lack readily available information about the parties. The guidance separates digital, non-cash remittance from cash-focused money transmission.
• Merchant acquiring: collecting card and other payments for merchants and settling them, online or in person.

It also covers two ways of working with a bank. In banking-as-a-service, the payment firm uses the bank's products but runs onboarding and transactions on its own platform, so much of the customer data and transaction records sits with the payment firm. In a sponsored account arrangement, the payment firm reaches payment systems through the sponsoring bank's licence, and the sponsor remains ultimately responsible for activity on the account.

Payment flows and why they matter

The guidance distinguishes three kinds of flow:

• Proprietary flows, where the payment firm pays on its own behalf, such as salaries. These are generally lower risk, but the guidance warns that "liquidity management" can disguise third-party disbursements.
• Third-party flows, where the firm uses its account for its customers' payments. This can resemble correspondent banking exposure and may require a safeguarding account depending on the jurisdiction.
• Bundled, netted or bulk flows. One-to-many payments such as salaries are generally lower risk. Many-to-one flows such as merchant servicing are higher risk. Many-to-many flows are the highest risk because they reduce transparency and increase reliance on the payment firm's controls.

The risks it names are limited payment transparency, sanctions exposure, money laundering risk from limited insight into originators and beneficiaries, and fraud, because newer payment firms often lack long-term behavioural data. For the cousin topic of banks dealing with banks, see our guide to the Wolfsberg correspondent banking questionnaire.

What the bank is expected to assess

The guidance recommends tailored questionnaires covering the business model, funds flows, payment corridors and controls, with the most stringent requirements applied where a firm runs several business lines. The areas it lists include:

• Business model: service type, cross-border exposure, high-risk funding methods such as cash, money orders or prepaid cards, non-resident customers, nested relationships and agents.
• Licensing: the firm's status, whether it matches its activities, and passporting or local licence needs.
• Jurisdictions: the quality of supervision where it operates, its payment corridors, where its customers and merchants are, and the location of nested entities.
• Controls: compliance resources and governance, customer due diligence, third-party and anti-bribery controls, product limits, IP monitoring and blocking, name and payment sanctions screening, suspicious activity monitoring, use of artificial intelligence and machine learning, management information, payment transparency, fraud monitoring, audit and training.
• Track record and growth: public enforcement history and whether controls can scale with planned products and markets. Newer firms may need more frequent reviews.

Ongoing monitoring and exit

Due diligence does not stop at onboarding. The guidance suggests event-driven reviews triggered by adverse news, ownership changes, financial crime incidents, licensing changes, or new flows or intermediaries. Reviews of account activity should look for unexpected changes in volumes, new corridors, sanctions patterns, emerging high-risk customers and unexpected nesting. The bank can decide to onboard, maintain, decline or exit, based on its risk appetite and the specific flows it supports. Where risks cannot be adequately mitigated because end-to-end visibility is reduced, it should adopt an appropriate risk-control strategy.

For payment firms: getting ready for the questions

These are our suggestions, not anything the guidance requires of you.

• Be able to describe your flows clearly, separating your own payments from customer payments, and showing how any bundling works.
• Keep an up-to-date map of agents, partners and any nested providers, with who does the screening and monitoring.
• Know your sanctions screening set-up well enough to explain lists, frequency and how you handle free-text fields.
• Track backlogs and audit findings, with remediation dates, since banks are told to ask for them.
• Tell your bank early about new corridors or products, because significant changes should prompt a reassessment.

For Irish authorisation of this type of firm, see our guide to payment institutions and e-money in Ireland. For training, see the Learnsignal CPD courses.

What we could not confirm

We could not confirm the exact publication date. The guidance has no formal red flags list or standalone information checklist, so the points above are drawn from its due diligence and control sections. We did not check whether any regulator has adopted or responded to it, and the guidance itself does not set legal requirements.

Frequently asked questions

Is this guidance mandatory?

No. It is guidance from an association of banks. Regulators may still expect firms to apply a sound risk-based approach.

Does it cover crypto firms?

Not if they are solely digital asset service providers. E-wallets are limited to fiat-currency wallets.

Which payment flows does it treat as highest risk?

Many-to-many bundled flows, because they reduce transparency and increase reliance on the payment firm's controls.

Can a bank exit the relationship?

Yes. The guidance frames the choice to onboard, maintain, decline or exit as a decision based on risk appetite and the flows supported.

Learnsignal publishes this guide for general education only. It is not legal or compliance advice.