Agent oversight for a money transmitter: what you owe for an authorised delegate or payout partner

Agent oversight is the part of a money transmitter's programme that covers people who are not its employees. An agent takes in customer money, or pays it out, under your licence and your rules. Examiners treat that work as yours, and the contract does not move the duty. For a firm settling cross border payments in stablecoins the question arrives in a new shape, because the settlement leg is visible to anyone while the last mile sits with a partner in another country.

What counts as an agent, and when does a payout partner become one?

The label on the contract is not the test. The function is.

An agent acts for you. It collects money for transmission, or delivers it, on your behalf and under your authority. The customer is yours. The duty to deliver is yours.

An independent counterparty is different. It buys from you or sells to you, and it owes its own customers in its own name under its own licence.

Most arguments sit between those two cases. A local payout firm that receives your instruction, pays your named beneficiary and reports back to you is acting for you. Calling it a correspondent does not change what it does.

Three questions settle it. Whose customer is the beneficiary. Whose licence permits the activity in that country. Who answers if the money never arrives. If the answers point back to you, you have an agent, and agent oversight applies to that money transmitter relationship.

What does agent oversight require of a money transmitter?

Four rulebooks reach the same place from different directions.

In the United States the duty sits in the programme rule. Section 1022.210 of title 31 of the Code of Federal Regulations requires a money services business that uses agents to include procedures for monitoring those agents in its anti money laundering programme. It stands alongside internal controls, a named compliance officer, training and independent review.

State licensing adds the prudential half. The Money Transmission Modernization Act, published by the Conference of State Bank Supervisors in 2021 as a model law and followed by most recent state amendments, calls the agent an authorised delegate. It requires a written contract, holds the delegate to the activity that contract permits, and leaves the licensee answerable for what the delegate does inside that scope.

The international standard is blunter. FATF Recommendation 14 and its interpretive note ask countries to require a money or value transfer service provider to keep a current list of its agents, to make that list available to competent authorities, and to include agents in its own programme and monitor them for compliance.

Canada says it plainly as well. A registered money services business must keep its registration details, including its agents and branches, current with FINTRAC, and Canada's Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations require a review of the compliance programme at least every two years.

Sanctions sit on top of all of it. The Framework for OFAC Compliance Commitments, published by the Office of Foreign Assets Control in 2019, sets out five components of a sanctions programme: management commitment, risk assessment, internal controls, testing and auditing, and training. Nothing in it stops at your own staff.

What diligence and what contract come before go live?

Diligence first, because a contract is only as good as what you knew when you signed it.

Establish that the agent may lawfully do the work where it sits. A registration or licence, in its own name, current, and wide enough to cover cash payout if that is what you need.

Then look at the people and the money. Ownership and control, including whoever sits behind a holding company. Screening of the firm, its owners and its directors against sanctions and politically exposed person lists. Adverse media.

Then read the programme. Who is the compliance officer. When was the last independent review, and what did it find. What monitoring does the agent run over its own customers. How are the people at the counter trained.

The contract then has real work to do. It should name the permitted activity and the countries. It should require compliance with the law that binds you as well as the law that binds the agent. It should set remittance terms for money collected, so float does not quietly become a loan. It should give you a right of audit and a right to the agent's transaction data. It should require notice of a regulatory action, a breach or a change of control. It should forbid a sub agent without your written consent.

How do you monitor an agent once it is live?

Monitoring is a sampling exercise with a schedule attached.

• Risk rate every agent on country, product, volume, cash intensity and licence status, then set the review frequency from that rating rather than from the calendar.
• Ingest the agent's own transaction data, not only your instruction file, so your monitoring sees what the counter saw.
• Screen the agent's settlement addresses and bank accounts before the first payment, then on a fixed cycle after it.
• Sample payouts end to end. Take the instruction, find the ledger transfer, then find the agent's proof of delivery to the named beneficiary.
• Watch exceptions rather than averages: cancelled payouts, repeat beneficiaries, amounts just under a reporting threshold, and one identity document appearing across unrelated senders.
• Visit the agents that carry the most risk, and keep the visit notes, the file sample and the remediation list.
• Re-screen and re-paper on a cycle, and record each finding with an owner and a date, so the next review starts where the last one stopped.

Then report it upward. Agent oversight that never reaches a board committee is a folder of spreadsheets, and a money transmitter cannot evidence governance from a folder.

What changes when the settlement leg runs in stablecoins?

The funding leg becomes easy to prove. The payout leg does not.

A transfer to an agent on a public blockchain is verifiable by anyone holding the hash. You can show when it left, when it confirmed and which address received it. That retires the oldest argument in agent monitoring: whether the funding ever arrived.

What remains is the part no chain can see. The agent still has to pay a named person in local currency. Proof of delivery is still a receipt, a bank confirmation or a signature.

Three controls close most of that gap. Screen the agent's receiving address, and treat a change of address exactly as you treat a change of bank details, with a callback and dual approval. Reconcile each payout to the instruction by transaction hash and by UETR. And require delivery confirmation inside an agreed window, with an exception report for anything late.

FATF Recommendation 16, the Travel Rule, requires originator and beneficiary information to accompany a transfer, and the IVMS101 data standard carries it. The FATF Targeted Update on virtual assets and virtual asset service providers of June 2025 continues to report uneven implementation across jurisdictions, so assume some agents cannot receive the data and write down what you do then.

Keep the file as long as the record rules demand. Section 1010.430 of title 31 of the Code of Federal Regulations requires Bank Secrecy Act records to be kept for five years.

What goes wrong, and how do you exit an agent relationship?

An agent you onboarded carefully three years ago and have not sampled since is not an oversight programme. It is a contract and a hope. An examiner reads the sampling, not the signature.

The findings repeat.

The first is a diligence file that stops at the holding company, so nobody ever checked the licence of the entity actually paying the money out.

The second is monitoring built only on your own instruction file. If the agent's data never arrives, your picture of the payment ends at the moment of funding.

The third is the sub agent nobody approved. Your agent appointed its own network, and the counter is now three parties away from anything you signed.

The fourth is an exit with no plan. The relationship ends in a hurry, and customer money is already in flight.

So write the exit down early. Name who may suspend an agent, and on what evidence. Say how payments in flight are completed or returned. Say where the records go, because your retention duty does not end with the contract.

Where StableNet fits

StableNet, built by SpendTheBits, is a cross border B2B payment and settlement platform for banks, credit unions, licensed money service businesses, exchange houses and remittance fintechs. Settlement runs in regulated stablecoins on public blockchains and completes in minutes with on chain auditability, so the funding leg to a payout partner is provable rather than asserted. It is ISO 20022 native, producing pacs.008 customer credit transfers, pacs.009 interbank legs, pacs.002 status reports and pacs.004 returns under a head.001 envelope, tracked end to end by UETR, so one payment carries one identifier across the instruction and the ledger. Compliance is built in: KYB and KYC onboarding, KYT, sanctions and PEP screening, FATF Travel Rule data in IVMS101, a compliance workbench and a tamper evident audit trail, which is the evidence set an examiner samples in an agent file. Universal Compliance Control, the SpendTheBits submission named a finalist in the Swift Hackathon 2026 Technical Challenge, applies the same discipline to settlement itself: an off chain compliance oracle issues one signed attestation and on chain gates enforce it identically across chains, so no valid attestation means no settlement. SpendTheBits is a Bank of Canada registered payment service provider.