The Payments Pulse: Proof Is the New Compliance

Brazil’s licensed online market is days from going dark. Operator authorizations end October 25 under Provisional Measure 1,394, a São Paulo court has given only partial relief, and the Supreme Federal Court has not set a ruling date. The same week, regulators handed down a $1.2bn anti-money-laundering penalty, the EU named its first “significant” stablecoin, and fintech funding topped $2.8bn in seven days.

The common thread is evidence. Courts, examiners and card networks are no longer asking whether you have a policy; they are asking whether you can show it worked. Last week’s edition, The Courts and the Auditors Are Now Setting the Rules, argued that rule-setting was moving to the courtroom and the audit. This week confirms it, and it builds on earlier themes: Regulation Is Moving From the Merchant to the Rail and The Processor Is Now the Defendant.

1. Brazil’s Licensed Market Goes Dark, and Processors Count the Cost

Photo: Ian Talmacs / Unsplash

In late September, President Lula issued a provisional measure banning licensed operation in one of Brazil’s regulated consumer categories. The measure runs 120 days and must be ratified, amended or revoked by Congress. On October 9, a São Paulo federal court partly allowed one operator to keep trading until October 25, when authorizations end, subject to 12 conditions. The merits are still pending, and the Supreme Federal Court has been asked to overturn the ban.

The financial damage is already visible. One major international operator reported a 36% drop in Brazilian net revenue for Q3 and guided full-year EBITDA to the low end of its £910m-£960m range. Its CEO said she expects the market to reopen “in some form or another” but admitted “we don’t know exactly what’s going to happen.” Scenarios on the table include a narrower product scope or a return with advertising limits. Brazil’s October election is widely seen as a swing factor.

For payments teams, this is a settlement problem as much as a policy one:

• Funds in flight: pending deposits, withdrawals and refunds need a clear wind-down path if authorizations lapse.
• Reserves and chargebacks: a sudden stop can trigger refund demand and disputes while volume (and fee income) disappears.
• Rail concentration: local rails built around a single vertical lose their volume overnight.

This is the sharpest example yet of the pattern we described in A Market Gets Switched Off While the Gates Open Everywhere Else.

Why it matters: A license is not a guarantee of continuity. Stress-test any single-jurisdiction exposure for a prolonged outage: reserves, refund flows, and contractual exit terms.

2. A $1.2bn AML Penalty Defines “Effective in Practice”

Photo: Josh Sanabria / Unsplash

On the enforcement front, Bank of America was hit with a $1.2bn FinCEN civil penalty for willful Bank Secrecy Act violations: an ineffective AML program, inadequate due diligence on foreign correspondent accounts, and late suspicious activity reports. The OCC’s $750m penalty is credited against that figure rather than stacked on top, and OFAC added an $11.6m settlement over 475 apparent sanctions violations. The roundup we relied on calls it the third-largest Treasury penalty ever and the OCC’s largest, with the lesson that programs must be “effective in practice, not simply comprehensive on paper.”

Licensed consumer operators got the same message from regulators elsewhere:

• UK: three operators within one group settled for £5,012,261 and must commission a third-party audit of AML and customer-protection policies. Cited failings: outdated policies, weak customer risk classification, unchecked crypto-to-sterling deposits, skipped enhanced due diligence.
• Sweden: an appeals court upheld fines of SEK 4m and SEK 40m against one operator for slow, over-automated customer interventions and for a “no limit” option that bypassed mandatory deposit limits.
• US: FinCEN is loosening some obligations (beneficial-ownership reporting eliminated for US companies in August; due diligence re-verification relief in February) while raising the bar on effectiveness. On October 5 it also withdrew its 2020 unhosted-wallet and 2023 crypto-mixing proposals.

Compliance as infrastructure is a theme we have tracked since Compliance Is Becoming the Infrastructure and Every Rail Just Became a Liability Surface.

Why it matters: Less paperwork does not mean less liability. Examiners test whether monitoring, screening and intervention work when an alert fires. The documented response is the deliverable.

3. Stablecoins Move Inside the Perimeter While US Legislation Stalls

Photo: Lukas S / Unsplash

On October 14, the European Banking Authority classified USDC, issued in the EU by Circle Internet Financial Europe SAS, as the first “significant” e-money token under MiCA. From November 12, the EBA takes direct oversight of own funds, reserve assets, liquidity, and recovery and redemption planning, while France’s ACPR keeps governance and fitness assessments. It is a scale designation, not a finding of non-compliance. A week earlier, ESMA told authorized platforms to block new access to non-compliant stablecoins within three months.

