Banks Are Blocking Payments to Contractor Payment Providers: What's Happening Country by Country

In 2026, companies with distributed teams hit a new problem. A payment to their contractor payment provider that had gone through without a hitch for years is suddenly rejected by their own bank, with no warning and no explanation. In recent weeks, we've heard from companies whose banks in the UAE and the US did exactly that.

Behind this is consistent regulatory policy rather than one bank acting on its own. Over the past few years, regulators have built a system in which a bank that handles transactions involving sanctioned banks puts its access to US dollar correspondent accounts at risk. Banks are also expected to scrutinise anything with a Russian connection, from where the money ends up to who owns the counterparty and which companies it's related to, whether that link is direct or runs through an intermediary.

Below we look at why this is happening, what banks focus on in different jurisdictions, and what to do if a payment has already been stopped.

It's written for founders, CFOs and heads of HR at companies with distributed teams, particularly those that pay contractors in Russia, Belarus and other higher-risk jurisdictions through an intermediary.

We've covered why a company remains responsible for payments it makes through an intermediary in “When Contractor Payments Become a Sanctions Risk”, and how a provider's sanctions exposure comes up in investor due diligence in “How Your Contractor Payment Provider Could Cost You Your Next Round”. This piece focuses on the banks.

If you want to see how your payment chain looks through a bank's eyes, book a 20-minute call with Finboo's compliance team: https://finboo.io/en/demo

Banks are behaving this way in 2026 because of a series of regulatory decisions that began in late 2023.

• December 2023. US Executive Order 14114 gave the US Treasury the power to sanction a foreign bank for significant transactions with persons linked to Russia's military-industrial base, up to and including a ban on US correspondent accounts.
• February 2024. The operator of the Mir payment system, NSPK, was added to the US sanctions list. Soon after, banks in Armenia and Kyrgyzstan stopped accepting Mir cards.
• June 2024. OFAC expanded “Russia's military-industrial base” to cover all persons blocked under the main Russia executive order, including Russia's largest banks. Significant transactions with any of them now create sanctions risk for a foreign bank.
• January 2025. The risk became real: Kyrgyzstan's Keremet Bank was added to the US sanctions list for making transfers on behalf of sanctioned Promsvyazbank, under the same Executive Order 14114.
• 29 January 2026. Russia was added to the EU list of high-risk third countries, and European banks are now required to apply enhanced checks to anything connected with it.

For any bank that relies on access to the US dollar, the logic is the same: it's cheaper to reject a questionable payment than to explain it to a regulator.

The first thing a company notices is the silence. The payment fails or bounces back, and when you ask why, the bank either gives a stock answer or doesn't reply at all.

That isn't sloppiness on the bank's part. If it has filed a suspicious activity report with its financial intelligence unit, the law prohibits it from telling the client. This tipping-off ban applies in the EU (Article 39 of Directive (EU) 2015/849), in the US (the confidentiality rules for suspicious activity reports under the Bank Secrecy Act) and in the UAE (under federal anti-money laundering law).

So silence doesn't mean nothing serious is going on. Often it means the opposite: the bank can't give a reason precisely because the review has gone beyond a routine request for documents.

There's also a less obvious consequence. A bank can stop serving a client, or a particular type of payment, simply because the risk no longer seems worth it. It doesn't have to prove a violation or justify its decision, which usually leaves the company with nothing concrete to dispute.

To the company, paying a contractor payment provider is just paying for a service: an invoice, a payment reference, bank details at a bank in the EU, the UK, the US or Asia. To the bank, it's the start of a chain, and it needs to know where that chain ends.

A bank's compliance team will typically look at the following.

Who the recipient is. The bank vets the provider as its client's counterparty: who the beneficial owners and directors are, where and with what history the group's companies are registered, and which banks serve them. Citizenship of owners and directors is a separate factor: Russian or Belarusian citizens in the provider's structure, even with EU residence permits, are in themselves a reason for enhanced due diligence at many banks, especially since Russia was added to the EU high-risk list. Many providers also have related Russian companies within their group. To a bank, that's a direct Russian link in the chain, even if your own payments never go through those companies.

Where the money goes next. If public information shows that the provider pays out to higher-risk countries, the bank assesses not a single payment but the whole route: which companies, countries and banks the money passes through before it reaches the end recipient. An intermediate jurisdiction such as Armenia, the UAE, Kazakhstan or Hong Kong does not isolate the risk. EU and US regulators explicitly treat such chains as potential sanctions circumvention, and the EU's 20th sanctions package banned settlements through netting and set-off in third countries where they undermine the purpose of the restrictions.

What is publicly known about the provider. The compliance officer searches the provider's name. Reports of sanctions circumvention, investigative journalism and mentions in sanctions databases are adverse media, and once they are on the radar, neither the bank nor its client can claim ignorance.

How often the provider's bank details change. If the recipient regularly changes banks, with some accounts marked “no longer available” and new ones appearing in their place, this may mean that its previous banks have stopped serving it. For the sending bank's compliance team, this is a visible signal: the recipient is losing banking partners.

