FATF Recommendation 16 After the June 2025 Revision: What Payment Transparency Asks of Identity Data

For information; not legal advice.

Every payment message carries two sets of names. One set describes who is sending the money and the other describes who is meant to receive it. The Financial Action Task Force standard that governs those two sets is Recommendation 16, called payment transparency, and in June 2025 the Task Force revised it. The supervisors who describe the revision do so mainly in terms of the payment chain and the content of the payment message, as the next section shows. This article reads the standard from the other end, and asks where in a payment the information comes from, who verified it, and what an institution needs to hold about its own customer for a payment message to be complete.

The article is a reading aid and not a compliance opinion. It adds to the earlier article on crypto-asset service providers and the transfer rules, which covers the application of the same standard to virtual asset transfers and the European regulation on them. This article is about the standard itself and about transfers of funds, and it links the two only where the text of the standard does.

Four limits of the sources are stated here, before the detail. First, the website of the Financial Action Task Force could not be fetched, so the standard was read in the consolidated text 2012-2026 that the Eurasian Group hosts, and the revision was read through two supervisory pages that describe it. Second, one of those two pages, from the Japanese Financial Services Agency, is in Japanese, and the list of revised items below is this article's translation of it. Third, the text of the standard before the revision was not read, so the article does not say, for any sentence of the current text, that it is new. Fourth, the guidance that the Task Force is preparing to go with the revision was not available in final form, and a consultation on it is noted below.

What the supervisors say changed in June 2025

The Luxembourg supervisor, the Commission de Surveillance du Secteur Financier, published a short page dated 18 June 2025. It says that the Task Force streamlined international requirements on 18 June 2025, that the aim is to increase the safety and security of cross-border payments and to better detect financial crime, and that the changes were agreed at the Plenary meeting of June 2025. It adds that the changes will ensure consistency of the information required in payment messages, to build a clearer picture of who is sending and receiving money, and to help eliminate fraud and error that affect customers. It also notes that the recommendation is referred to as the travel rule in the context of virtual assets.

The Japanese Financial Services Agency published a longer page on 19 June 2025, with updates in August 2025 and December 2025. Its account of the purpose is that the revision follows changes in the structure of the payment market caused by new technology, and aims to make the recommendation technology neutral and in line with the principle that the same activity and the same risk get the same rules. It adds that the revision also answers a priority action of the roadmap that the G20 set for making cross-border payments faster, cheaper, more transparent and more inclusive while keeping safety and security.

The page lists five main revised items. In this article's translation they are as follows.

1. A clearer definition of the start and end of a cross-border payment, which makes clearer who is responsible at each point in the payment chain.
2. A review of the information sent with a cross-border payment, to improve the content and the quality of the information on the sender and the receiver.
3. A check of the consistency of the information on the receiver in a cross-border payment.
4. A review of the exemption for card payments.
5. A limited standard for cross-border cash withdrawals.

The page says that the revision follows two public consultations, held in 2024 and in 2025. It says that the Task Force will prepare guidance with more detail and keep talking to private stakeholders. On implementation, it says that, in view of what both public and private sectors have to do, the end of 2030 is the target for the deadline, which gives lead time, and that the Task Force may adjust the deadline if needed.

The same page of the Luxembourg supervisor lists, among related documents, a notice of 26 June 2026 that the Task Force opened a public consultation, until 21 August 2026, on guidance to increase payment transparency. The consultation document itself was not read. A firm planning its implementation should read the final guidance when it is issued, since it is the Task Force's own account of how the text is to be applied.

The recommendation, in the Task Force's words

The text of Recommendation 16 is short. Countries should ensure that financial institutions include required and accurate originator information, and required beneficiary information, on payments or value transfers and related messages. The information should be structured to the extent possible and should remain with the payment, or the related message, throughout the payment chain. Countries should also ensure that financial institutions monitor payments for the purpose of detecting those that lack the required originator or beneficiary information, and take appropriate measures.