In the US, the Senate failed to invoke cloture on the CLARITY Act (49-50), so agencies and states are filling the gap:

• Oct. 1: OFAC designated Russia’s A7 Network and the A7A5 token; FinCEN proposed prohibiting transmittals involving A7 sub-agents. The SEC proposed crypto custody rules allowing state-chartered trust companies and limited self-custody. Florida’s stablecoin issuer licensing took effect.
• Oct. 5: the CFTC issued an advance notice on retail leveraged crypto (Regulation CTX) and a new crypto-market category (Regulation CAM); comments are due December 14. Modern Treasury and Rain applied for national trust bank charters.
• Oct. 9: the CFTC issued an interim final rule excluding certain state- and tribal-licensed products from the “swap” definition, alongside a proposal to expressly include event contracts.
• Oct. 14: the OCC’s debanking review found all nine of the largest national banks kept policies that could restrict lawful businesses, including digital asset firms. It does not create a right to an account.
• State level: 34 regulators settled with Coinme for $2.5m, requiring it to exit kiosks by January 1, 2027 or pay $4m more. Illinois’ 0.2% digital asset tax is delayed to July 1, 2027.

We flagged the stalling in The Rules Are Stalling. The Rails Aren’t. and the broader build-out in The Infrastructure Shift.

Why it matters: Compliant stablecoin rails are becoming more available and more conditional. Expect issuer-level licensing, reserve transparency and sanctions screening to flow down into merchant onboarding.

4. Record Capital and Another Rail Consolidation

Photo: Vital / Unsplash

FinTech Global counted more than $2.8bn across 17 deals in the week to October 16, up from $1.33bn the week before. Ramp reportedly raised $1.85bn at a $60bn pre-money valuation, up from $44bn in June. Other rounds: ID Finance €545m, Stand $70m (Series C, $1bn valuation), Archa $61m, Harmonic Security $50m, Reach Security $50m+, Causa Prima $20m for AI-driven billing dispute settlement, and Fission $10m. PayTech led by deal count. US fintech funding hit $19.3bn in Q3, up 69% year on year.

On October 9, Anchorage Digital acquired Routable, a payouts company covering more than 220 countries and territories; terms were undisclosed and it will be renamed Routable by Anchorage Digital. Crypto-native infrastructure keeps buying fiat payout capability, the same consolidation logic we covered in Infrastructure Is Consolidating Around Whoever Owns the Rails.

Why it matters: Money is following security, disputes and cross-border payouts. Vendor selection should assume today’s independent provider may be tomorrow’s subsidiary of a custody or stablecoin player.

5. AI Moves From Scoring to Deciding, and the Networks Tighten

Photo: George Prentzas / Unsplash

On October 15, Forter and GMO Payment Gateway announced that Mercari fully adopted Forter’s AI judgment platform. Preliminary, vendor-reported results: chargeback amounts fell to about one-tenth of prior levels, no legitimate transactions were wrongly rejected, unnecessary 3D Secure challenges dropped while card sales improved, and manual review and rule maintenance were eliminated. The model returns three outcomes (approve, reject, or step up to 3DS) and was delivered through GMO-PG’s existing API, which shortened time to production.

The next frontier is agent-initiated checkout. Meta and Sierra are reportedly developing a Personal Agent Protocol, with a first specification expected later this month, while liability for agent-initiated purchases remains unresolved. We raised this in Trust Is Becoming the Rail.

Meanwhile the networks are raising the floor for higher-risk merchants. Mastercard’s revised MMP standards (effective January 1, 2026) require a scan before the first transaction, extend monitoring to restricted and members-only site areas, check for transaction laundering such as incorrect MCCs, and require issues to be resolved within 15 days. Visa’s VAMP began enforcement in October 2025. (This summary comes from a processor’s article, so verify against Mastercard’s documentation.)

Why it matters: Automated decisioning cuts fraud losses and friction, but only if you can explain and audit its decisions. Pair AI step-up logic with clean MCCs and accurate site content before the scan finds the gap.

The Bottom Line

This week, the rules were set by a decree, a penalty and a classification, not by new legislation. Brazil shows a licensed market can vanish overnight; the $1.2bn bank penalty shows examiners grading operational effectiveness; and in stablecoins, Europe and the US states are drawing the perimeter while Congress stalls. Meanwhile, capital and AI are racing ahead, funding payouts, security and decisioning. For anyone running higher-risk payment flows: stress-test single-market exposure, document what happens when an alert fires, prefer rails inside a licensing perimeter, and treat explainable AI decisioning as part of your compliance stack. As we put it in The Infrastructure Shift, the rails keep moving; proof is what lets you stay on them.