Remittance and international money transfer testing
FintechAssuranceLabs tests international money transfer products like Wise, Remitly, and Payoneer. We test FX quotes and margin, fixed fees, corridor rules, sanctions screening, payout settlement timing, and failure and refund paths. We deliver the test evidence that partner banks, US state examiners, and EU and Canadian supervisors request from remittance providers.
What breaks in international transfers
A remittance product earns the fixed fee and the margin inside the exchange rate on every transfer. The failures below take more than the disclosure promised or force the provider to return both.
- Quote expires and the payment goes through at a new rate. The sender pays after the quote's validity window, and the rate service reprices at the new market rate while the confirmation screen still shows the old Total to Recipient. For a US sender, a recipient amount below the disclosed amount is an error under 12 CFR 1005.33(a)(1)(iii), unless the disclosure was a permitted estimate. Under 1005.33(c)(2)(i) the provider refunds the sender or makes the difference available to the recipient at no additional cost, so the margin earned on every repriced transfer turns into a correction run.
- Returned payout refunded minus the provider's own fee. A recipient bank returns a payout because the sender entered a wrong account number, and the refund job converts the returned amount at the day's rate and keeps the transfer fee. Where the funds missed the disclosed date because of incorrect sender information, 1005.33(c)(2)(iii) allows deduction of third-party fees actually imposed but not of the provider's own fee, with the refund due within three business days after the investigation report. The refund under 1005.33(c)(2)(ii)(A)(1) is the amount of funds the sender provided, so a reconversion that returns less falls short.
- Date Available computed on the sender's calendar. The availability engine counts business days in the sending country and ignores the payout partner's cut-off and public holidays in the destination country. Funds arrive after the Date Available printed on the receipt (1005.31(b)(2)(ii)), which is an error under 1005.33(a)(1)(iv). The remedy in 1005.33(c)(2)(ii)(B) adds a refund of all fees to the correction the sender chooses. The 1005.33(a)(1)(iv)(B) exception covers screening and OFAC investigation delays, not a wrong holiday calendar, so every transfer to that corridor on the holiday loses its fee.
- Transliterated names pass the sanctions filter. The screening service compares names only in one Latin spelling, so a recipient whose name appears on the list under another transliteration is paid out. OFAC's Framework for OFAC Compliance Commitments (2 May 2019) names screening that did not account for alternative spellings among the root causes of apparent violations. The transfer earns one fixed fee and exposes the provider to a civil penalty determined under the Economic Sanctions Enforcement Guidelines (31 CFR Part 501, Appendix A).
- Split transfers escape the 24-hour rule in Canada. A sender makes three international transfers of CAD 3,500 each to one beneficiary within 24 hours, and the aggregation job groups transfers by funding method instead of beneficiary. No EFT report is filed, although PCMLTFA Regulations sections 30(1)(b) and 127(1)(c) treat transfers the provider knows go to one beneficiary within 24 consecutive hours as one EFT, here above the $10,000 reporting threshold. The Administrative Monetary Penalties Regulations classify a contravention of section 30(1)(b) as a minor violation that FINTRAC can proceed with under Part 4.1 of the Act.
Licence and the evidence regulators and partner banks request
International transfers need a licence: money transmitter licences, a payment institution authorisation, or an MSB registration, held directly or by a partner.
United States
State money transmission laws require a licence in each state whose law covers the provider's activity. The provider registers with FinCEN as a money services business (31 CFR 1022.380) and keeps a written anti-money laundering program with independent review (1022.210(d)(4)). Transmittal orders of $3,000 or more carry transmittor and recipient information (31 CFR 1010.410(f)). A nonbank with at least one million aggregate annual international money transfers is a larger participant under CFPB supervision (12 CFR 1090.107(b)). Regulation E Subpart B sets the disclosure, error, and cancellation rules. Examiners and partner banks typically request:
- pre-payment disclosure and receipt samples per corridor and language, recalculated from quote inputs;
- the error resolution case log with notice, determination, report, and remedy dates (1005.33(g));
- sanctions screening test data and results with list version and match threshold;
- test records that support the independent review of the AML program.
European Union
A non-bank provider of money remittance, a payment service in Annex I point 6 of Directive (EU) 2015/2366, is authorised as a payment institution before it starts, unless an exemption applies (Article 11). Article 45(1) requires the maximum execution time, all charges, and the actual or reference exchange rate to be provided or made available for a single payment transaction. For online credit transfers with currency conversion in euro or another Member State currency, Regulation (EU) 2021/1230 Article 5 requires the estimated conversion charges and the estimated total in the payer's currency before initiation. Regulation (EU) 2023/1113, applicable from 30 December 2024, sets payer and payee information for transfers (Article 4), a reduced data set for unlinked transfers of EUR 1,000 or less to providers outside the Union (Article 6(2)), and reject or request procedures for missing information (Article 8). EU AML testing maps these to tests. Supervisors and safeguarding banks typically request disclosure captures per currency pair, field completeness results per message format, and records of transfers rejected or suspended for missing information.