Two words in that text carry most of the weight for identity verification. The first is "accurate", which is attached to the originator information and not to the beneficiary information. The glossary of the interpretive note says what it means: accurate is used to describe information that has been verified for accuracy. The second is "required", which sends the reader to the lists of data items in the interpretive note, described below.

The objective, in the first paragraph of the interpretive note, is to prevent terrorists, perpetrators of money laundering and associated predicate offences such as fraud, and other criminals from having unfettered access to payments or value transfers for moving their funds, and to detect such misuse when it occurs. It aims to ensure that basic information on the originator and the beneficiary is immediately available to law enforcement and prosecutors, to financial intelligence units, and to ordering, intermediary and beneficiary financial institutions, to help them identify and report suspicious transactions and to apply asset freezes and prohibitions. The note says that countries should minimise thresholds because of the terrorist financing threat posed by small payments, while taking into account the risk of driving transactions underground and the importance of financial inclusion. It adds that the Task Force does not intend to impose rigid standards or to mandate a single operating process that would negatively affect the payment system or financial inclusion.

The scope covers cross-border and domestic payments or value transfers, including serial payments and cover payments. Information accompanying them should be structured, to the extent possible, in accordance with the established standards of the system used, and should be sufficiently detailed to enable identification of the originator and beneficiary. A footnote adds that "originator" and "beneficiary" are interchangeable with "debtor" and "creditor", the terms used in certain messaging standards. Another footnote says that the recommendation does not specify whether or how the information transmitted should be screened against sanctions lists, because various mechanisms may ensure compliance with targeted financial sanctions.

The payment chain and who is responsible where

The revision's first item is about the chain, and the text of the note gives the definition. For implementation purposes, the payment chain starts at the financial institution that receives the instructions from the originator for the transfer of funds to the beneficiary. Its end point is the financial institution that services the account of the beneficiary or provides cash to the beneficiary. The note names three roles: the ordering financial institution, one or more intermediary financial institutions, and the beneficiary financial institution. Messaging standards call the first and the last "debtor agent" and "creditor agent".

The information in the payment message should make it possible for all institutions and authorities to identify which financial institution services the account of the originator and of the beneficiary, and in which countries those institutions are located. Financial institutions should ensure that account numbers are not used to disguise the identification of the country where the institution that services the account resides.

The glossary defines the originator as the account holder who requests the payment from that account, or, where there is no account, the natural or legal person that places the order with the ordering institution. This matters for onboarding. A person without an account who places a payment order, such as a customer of a money transfer service, is an originator, and the institution has to hold the required information about that person even though no account was ever opened.

The link to customer due diligence

The recommendation on customer due diligence, Recommendation 10, lists the occasions on which an institution must carry out due diligence. One of them is when carrying out occasional transactions that are payments or value transfers in the circumstances covered by the interpretive note to Recommendation 16. Another is when the institution has doubts about the veracity or adequacy of previously obtained customer identification data. So the two recommendations meet in one place: the person who makes a one-off payment through a firm is a customer for the purposes of identification, if the payment is of the kind that Recommendation 16 covers. For the wider framework, see the article on how risk sets the verification steps under the FATF standard.

What must travel with a cross-border payment

The note distinguishes payments above and below a de minimis threshold. Countries may adopt a threshold no higher than USD/EUR 1,000 for cross-border payments, other than cash withdrawals. Below it, the financial institution should include the name of the originator and the beneficiary, and the account number of each, or, where there is no account, a unique transaction reference number that permits traceability. The note says that this information need not be verified for accuracy, unless there is a suspicion of money laundering or terrorist financing, and in that case the institution should verify the information pertaining to its customer.

Above the threshold, the information accompanying a cross-border payment should always contain five groups of data, set out in paragraph 9 of the note.

The third column of the table is this article's reading of where an ordering institution gets each item.

Footnote 53 of the consolidated text adds a case to the account-number row: where the funds are drawn from a financial institution other than the ordering institution, the account number and the name of the institution from which the funds are drawn should be included. A further footnote to the note says that, in the absence of standardised postal address information for the originator, the country and town name, or the nearest alternative, suffice. The glossary defines a "unique official identifier" as an identification scheme issued by the public sector in the relevant jurisdiction that ensures that a given identifier refers to a unique person, entity or legal arrangement.

