Due diligence on cross-border infrastructure fits in seven questions: who holds the licenses, whether each conversion produces an exchange contract, how many accounts the money passes through, whether reconciliation is an output or a task, what happens when a rail fails, whether compliance runs inside the flow, and whether the country roadmap moves. A provider that cannot answer each one in a single sentence has already answered it.
Forty pages of RFP, seven questions that decide it
A payments RFP runs forty pages and asks about API endpoints, dashboard features and supported currencies. Then the contract is signed, and the first payout failure reveals what nobody asked: who is actually regulated, where the money actually sits, and who answers when a rail stops.
Due diligence on cross-border infrastructure does not need forty pages. It needs seven questions, asked directly, and the discipline to expect a one-sentence answer to each. The questions work on any provider, including us.
- Which entity holds the licenses, and where?
- Is there an exchange contract for each conversion?
- How many accounts does the money pass through?
- Is reconciliation an output or a task?
- What happens when a rail goes down?
- Is compliance embedded in the flow, or bolted on afterward?
- Is the country roadmap continuous evolution, or a static list?
1. Which entity holds the licenses, and where?
Why it matters. "Cross-border provider" describes at least three different structures: a company holding its own license in a market, a company registered with a federal authority, and a company operating through a locally compliant sponsor-institution framework. Each structure is legitimate, and each behaves differently under stress. The entity that touches your money in each country determines which regulator supervises it, and how your funds are treated if that entity fails.
What a good answer contains. A named legal entity per country, and the specific authorization or registration each one holds. In Brazil, for example, a provider may operate as a payment institution authorized by the Banco Central do Brasil. In the United States, registration with FinCEN as a Money Services Business is a registration, not a banking license, and a good provider says so in plain terms. In markets such as Mexico and Colombia, providers commonly operate under locally compliant sponsor-institution frameworks; a good answer names the model and the registered local entities behind it.
What you should not accept: "we are fully licensed in all markets." That sentence blends three different structures into one word, and it usually means nobody has asked before.
2. Is there an exchange contract for each conversion?
Why it matters. In regulated FX markets, notably Brazil, a conversion executed on the licensed rail produces a documented exchange contract per transaction: a record with a name, an amount and a purpose. That document is the audit trail. When a bank, an auditor or a regulator reviews your flows, the route with per-transaction contracts answers in minutes; informal routes have no equivalent document. That difference, more than the rate, is what separates the two in a due diligence.
What a good answer contains. A plain yes for the corridors where the instrument exists, plus the operational detail: who issues the contract, under whose authorization, and how you retrieve it per transaction. If the provider cannot say who issues the exchange contract for a BRL conversion, the regulatory risk of that route sits with you. The mechanics are the same ones described on our FX settlement page.
3. How many accounts does the money pass through?
Why it matters. Every account between your payer and your beneficiary is an intermediary, a fee, a delay and a point of failure. The double FX leg hides here: routes that convert twice do it because the money travels out and back instead of settling where it landed. Providers quote a rate; few draw the route.
What a good answer contains. A drawn route, account by account: how many legs, how many conversions, where balances sit overnight, and in whose name. One conversion, executed at pay-in or payout, is the benchmark of a route designed for the corridor. If the drawing takes more than a minute, the route has more legs than the price suggests.
4. Is reconciliation an output or a task?
Why it matters. If closing the month means exporting statements from a different bank in each country and matching them by hand, the architecture is producing the workload. Fragmented balances produce fragmented records, and finance teams spend days each month reconstructing what the system should have recorded. Adding headcount treats the symptom.
What a good answer contains. One ledger across currencies and entities, an event for every state change, and reconciliation data produced as the transaction happens rather than reconstructed after it. The test is concrete: ask to see the month-end close for a client operating in three markets. Good providers show a report; the rest describe a process. That is what our ledger is built to produce.
5. What happens when a rail goes down?
Why it matters. Every provider performs on the happy path. The difference shows when a payout bounces, a beneficiary detail is wrong, or a local rail has an outage. Failures at the rail level are normal events in payments; what varies is whether the provider engineered for them.
What a good answer contains. Specific failure mechanics, described without hesitation: a typed status event for every state change, a retry flow where beneficiary details can be corrected and the payout resubmitted, and a named escalation path with response commitments. A good answer names the event you receive and the action you can take. Vague reassurance about round-the-clock monitoring means the failure path has never been drawn.
6. Is compliance embedded in the flow, or bolted on afterward?
Why it matters. KYC, KYB, AML and sanctions screening either run inside every transaction, or they run as periodic cleanup around the flow. The bolt-on version looks cheaper until a compliance review freezes settlement for days, or a counterparty bank asks for records the provider cannot produce per transaction. In cross-border payments, compliance gaps travel: a weak leg contaminates the whole route.
What a good answer contains. The controls, named one by one, with their place in the transaction path: identity verification, UBO discovery, sanctions and PEP screening, transaction monitoring, and audit trails per transaction. Then governance: who supervises the framework, and what regulatory reporting exists in each market. A provider that treats these as product mechanics answers in detail; a provider that treats them as a department sends you a PDF. Ours is documented on the compliance page.
7. Is the country roadmap continuous evolution, or a static list?
Why it matters. Payment rails move. Real-time systems keep launching and gaining functions across Latin America, and the method your customers prefer next year may not exist in your provider's integration today. A coverage list built once, at contract time, ages against the corridor you will need next.
What a good answer contains. Evidence of motion: rails or markets added recently, how new methods reach existing clients (through the same API and contract, or as a new project), and honest labels separating what is live from what is announced. A waitlist labeled as a waitlist is a good sign. Overpromising is the actual red flag: a provider that says yes to every country has answered question one for you.
Seven direct sentences, or seven narratives
The seven questions share one discipline: each has a one-sentence answer if the structure exists. The entity has a name. The exchange contract has an issuer. The route has a leg count.
Providers that respond with two paragraphs of context are describing what they do not have. Score the meeting accordingly: seven direct sentences is a route you can audit; seven narratives is a route you will discover in production.
For transparency: ATTRUS operates regulated cross-border financial infrastructure across Brazil, Mexico, Colombia and the United States, and we answer these seven questions in due diligence all the time. We published the list because the market improves when buyers ask them, of every provider.
Frequently asked questions
Is a FinCEN registration the same as a banking license?
No. Registration with FinCEN as a Money Services Business is a federal registration, not a banking license. A provider that presents it as being "fully licensed" is blending three different structures into one word, and a good provider says so in plain terms.
What is an exchange contract and why does it matter?
In regulated FX markets such as Brazil, a conversion executed on the licensed rail produces a documented contract per transaction, with a name, an amount and a purpose. It is the audit trail a bank, auditor or regulator asks for. Informal routes have no equivalent document.
How many conversions should a cross-border route have?
One, executed at pay-in or payout. Routes that convert twice do it because the money travels out and back instead of settling where it landed. Each extra account on the route is a fee, a delay and a point of failure.
What does a sponsor-institution framework mean?
It means the provider operates in that country through a locally licensed institution rather than under its own license. The structure is legitimate and common in markets such as Mexico and Colombia. A good answer names the model and the registered local entities behind it.
Reference note
Regulatory terms used in this guide (Bacen authorization for payment institutions, FinCEN MSB registration, sponsor-institution frameworks) reflect publicly documented structures as of August 2026.
This article is general information, not legal or financial advice. Last reviewed August 2026.