Canada
A money services business registers with FINTRAC, verifies the identity of a person who requests an EFT of $1,000 or more, reports international EFTs of $10,000 or more within 5 working days, and carries travel rule information (FINTRAC requirements). A payment service provider also registers with the Bank of Canada under the Retail Payment Activities Act, and since 8 September 2025 section 20 requires end-user funds to be held in a trust account or in an insured or guaranteed account used for no other purpose (RPAA text). FINTRAC examiners and the Bank of Canada typically request evidence of 24-hour aggregation logic, travel rule fields in SWIFT MT103 and other international EFT messages, and reconciliation of funds in transit to the safeguarding account.
Remittance test scenarios
- FX quote lifecycle. Payment one second before and one second after quote expiry, rate lock honoured, margin applied once, and exchange rate rounding per currency under 1005.31(b)(1)(iv). The FX rate application testing guide shows the recalculation checks.
- Fees by corridor. Fee tables per amount band, funding method, and payout method, including promotional zero-fee transfers, with the quoted fee equal to the charged fee.
- Corridor rules. Per-corridor limits, required recipient fields, payout methods, and US transfers of $15.00 and $15.01 at the Regulation E exclusion boundary.
- Sanctions screening. Name variants, transliterations, a list update between quote and payout, and a recipient edited after screening, run with a "Sanctions and PEP screening test data set and results". The sanctions screening false positive guide covers threshold tuning.
- Settlement timing. Payout partner cut-offs, destination holidays, weekends, and daylight saving shifts against the Date Available on the receipt. Bank transfers and payment rails testing delivers "Cut-off time and settlement timing scenarios across time zones".
- Cancellation. Requests at 29 and 31 minutes after payment, before and after pickup, with a refund of the total including fees within three business days (1005.34).
- Returns and refunds. Immediate rejects, late returns, returns net of a correspondent fee, and duplicate return messages that refund once.
- Card-funded transfers. Authorisation at payment, decline after the quote, and a chargeback on a transfer already paid out, with tokenised storage that keeps cardholder data out of logs and test environments.
- Thresholds and aggregation. EU transfers of EUR 1,000.00 and EUR 1,000.01 to providers outside the Union, and Canadian transfers combined across 24 consecutive hours.
- Ledger and prefunding. Prefunded payout balances, FX positions, and fee and margin revenue booked separately and reconciled to partner statements.
Integrations and protocols to cover
- FX rate and liquidity provider APIs: streaming rates, quotes with a validity window, rate locks, trade booking, and end-of-day position files.
- ISO 20022 cross-border messages: pacs.008 credit transfers, pacs.002 status reports, pacs.004 returns, camt.053 and camt.054 statements, and the end-to-end reference (UETR).
- SWIFT MT103 messages to correspondent banks, with travel rule fields.
- Payout partner APIs: bank deposit, mobile wallet, and cash pickup networks, with status webhooks and idempotency keys on payout requests.
- Pay-in rails: card processors with ISO 8583 authorisation messages, open banking payment initiation under PSD2, and Nacha ACH debits for US senders.
- Screening and identity: sanctions list feeds such as the OFAC SDN list and the EU consolidated financial sanctions list, name screening APIs, and KYC vendor APIs.
- Regulatory reporting exports: FINTRAC EFT reports and FinCEN transmittal records for transfers of $3,000 or more.