The pattern of the table is that three of the five groups are about the originator and come from the file that the institution built when it verified the customer. The name, the date of birth and the address are exactly the attributes that an identity document and its verification produce. Only the beneficiary side comes from the originator's instruction, and the note treats it differently, as described below.

Domestic payments, cards and cash

For domestic payments the note allows a threshold of the same level and a reduced content below it: the name of the originator, and the account number of the originator or a unique transaction reference number. Above the threshold, domestic payments carry the same originator information as cross-border payments, unless the information can be made available to the beneficiary institution and the authorities by other means. In that second case the ordering institution need only include the account number or a unique reference number that permits the payment to be traced back to the originator or the beneficiary. The information should be made available by the ordering institution within three business days of a request from the beneficiary institution, from an intermediary or from the competent authorities, and law enforcement authorities should be able to compel immediate production.

The note exempts transfers between financial institutions acting on their own behalf, and it treats net settlements and batch files separately. Its card paragraphs apply to transfers that flow from a transaction carried out with a credit, debit or prepaid card for the purchase of goods or services, where the card number should accompany the transfers and the name and location of the card issuer and merchant acquirer should be available on request. A footnote limits the purchase of goods or services to purchases from individuals or entities that the relevant institution onboarded to accept card payments following the required due diligence. When a card is used for another type of payment, such as a transfer from person to person, the ordinary requirements for domestic or cross-border payments apply.

The revision's items on cards and on cash withdrawals concern this part of the text. For cross-border cash withdrawals, using a card through a different financial institution, the card number should accompany the withdrawal and the name of the cardholder should be sent to the acquiring institution on request within three business days. For domestic cash withdrawals no information beyond the account number or card number is required to accompany them.

Duties of the three kinds of institution

The note divides the responsibilities by role. They are the part of the text that most affects a product team, because each duty becomes a condition that a payment flow has to check.

The ordering institution

The ordering institution should ensure that cross-border payments above the threshold contain required and accurate originator information, and required beneficiary information. Below the threshold it should ensure the names and account numbers or reference numbers. It should maintain all originator and beneficiary information collected, in accordance with Recommendation 11. It should not be allowed to execute the payment if it does not comply with these requirements.

The last sentence ties the recommendation to the verification of identity in a hard way. An originator whose attributes were never verified is, for a payment above the threshold, an originator whose payment the institution may not send. The text does not say how the verification must be done, and the choice of method is left to the institution's own customer due diligence under Recommendation 10.

The intermediary institution

An intermediary should ensure that all the originator and beneficiary information that accompanies a cross-border payment is retained with it. Where technical limitations prevent the required information from remaining with a related domestic payment, the receiving intermediary should keep a record for at least five years of all the information received. It should take reasonable measures, consistent with straight-through processing, to identify cross-border payments that lack required information. It should have effective risk-based policies and procedures for determining when to execute, reject or suspend a payment lacking required originator or required beneficiary information, and what follow-up action is appropriate.

The beneficiary institution

The beneficiary institution has the longest list of duties in the note, and it is the part that the revision's items on the receiving side concern. The paragraphs are numbered 28 to 31 in the consolidated text.

It should take reasonable measures to identify cross-border payments that lack required originator or required beneficiary information. For cross-border payments above the threshold, it should verify the identity of the beneficiary, if the identity has not been previously verified, and maintain this information in accordance with Recommendation 11. This is paragraph 29, and it is a direct statement of identity verification at the receiving end of a payment: a person who receives a cross-border payment above the threshold must have had their identity verified, either before or at that moment.

Paragraph 30 is the text on misdirected payments, and it concerns the consistency of beneficiary information, which is one of the revised items. It applies to cross-border payments or value transfers above the de minimis threshold, and the duty described next does not extend to payments at or below it. It says that information received on the intended beneficiary should inform the beneficiary institution's monitoring, with the objective of detecting misdirected payments, for example due to possible money laundering, fraud or error. The institution should take measures to mitigate the risk of transfers being made to an unintended beneficiary, and the measures should include at least one of three options.