What the payment flow itself looks like. Regular round amounts, growing volumes, a “software development services” reference while the money is in fact distributed to dozens of people in another country: to transaction monitoring systems, these are signs of transit rather than payment for work. If each payment is not backed by a contract with the contractor and an acceptance certificate signed by both sides confirming the work was done, questions arise almost automatically.

Then there's an external factor: the correspondent bank. Dollar payments go through US banks, euro payments through European ones. If the correspondent has questions about the recipient, it asks the sending bank. If the answers aren't convincing, the sending bank will usually just stop processing those payments rather than put its correspondent relationships at risk.

The risk to the bank is real. In 2026, the UK regulator OFSI fined both the payer, Apple's Irish subsidiary, and the bank that executed the payments, Deutsche Bank's London branch, over the same 2022 payments. The recipient's sanctions status changed after the relationship had begun, and screening missed it. That is why a bank would rather reject a questionable payment than execute it and answer for it years later.

Banks in different countries follow much the same logic. What differs is the trigger and the timing. Here is what we know about the main corridors.

UAE. Emirati banks clear dollars through US correspondents. Since December 2023, the US has been able to sanction a foreign bank for significant transactions involving Russian persons on its sanctions list, up to cutting off its US correspondent accounts. Since June 2024, OFAC has treated everyone blocked under Executive Order 14024 as falling under this rule, including Russia's largest banks. The country's own track record matters too. The UAE came off the FATF grey list in February 2024 and the EU high-risk list only in July 2025. The regulator itself is quick to act: in March 2023 the Central Bank of the UAE revoked the licence of MTS Bank's Abu Dhabi branch, citing sanctions risk.

US. For an American bank, sanctions compliance is a legal obligation, not a matter of risk appetite. It may not deal with anyone on OFAC's sanctions list, and civil liability applies even without proof of intent. In 2024, the statute of limitations for sanctions violations was extended from five to ten years. In practice, the bank looks beyond its client to where the client's money goes through an intermediary.

EU and UK. Since 29 January 2026, Russia has been on the EU list of high-risk third countries, and European banks must apply enhanced due diligence to business relationships and transactions connected with it. We covered how this works in our article on the EU high-risk country list. Directive (EU) 2024/1226 has also set EU-wide standards for criminal liability for sanctions circumvention, and in the UK, OFSI can impose fines without having to prove intent. For a provider with a European or British entity, routing “prohibited” payouts through an affiliate in a third country counts as circumvention.

China and Hong Kong. China's largest banks, ICBC and China Construction Bank, stopped accepting payments from sanctioned Russian banks as early as the start of 2024. By autumn 2024, according to Russian business media, Chinese banks had begun screening payments from the UAE, India and Hong Kong for Russian links, looking at where the money came from rather than which country sent it.

Singapore. Singapore is one of the few Asian jurisdictions with its own sanctions against Russia. Since March 2022, every financial institution in the country, payment companies included, has been barred from dealing with VTB, VEB.RF, Promsvyazbank and Bank Rossiya. Like Emirati banks, Singaporean banks also clear dollars through US correspondents and are exposed to the same US secondary sanctions logic. A provider's account in Singapore offers no protection. It's simply one more bank with obligations of its own.

Turkey. After the secondary sanctions order of December 2023, Turkish banks cut correspondent ties with most Russian banks and started closing accounts of Russian companies. Companies that had used Turkey as a transit jurisdiction for payments were caught up as well.

Armenia, Kazakhstan and Central Asia. Back in 2023, the Central Bank of Armenia warned that local banks were having to refuse transfers because Western correspondent banks were reviewing their transaction controls. The National Bank of Kazakhstan acknowledged the risk of secondary sanctions as legitimate grounds for commercial banks to be cautious. And in December 2025, after the European Commission decided to add Russia to the high-risk list, banks in Armenia, Kazakhstan, Tajikistan and several other countries tightened checks on Russia-related transactions, according to RBC.

The upshot is simple. There are fewer and fewer “friendly” jurisdictions left that can screen out a Russian link. An intermediate country in a payment chain doesn't remove the risk. It adds one more bank that can stop the payment.

The bank's questions are addressed to you, not to the provider. The provider can carry on as usual, but it's your bank that stops the payments, and you're the one who has to deal with it.

Operational risk. The most obvious consequence is that your team doesn't get paid. Finding a new provider, vetting it, signing a contract and making the first payouts takes days or weeks, and your contractors are waiting the whole time.

Risk to the company's account. The bank may simply refuse specific payments, or it may decide that a client with this kind of counterparty isn't a fit and close the account altogether. Opening a new account with that history is harder than keeping the one you have.

Historical risk. If your previous provider changed its policy and stopped paying into sanctioned banks, that covers future payments, not past ones. Payouts made through the provider stay on your company's statements, and limitation periods for sanctions violations run for years: ten years in the US, while in the EU, Directive 2024/1226 requires member states to set at least five years from the date of a serious offence, and some go further. We explained why the client shares responsibility for payments made through an intermediary in “When Contractor Payments Become a Sanctions Risk”.