Related
Standards
- Electronic Fund Transfer Act and Regulation E, including the remittance transfer rule
- GLBA and US state money transmitter requirements
- EU AML directives and regulation, KYC obligations
- PSD2 and Strong Customer Authentication
- ISO 20022
- PCI DSS 4.0
- PCMLTFA and FINTRAC obligations
- Retail Payment Activities Act
Services
Guides
- How to test FX markup: rate application and markup disclosure
- How to reduce false positives in sanctions screening: testing for false alerts and missed matches
- How to test Same Day ACH cutoff times and settlement timing across time zones
- How to reconcile camt.053 statements: format, batch entries, reversals, and MT940 mapping
- How to test payment idempotency
Sample deliverable
Sample, synthetic data
| Connector | Happy path | Timeout and retry | Expired consent or token | Duplicate, out-of-order, or offline delivery | Coverage status and open defect |
|---|---|---|---|---|---|
| Bank connector 01 (Berlin Group NextGenPSD2) | Covered, 9 of 9 cases passed: POST /v1/consents reaches consentStatus valid after SCA, and the accounts, balances, and transactions calls return 200 for that consent | Covered, 6 of 6 cases passed: a timed-out transactions call is retried with a new X-Request-ID, and a 429 ACCESS_EXCEEDED response stops refreshes for that consent until the next day | Failed, 4 of 5 cases passed: after a 401 CONSENT_EXPIRED response, the connector keeps scheduling refreshes and shows a stale balance of 1,240.00 XTS as current | Covered, 5 of 5 cases passed: a pending transaction that returns with bookingStatus booked and a new transactionId replaces the pending entry, and overlapping dateFrom windows import no duplicates | Failed, retest scheduled after the INT-0203 fix. INT-0203 (medium): the bank connector does not set reconnect required after a 401 CONSENT_EXPIRED response |
| Bank feed 03 (OFX) | Covered, 7 of 7 cases passed: a STMTRQ for a checking account returns STMTRS with SONRS STATUS code 0, and each STMTTRN posts once to the ledger bank account | Covered, 4 of 4 cases passed: a statement request retried after a timeout reuses its TRNUID, and status 2019 Duplicate request is handled as already processed | Covered, 3 of 3 cases passed: SONRS status 15500 Signon invalid stops the bank feed and asks the user to reconnect, with no empty statement imported | Failed, 5 of 6 cases passed: overlapping DTSTART and DTEND windows repeat FITID values, and one repeated FITID with a changed TRNAMT imports as a second transaction | Failed, retest scheduled after the INT-0221 fix. INT-0221 (medium): a repeated FITID with a changed TRNAMT of 18.75 XTS imports as a second bank transaction |
| Card terminal SDK (offline mode) | Covered, 12 of 12 cases passed: online EMV contact and contactless sales return tag 8A value 00, and each approved sale posts one capture | Covered, 6 of 6 cases passed: an authorisation request with no host response before the timeout sends a reversal before the sale is retried | Covered, 4 of 4 cases passed: a terminal session token that expires while the terminal is offline is refreshed before the store-and-forward upload starts | Failed, 10 of 11 cases passed: offline sales under the terminal floor limit (tag 9F1B) complete with tag 8A value Y3, and one retried store-and-forward upload posts two captures | Blocked for release until the INT-0214 fix passes retest. INT-0214 (high): a store-and-forward upload retried after a lost acknowledgement captures one 42.50 XTS sale twice |
| Broker API A (FIX 4.4) | Covered, 10 of 10 cases passed: Logon (35=A) succeeds, and each ExecutionReport (35=8) with ExecType (150) F updates the imported position once | Covered, 5 of 5 cases passed: no inbound message within HeartBtInt (108) triggers a TestRequest (35=1), and a reconnect resumes at the next expected MsgSeqNum (34) | Covered, 3 of 3 cases passed: a Logon with an expired Password (554) is answered with Logout (35=5) and Text (58), and the broker link shows as disconnected with positions kept | Covered, 8 of 8 cases passed: a MsgSeqNum (34) gap triggers ResendRequest (35=2), and a resent ExecutionReport with PossDupFlag (43) Y and a known ExecID (17) is not counted as a second fill | Covered, with no open defects on Broker API A |
| Payout partner B (ISO 20022 pacs.008) | Covered, 8 of 8 cases passed: a pacs.008.001.08 credit transfer with a UETR returns pacs.002 TxSts ACSP and then ACSC, and the payout is marked settled once | Failed, 5 of 6 cases passed: a timed-out pacs.008 submission is followed by a pacs.028 status request, but one retry is sent as a new pacs.008 with a new UETR | Covered, 4 of 4 cases passed: a payout submitted with an expired API access token returns 401, and the token is refreshed before one resubmission with the same UETR | Covered, 6 of 6 cases passed: a pacs.002 TxSts RJCT after ACSP releases the payout hold once, and a repeated pacs.002 for the same UETR changes no balance | Blocked for release until the INT-0230 fix passes retest. INT-0230 (high): a pacs.008 retried after a timeout carries a new UETR and pays 250.00 XTS twice to one beneficiary |
Amounts use XTS, the ISO 4217 code reserved for testing. Connectors, banks, and partners are generic sandbox endpoints, and terminal sales use scheme test cards masked to BIN and last four.
Questions
What is a remittance?
How does international money transfer work?
How long does an international wire transfer take?
Scope testing for your corridors
Send your corridors, funding and payout methods, and licences, and we return a test scope with the evidence each regulator or partner bank will request.
Scope your testing