1. The institution checks, for each transaction, the extent to which the name and account number of the beneficiary in the payment message align with the information it holds.
2. The institution conducts holistic ongoing monitoring to identify anomalous accounts, transactions and activity, including misaligned beneficiary information, following a risk-based approach.
3. If the beneficiary and ordering institutions both take part in a pre-validation mechanism, such as confirmation or verification of payee, that checks the alignment for each transaction, the pre-validation may be used instead of the first two options.

A footnote makes a point that matters for any matching of names: alignment does not imply that there must be an exact match, and the expected degree of alignment may vary based on the risk and the context. This is footnote 62 of the consolidated text.

The institution should also have effective risk-based policies and procedures for determining when to execute, reject or suspend a payment lacking required information, or when it identifies potentially misdirected payments under paragraph 30, and what the follow-up action is. This is paragraph 31.

Money or value transfer providers

Money or value transfer service providers should comply with all the relevant requirements of the recommendation in the countries in which they operate, directly or through their agents. Where a provider controls, or is part of a network controlling, both the ordering and the beneficiary side of a payment, it should take into account all the information from both sides to determine whether a suspicious transaction report has to be filed, and file it in any country affected. For such a provider, the originator can be a person with no account, and the identity data of that person are the data of the one-off customer discussed above.

How two jurisdictions write the same ideas

The standard is addressed to countries, and each country turns it into its own rules. Two examples show how the same text appears in different legal forms. Neither is a statement that the rule implements the June 2025 revision, since both rules, or their main texts, are older or separately made, and the article does not read them as responses to it.

The European Union: the transfers regulation and verification of the payee

Regulation (EU) 2023/1113 is the European text on information accompanying transfers of funds and certain crypto-assets, and its part on transfers of funds covers the same subject as Recommendation 16. The earlier article covers its crypto-asset chapter, and this one reads the part for funds.

Article 4 requires the payment service provider of the payer to ensure that transfers are accompanied by the name of the payer, the payer's payment account number, and the payer's address including the name of the country, official personal document number and customer identification number, or alternatively the payer's date and place of birth. It adds, where the message format has the field and the payer provided it, the current Legal Entity Identifier or an equivalent official identifier. For the payee it requires the name, the payment account number and, on the same condition, the identifier.

The verification duty is in the same article. Before transferring funds, the provider of the payer shall verify the accuracy of the payer information on the basis of documents, data or information obtained from a reliable and independent source. Verification is deemed to have taken place where the identity of the payer has been verified in accordance with Article 13 of Directive (EU) 2015/849 and the information obtained has been retained in accordance with Article 40 of that directive. The provider shall not execute any transfer of funds before ensuring full compliance with the article, apart from the derogations for transfers within the Union and below the threshold.

Article 5 reduces the content for transfers where all providers in the chain are established in the Union: the payment account number of both the payer and the payee, or a unique transaction identifier. Under Article 5(2), the provider of the payer must make information available within three working days of receiving a request from the payee's provider or an intermediary, and what it makes available depends on the amount. For transfers exceeding EUR 1,000, whether carried out in a single transaction or in several that appear to be linked, it makes available the information on the payer or the payee in accordance with Article 4. For transfers not exceeding EUR 1,000 that do not appear to be linked to other transfers which, together with it, exceed EUR 1,000, it makes available at least the names of the payer and the payee and their payment account numbers or the unique transaction identifier. For transfers not exceeding EUR 1,000 that do not appear to be linked to others, the payer's provider need not verify the information on the payer unless it received the funds in cash or in anonymous electronic money, or has reasonable grounds for suspecting money laundering or terrorist financing.

The payee's side is in Article 7. For transfers exceeding EUR 1,000, whether in a single transaction or in several that appear to be linked, the payee's provider shall verify the accuracy of the information on the payee before crediting the payee's account or making the funds available, on the basis of documents, data or information from a reliable and independent source. That verification is deemed to have taken place where the payee's identity was verified under the same article of that directive and the information retained. Article 8 requires effective risk-based procedures for deciding whether to execute, reject or suspend a transfer that lacks the required information, and says that the provider shall, on a risk-sensitive basis, reject the transfer or request the required information before or after crediting the account.

