Instant payment regulation and sanctions screening: EU vs US rules

The EU's Instant Payments Regulation turns sanctions screening of instant payments around: for euro instant credit transfers between payment providers in the EU, banks may not screen the payment against EU targeted financial sanctions lists, and must instead check their own clients against those lists at least once every calendar day and immediately after any new designation. In the United States there is no such rule. OFAC asks for a risk-based approach, notes that solely domestic instant payments generally carry lower sanctions risk, and leaves it to each bank to decide whether and how to screen FedNow and RTP payments. Banks with flows in both places need two designs. Botminds' Payment Sanctions Screening sits on the U.S. design, where an instant payment held on a hit waits on a clock while a person decides, and on the cross-border payments both regimes still screen.

What does the EU Instant Payments Regulation say about sanctions screening?

It replaces screening of each euro instant payment with screening of each bank's own clients. Regulation (EU) 2024/886, adopted on 13 March 2024, amended the SEPA Regulation and added Article 5d. The European Banking Authority summarises the core of it: "The first subparagraph of Article 5d point (2) of Regulation (EU) 2024/886 prohibits the screening of SEPA instant payment transactions against the EU targeted financial sanctions list" (EBA Final Report on Guidelines on restrictive measures, November 2024).

The logic is the one behind the rest of the regulation. A euro instant payment must reach the payee within 10 seconds: under Article 5a(4), point (c), "within 10 seconds from the time of receipt of the payment order by the payer's PSP, the payee's PSP shall make the amount of the payment transaction available on the payee's payment account" (European Commission, Q&As on IPR implementation). A filter hit that sends the payment to a person's queue cannot meet that. If every payment provider in the chain has already checked its own clients, the payment between two checked clients needs no second check.

The Commission's answer to when this applies is short: "Article 5d applies to all PSPs from all Member States from 9 January 2025." The EBA's guidelines on restrictive measures, which apply from 30 December 2025, carve the same exception out of their general rule that payment providers "should screen transfers of funds before making the funds available to the payee" (EBA guideline 19, which opens "Except in cases covered in Article 5d").

In the EU, the bank may not screen the instant payment; it must have screened the client. In the U.S., the bank decides how, and answers for the result.

Daily, and immediately after a new listing: the client-screening duty

The price of the ban is a demanding duty on client screening. The Commission's Q&A says the own-client screening "must be carried out at least once every calendar day", which includes weekends, and that "If a new designation is adopted between the daily checkpoints, in accordance with Article 5d(1), a check of own clients must occur immediately after the entry into force of a new designation." It chose the word on purpose: "The policy expectation with respect to the acceptable duration of this time gap is represented by the use of the notion 'immediately' as opposed to 'as soon as possible' or 'without undue delay'."

A hit in that daily check stops the client, not the payment. Asked whether a bank should suspend instant payments for a flagged client while it investigates, the Commission said yes, "until the flag is confirmed to be a false positive", and closed off a common practice: "verification of own clients cannot be launched on a calendar day with a manual follow up, in case of an alert, only on the next business day." That moves the sanctions analyst's queue from the payment to the client file, and makes a client-level false positive costly: the client cannot pay or be paid instantly until a person clears it.

The client check also has to reach owned and controlled companies. The Commission notes the daily screening "can be calibrated to detect entities owned or controlled by listed persons", for example by screening a client's registered ultimate beneficial owner, and where that is not possible, "checking of payment details is not prevented" for that purpose (Q&As 165 and 166).

What the ban does not cover

The prohibition is narrower than its headline. It covers euro instant credit transfers where both payment providers are in the EU, and only screening against EU targeted financial sanctions lists. The Commission's Q&A spells out the limits:

• National lists and other EU measures. The ban is "without prejudice to actions taken by PSPs in order to comply with" national restrictive measures and EU measures that are not targeted financial sanctions, as the EBA puts it; payment details can be screened for those.
• Payments that leave the EU. "For transactions where one of the two PSPs is located outside the EU (EEA), the prohibition included in Article 5d(2), first subparagraph, does not apply" (Q&A 168).
• Non-instant transfers. For credit transfers that are not instant credit transfers, including non-time-critical ones, "the prohibition included in Article 5d(2), first subparagraph, regarding transaction-based screening does not apply" (Q&A 160).
• The UK and Switzerland. Until the articles are taken over there, they "will not apply to instant credit transfers between a PSP located in the Union and a PSP located in Switzerland. The same would apply with regard to instant credit transfers in euro to and from the UK" (Q&A 169).

The obligation itself does not move. The Commission is clear that EU sanctions regulations already demand immediate compliance "regardless of the type of screening put in place" (Q&A 161). Article 5d changes the method; the bank still answers for the result.

What does OFAC say about FedNow and RTP?

OFAC says the method is the bank's choice, made on risk. Its 2022 guidance for instant payment systems states that "there is no one-size-fits-all approach to managing sanctions risks with regard to instant payment systems", and that "solely domestic instant payment transactions generally pose a lower sanctions risk than those involving accounts maintained at non-U.S. banks, which may not be subject to similar regulatory requirements and examinations" (OFAC, Sanctions Compliance Guidance for Instant Payment Systems, September 2022).

