A seller can pass every check at sign-up and still become a liability, creating a serious security gap. In 2024, the US Treasury’s Financial Crimes Enforcement Network (FinCEN) penalised TD Bank for a record US$1.3 billion for failing to adequately monitor customer activity. Ongoing compliance monitoring continually checks a seller’s identity, activity, and risk profile. Onboarding confirms a seller’s identity on day one. After that, transaction monitoring, Anti-Money Laundering (AML) checks, sanctions screening, and periodic reverification ensure that the seller’s activity and information remain accurate over time.

Below, we’ll explain why compliance monitoring should continue past onboarding, how transaction and AML monitoring work to catch unusual seller behaviour, and how sanctions screening applies once a seller is active.

Key takeaways

• Seller risk can change over time; a single onboarding check can’t account for future shifts in ownership, business model, or transaction behaviour.

• Transaction monitoring, AML review, and sanctions screening work together to flag activity that doesn’t match a seller’s stated profile.

• Platforms that skip or delay ongoing monitoring face potential exposure to risks, including account restrictions, missed regulatory filings, and undetected fraud.

Why does compliance monitoring continue after seller onboarding?

Compliance monitoring continues after seller onboarding because a seller’s risk profile can change after the initial onboarding check at sign-up. Ongoing monitoring checks whether their activity still aligns with their original profile and assessment.

Here's what to keep in mind:

• Regulatory obligations go beyond sign-up: Card network requirements and rules such as FinCEN’s Customer Due Diligence Rule in the US call for ongoing monitoring.

• Sellers change their business models: A direct-to-consumer shop might switch to wholesale, start selling in new countries, or bring on an owner who never went through verification.

• Volume and behaviour shift: A jump in transaction size, peak in refunds, or sudden change in processing volume can signal fraud or an undisclosed change in business. None of that shows up in a static record.

• Sanctions lists and regulatory guidance update constantly: A jurisdiction can add new restricted entities or lower a reporting threshold. This means a seller who was compliant last quarter might not be compliant today, even if their behaviour remains the same.

• Reactive discovery costs more than proactive monitoring: Waiting for a card network enquiry or regulatory audit to reveal a problem puts a platform in a worse position than catching it through routine review.

How does transaction and AML monitoring support compliance monitoring?

Transaction and AML monitoring support compliance monitoring by comparing account activity against a baseline. When activity drifts from that baseline, the system flags it for review.

Here's what that looks like:

• Structuring like patterns: Series of transactions kept just under a review threshold, repeated often enough to look intentional rather than coincidental

• Peaks in speed or value: Sudden jump in transaction volume or dollar amount that doesn’t match the seller’s history or the seasonality of their stated business

• Geographic mismatches: Payment activity that routes through countries the seller has no stated connection to

• Quick movement of funds: Money that arrives and gets withdrawn or transferred fast, with no clear business reason behind the move

• Chargeback or refund clusters: Patterns that point to chargeback fraud, an undisclosed business change, or a seller who’s testing stolen payment credentials

• Layering and integration typologies: Funds moved through multiple transactions to obscure their origin, then reintroduced as legitimate-looking business revenue

Platforms with a Bank Secrecy Act obligation in the US or an equivalent requirement elsewhere are generally required to report suspicious activity to the authorities. This mandate comes with its own documentation and filing timeline. A solution like Stripe Connect gives platforms transaction-level data on connected accounts, enabling risk-based reviews instead of manual spot checks that may catch problems only after they arise.

What role does sanctions screening play in ongoing compliance monitoring?

Sanctions screening reduces risk in ongoing compliance monitoring. The US, EU, UN, and other jurisdictions update their sanctions lists on a rolling basis.

Here’s how it fits into compliance monitoring:

• Recurring seller screening: Sellers, their beneficial owners, and, in some cases, their counterparties are continually checked against updated lists.

• Politically exposed person (PEP) screening: PEPs carry elevated risk even if they aren’t on a sanctions list. Screening covers both categories together.

• Jurisdiction-specific requirements: A seller in a higher-risk jurisdiction, or one whose ownership includes a PEP, generally needs to be reviewed more frequently than a low-risk domestic seller with stable activity.

• Multiple signals: Verification results, ultimate beneficial owner (UBO) data, transaction behaviour, and sanctions screening all feed into the same ongoing risk assessment; they’re not separate, disconnected checks.

What are the risks of inconsistent compliance monitoring after onboarding?

The risks of inconsistent compliance monitoring after onboarding begin with card networks’ holding platforms accountable for what happens on their connected accounts. A pattern of missed warning signs can lead to the following:

• Regulatory fines: Connected accounts that pass onboarding cleanly but are later used for card testing or laundering stolen payment credentials can cause undetected fraud. Without reasonable prevention procedures, that can lead to severe regulatory fines.

• Increased scrutiny: Missed suspicious activity report filings, missed sanctions hits, or outdated UBO records that appear during an examination or audit can increase scrutiny from regulators and auditors.

• Account restrictions: A payment provider or card network might suspend or terminate a connected account tied to a platform that failed to catch escalating risk.

• Reputational damage: When sellers use a platform for activity that draws public or press attention, it reflects on the platform regardless of who committed the underlying violation.

How can platforms evaluate if their compliance monitoring is working?

Platforms can evaluate whether compliance monitoring is working by ensuring that alerts turn into timely, documented decisions and that review frequency reflects each seller’s risk level.

Consider these factors:

• Alert-to-resolution time: This is how long it takes from when a transaction or sanctions alert fires to when someone reviews and closes it. Alerts that sit open for weeks make nearly real-time monitoring pointless.

• False positive rate: If nearly every alert turns out to be nothing, the thresholds will require tuning; otherwise, reviewers might start rubber-stamping alerts out of fatigue.

• Reverification cadence by risk tier: Higher-risk sellers should be reviewed more often than low-risk ones. If everyone follows the same annual schedule regardless of risk, the programme isn’t based on risk.

• Documentation quality: Every escalation, review, and decision needs an audit trail that explains why a seller was cleared or flagged; regulators and card networks will ask for this during review.

• Coverage of ownership changes: Assure that UBO data updates when sellers report a change. It should be dynamic and develop from the original onboarding record.

Platforms on Stripe Connect can build these checks around the verification, screening, and monitoring data Stripe already generates for connected accounts. This eliminates the need to build separate infrastructure to track the same signals.

How Stripe Connect can help

Stripe Connect orchestrates money movement across multiple parties for software platforms and marketplaces. It offers quick onboarding, embedded components, global payouts and more.

Connect can help you:

• Launch in weeks: Use Stripe-hosted or embedded functionality to go live faster and avoid the up-front costs and development time usually required for payment facilitation.

• Manage payments at scale: Use tooling and services from Stripe so you don't have to dedicate extra resources to margin reporting, tax forms, risk, global payment methods or onboarding compliance.

• Grow globally: Help your users reach more customers worldwide with local payment methods and the ability to easily calculate sales tax, value-added tax (VAT) and goods and services tax (GST).

• Build new lines of revenue: Optimise payment revenue by collecting fees on each transaction. Monetise Stripe's capabilities by enabling in-person payments, instant payouts, sales tax collection, financing, expense cards and more on your platform.

Learn more about Stripe Connect or get started today.