The same pattern, in which the identity check done at onboarding counts as the check for the payment, is in both the payer and the payee articles. In practice that means that a firm which verified its customer well at onboarding, and kept the verified attributes in a form it can read at payment time, has most of what the payment duty requires. That is a reading of the text and not a statement by a supervisor.

A separate European regulation, Regulation (EU) 2024/886, adds a service that matches the beneficiary's name to the account. Article 5c requires the payer's payment service provider to offer the payer a service ensuring verification of the payee to whom the payer intends to send a credit transfer. The provider must perform it immediately after the payer provides the information about the payee and before the payer is offered the possibility of authorising the transfer, whatever channel the payer uses. Where the payment account identifier and the name of the payee have been inserted, the payer's provider provides a service for matching them; if they do not match, the payer is notified that authorising the transfer might lead to the funds going to an account not held by the payee indicated; and if they almost match, the provider shows the payer the name of the payee associated with the account identifier. Where the payee is a legal person and the payer's provider offers a channel that allows it, the payer may instead provide data elements such as a fiscal number, a European unique identifier or a Legal Entity Identifier, which the payee's provider checks against the identifier.

The recitals explain why the service allows near matches. They say that the presence of diacritics or different possible transliterations of names in different alphabets, and differences between habitually used names and names on formal documents, may result in a name that does not match exactly but nevertheless almost matches. The regulation sets the dates by which providers comply: those in euro-area Member States by 9 October 2025, and those in Member States whose currency is not the euro by 9 July 2027. It provides that the services are provided to all users without a charge.

The Task Force text names a pre-validation mechanism such as confirmation or verification of payee, in the third option of paragraph 30, so the European service is one concrete example of the kind of mechanism the note has in mind. Whether a particular national mechanism satisfies the note is for the supervisors and the evaluators to say, and the article makes no claim about it.

The United States: the travel rule and the transmittal record

The American rule on funds transfers sits in the regulations of the Financial Crimes Enforcement Network, in 31 CFR 1010.410. Paragraph (f) is the part that makes information travel with the payment order. It applies to any transmittor's financial institution or intermediary financial institution located within the United States, for a transmittal order for a transmittal of funds of $3,000 or more.

The transmittor's institution must include in the order the name and, if the payment is ordered from an account, the account number of the transmittor; the address of the transmittor; the amount; the execution date; the identity of the recipient's financial institution; as many of the name and address of the recipient, the account number of the recipient and any other specific identifier of the recipient as are received with the order; and either the name and address or a numerical identifier of the transmittor's institution. An intermediary that accepts a transmittal order must pass on the same items, if received from the sender. The rule includes a safe harbor for transmittals made before an institution converts to the expanded Fedwire message format.

Paragraph (e) is a recordkeeping rule for non-bank financial institutions, again for transmittals of $3,000 or more. For a transmittor that is not an established customer, if the order is made in person, the institution must verify the identity of the person placing the order before accepting it, and record the name and address, the type of identification reviewed, the number of the identification document and the taxpayer identification number or, if none, an alien identification number or passport number. If the order is not made in person, the institution must record the name and address of the person placing the order, the taxpayer identification number or its equivalent, and a copy or record of the method of payment, such as a check or credit card transaction.

The text sets the in-person and remote cases side by side. It requires verification of the person placing the order in the first and a record of the name, address, number and payment method in the second, and it does not state a verification step for the second case. That is the rule as printed on 28 October 2026, and a reader should look for the supervisor's current expectations before relying on the contrast.

Two further points of care. The electronic Code page carries a cross-reference to an amendment published on 4 September 2024, and another to a notice of 2 January 2026 that delayed that amendment until 1 January 2028. The amendment was not read for this article. And the American figure of $3,000 and the Task Force's ceiling of USD/EUR 1,000 for a de minimis threshold are numbers in two legal instruments of different kinds, and the article does not assess how they relate.