It also gives the bank a way to judge individual payments. Payments "consistent with past customer behavior that a financial institution has previously vetted and cleared for potential sanctions implications generally pose lower sanctions risk than payments that appear inconsistent with a customer's prior history, such as significantly higher value payments or payments made to foreign persons with whom the customer has not previously dealt." That is close to the EU's reasoning about checked clients, but it is guidance on risk, not a prohibition.

The Federal Reserve's own rulebook for FedNow takes the same line. Participants must keep "reasonable procedures for screening customer information against current sanction lists and updated lists to the extent customers might be a party to a FedNow Service transaction", and a footnote adds: "The Federal Reserve Banks do not require real-time transaction screening in their terms, but a FedNow receiver that conducts such screening under its compliance program may use the accept-without-posting feature (ACWP) to facilitate its compliance processes" (FedNow Service Operating Procedures, June 2025).

Do I have to screen instant payments for sanctions in the US?

There is no U.S. rule that says you must screen each instant payment, and none that says you may not. What is required is that no payment is processed for a blocked person and no prohibited payment goes through, so a bank that does not screen each FedNow or RTP payment has to show its customer screening and its limits on cross-border exposure carry the risk instead. For a bank whose instant payments are purely domestic between screened customers, that case can be made; for one whose customers pay foreign persons, it is harder.

Volume is pushing the question up the agenda. FedNow settled 8,413,402 payments in 2025, and 6,376,467 in the third quarter of 2026 alone, an average of 69,309 a day.

U.S. instant payments held on a hit, each on its own short clock

One bank, two rails: designing for both

A bank with EU and U.S. instant flows runs two designs side by side, and the difference is where the analyst's queue sits. On the EU rail the queue is made of clients flagged by the daily and post-designation checks, and the clock is "immediately". On the U.S. rail it is made of payments, and the clock is whatever the bank sets inside FedNow's accept-without-posting window or its own target.

The two designs share more than the headline suggests. Both depend on fast, complete client screening, which is where OFAC's own guidance places much of the risk control for domestic instant payments. Both need list updates loaded within minutes of publication. And both need a person to decide a hit quickly, with evidence; only the object of the decision differs. How OFAC has judged automation that skipped that person is the subject of real time payment screening: agents prepare, a person releases.

A list update arrives: lookalike hits gathered so a person checks the pattern once

Cross-border instant payments, and where each rule stops

Cross-border instant payments are screened as payments on both sides. The EU prohibition does not apply when one of the two payment providers is outside the EU or EEA, and OFAC's guidance treats payments involving accounts at non-U.S. banks as the higher-risk case. A euro instant payment from Frankfurt to London, or a dollar instant payment that reaches a foreign bank through a correspondent, is in the transaction-screening column of both regimes.

That is also where the EU rule can surprise a bank. The Commission's Q&A on the UK and Switzerland means a bank's euro instant flows split into two populations: intra-EU payments it may not screen against EU lists, and payments to and from the UK and Switzerland it must treat as ordinary cross-border transfers. A screening configuration that cannot tell the two apart will either breach the prohibition or miss the obligation. Where those payments carry ISO 20022 data, the fields that identify the other bank are the ones the routing rule depends on; ISO 20022 sanctions screening, field by field shows them on one message.

What to ask before an instant payment screening change

Ask what the rule requires of each flow, then whether the controls can show it. The checklist below is a starting point for a bank that runs instant payments in the EU, the U.S., or both.

Payment Sanctions Screening fits the parts of this where a person must decide a held payment on a short clock: U.S. instant payments, wires, IAT entries and cross-border flows. It does not replace an EU bank's daily client screening, though the same discipline applies there: load the list fast, gather lookalike hits, and decide each with cited evidence. The Payment Sanctions Screening page shows the instant lane on the sample bank's desk.

Questions people ask

Can a bank screen its customers daily instead of each payment?

In the EU, for euro instant payments between EU payment providers, that is exactly what the law requires: client screening at least once every calendar day and immediately after new designations, and no screening of those payments against EU targeted financial sanctions lists. In the U.S., a bank may choose to rely more on customer screening for domestic instant payments if its risk assessment supports it.

Is a domestic instant payment lower risk?

OFAC says solely domestic instant payments generally pose a lower sanctions risk than those involving accounts at non-U.S. banks, because U.S. banks already screen their customers under U.S. rules. Lower risk is not no risk: a payment between two screened customers can still involve a newly designated person before the next rescreen.

When did the EU instant payment sanctions rule take effect?

Article 5d applies to all payment providers in EU Member States from 9 January 2025, according to the European Commission. The EBA's guidelines on restrictive measures, which reflect it, apply from 30 December 2025, and from 10 July 2027 internal controls for targeted financial sanctions move under the new EU AML Regulation, (EU) 2024/1624.

Does the EU ban apply to instant payments to the UK or the US?

No. The prohibition applies only where both payment providers are in the EU or EEA. The Commission states that it will not apply to euro instant payments to and from the UK or Switzerland until the rule is taken over there, so those payments are screened like any other cross-border transfer.

What is accept without posting in FedNow?

It is one of three responses a receiving bank can give to a FedNow payment. The payment settles between the banks, but the receiver is relieved of making the funds immediately available to its customer while it investigates, for example a sanctions hit, and must then credit or return the funds by a deadline set in the FedNow Operating Procedures.

What lists does the EU daily client check use?

The EU-wide designation lists adopted under Article 215 of the Treaty on the Functioning of the EU, according to the Commission's Q&A 154. UN Security Council designations are covered once they are implemented in those EU lists.