The American rule for banks on customer identification, and the rule on beneficial ownership, are covered in the guide to the United States.

Where identity verification meets the payment message

Read together, the standard and the two national texts give a short list of places where a verification flow touches a payment. Each is a reading and not a rule, and the list is not exhaustive.

• Originator attributes. The note's lists need a name, an address and a date of birth for a natural person above the threshold, and the glossary says that "accurate" means verified. A flow that returns these attributes in structured fields, separately from the image of the document, lets the payment system fill the message from the verified record.
• Name forms. The European recitals recognise diacritics, transliteration and differences between habitual and formal names. A verified record that holds the name as printed on the document, the name in the machine readable zone and the name the customer uses gives a payment system more to match against.
• Legal persons. The note asks for a business identifier code, a Legal Entity Identifier or a unique official identifier where it exists. The business verification flow should keep that identifier as a field and not only as part of a document image.
• The beneficiary at payout. Paragraph 29 says the identity of the beneficiary should have been verified for a cross-border payment above the threshold, and European Article 7 says the same for transfers above EUR 1,000. A platform that pays out to individuals, such as a marketplace or a payroll service, therefore has a reason to verify the payee when the payee is first set up and not when the first payment arrives.
• The record. The ordering and beneficiary institutions should maintain the information in accordance with Recommendation 11, and the one-off customer has to be recorded as well as the account holder.

What a firm can decide now

The texts leave room, and a firm has to use it with a reason. Five decisions follow from the reading above.

1. Decide which verified attributes the payment system reads from the customer record, and make sure that every attribute in the table above exists as a field and not only inside a document image.
2. Decide how a customer who sends a single payment without opening an account is identified, since the originator definition includes that person and the due diligence recommendation lists the occasion.
3. Decide whether payees are verified when they are set up, and what the platform does with a payment to a payee whose identity is not yet verified.
4. For cross-border payments above the de minimis threshold, decide which of the three options for misdirected payments applies, who owns the matching rules, and how near matches are shown to the person who decides.
5. Decide how the firm will follow the Task Force's guidance, whose consultation closed on 21 August 2026, and who reads the final version against the firm's own procedures.

Questions to put to a provider

• Which of the attributes in the table does the product return as structured fields, and in what format are the name and the address returned?
• Does the product return the name as printed, the name in the machine readable zone and any transliteration, so that a payment system can match more than one form?
• For a business customer, does the product return the Legal Entity Identifier or other official identifier as a field?
• Can the product verify a payee at set-up, before the first payment, and return the status to the platform?
• How long does the provider keep the verification record, and can the firm retrieve it for a payment query years later?
• When the provider changes the format of a result, how and when does the firm hear about it?

Where this sits in a verification flow

A flow built on NeuroVision KYC places the identity steps in one session: document, selfie, liveness and face match, with the scenario assembled in an editor. The individual steps are described on the document verification page. This article does not state that these steps meet the payment transparency standard, that they produce the originator information the standard requires, or that they replace an institution's own customer due diligence.

To see how these steps look in your own scenario, contact the team.

Sources

All sources were fetched on 28 October 2026, except the FATF text, which was fetched on 27 October 2026.

• The FATF Recommendations, consolidated text 2012-2026, Financial Action Task Force, as hosted by the Eurasian Group, Recommendation 10, Recommendation 16 and the interpretive note to Recommendation 16.
• FATF enhances transparency in payments through the modification to the Recommendation 16 of its standard, Commission de Surveillance du Secteur Financier, Luxembourg, published 18 June 2025.
• FATFによる「Payment Transparencyに関するFATF勧告16の改訂」の公表について, Financial Services Agency, Japan, 19 June 2025, updated August and December 2025; page in Japanese.
• Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets, Publications Office of the European Union.
• Regulation (EU) 2024/886 amending Regulations (EU) No 260/2012 and (EU) 2021/1230 and Directives 98/26/EC and (EU) 2015/2366 as regards instant credit transfers in euro, Publications Office of the European Union, Article 5c.
• 31 CFR 1010.410, Records to be made and retained by financial institutions, electronic Code of Federal Regulations.