Risk in investor due diligence. A rejected payment or a closed account is something you'll be asked about in your next round or in a sale of the company. We looked at how this affects valuation and deal terms in a separate article.

A block is rarely the first warning sign. It's usually preceded by document requests, questions about the payment reference and delays of a few days. If you've already had requests like these, look into your payment chain now, before the payments stop.

Moving to a provider with a verifiable chain is easier before the bank starts asking questions than after. Once your account is under review, the bank will look closely at every new payment, even one to a different provider, while your team waits to be paid. Switching ahead of time takes a few days. Switching under pressure also means explaining yourself to the bank and holding up payouts.

What not to do. Don't resend the payment with a different reference, through a different entity or in smaller amounts. To a regulator, that is no longer carelessness. It looks like an attempt to get around controls, and it counts as an aggravating factor.

1. Answer the bank's request fully and promptly. A request for information is your chance to keep the account. An evasive answer moves the company from “looking into it” to “hiding something”.
2. Gather the documents for the payment: your contract with the provider, invoices, acceptance certificates and details of the end recipients. If the provider can't show you the chain down to the contractors' banks, that tells you something too.
3. Look back at your history. Check which banks your team actually received money in, and whether the sender matched the entity named in the documents. If the history isn't clean, speak to a sanctions lawyer before you do anything else.

Over recent weeks, several companies have come to Finboo after their banks stopped clearing payments to their previous providers. We are built so that every question a bank might ask has a documented answer ready: a European structure with no Russian entities anywhere in the chain, payouts to non-sanctioned banks only, a contract and act behind every payment — and the full route to the contractor's bank visible in advance. We'll review your payment set-up free of charge and in confidence, and show you how it looks through a bank's eyes.

Book a review

Finboo — payments to global teams without hidden fees, sanctions exposure or reputational risk.

The best way to see how your payment chain looks to a bank is to ask your provider the same questions the bank would ask. If you can't get clear answers, neither will your bank.

1. Who are the provider's beneficial owners and directors? Their citizenship and where the group's companies are registered are the first things a bank sees when it vets a counterparty.
2. Which entity and which bank are you paying? And which entity and which bank do your contractors receive money from? If these are in different jurisdictions, ask for the full route.
3. Which banks does the money pass through to reach the contractor? If the provider can't name them, or says only its payment partners have that information, neither the provider nor you can verify the chain.
4. Does the provider pay into sanctioned banks, for you or for other clients? Even if your own contractors are paid into “clean” banks, the provider's flows into sanctioned banks make any payment to it risky.
5. Since when has its current policy been in place? Restrictions on Russia's largest banks have applied since 2022, not since the latest sanctions packages.
6. What documents are there for each payout? A contract with the contractor and an acceptance certificate, both signed by both parties. These are what you'll show your bank if it asks.

If you already work with a provider, you can get some of these answers without it. Just ask your contractors who the money comes from and which bank it's sent from.

A contractor payment provider's sanctions exposure is no longer something that might come up one day in a regulator's review or an investor's due diligence. Today it's the paying company's own bank that checks it, and the consequences are immediate: payments stop, with no explanation.

• Banks in the UAE, the US, the EU, Singapore, China, Turkey and Central Asia all work the same way: access to the dollar and to Western correspondents matters more than any single client.
• An intermediate jurisdiction in the chain doesn't isolate the risk. It adds one more bank that can stop the payment.
• The bank puts its questions to the payer, not the provider, and a provider's change of policy doesn't wipe out the history of past payments. Moving to a provider with a verifiable chain costs less before the bank starts asking than after.

You can check your payment chain in a single conversation with your provider. The six questions above will give you a clear enough picture.

If you want to see how your payment chain looks through a bank's eyes, book a 20-minute call with Finboo's compliance team: https://finboo.io/en/demo

Sources

US: secondary sanctions on foreign banks. Executive Order 14114 (22 December 2023); OFAC FAQ 1181 and updated guidance for foreign financial institutions (12 June 2024). Analysis: K2 Integrity, Holland & Knight.

US: Mir operator NSPK. US Treasury press release, 23 February 2024.

US: Keremet Bank. Willkie Farr & Gallagher, January 2025.

US: statute of limitations. 21st Century Peace through Strength Act, Pub. L. 118-50, §3111 (24 April 2024). https://ofac.treasury.gov/media/933056/download

EU: criminal liability for sanctions circumvention and limitation periods. Directive (EU) 2024/1226, including Article 11. https://eur-lex.europa.eu/eli/dir/2024/1226/oj; analysis: Clyde & Co.

EU: tipping-off ban. Directive (EU) 2015/849, Article 39. https://eur-lex.europa.eu/eli/dir/2015/849/oj

UK: penalties over the Okko payments. OFSI penalty notices: Apple Distribution International (19 March 2026), Deutsche Bank AG London Branch (2026). Analysis: Crowell & Moring, Duane Morris.

UAE: exit from the FATF and EU lists. Herbert Smith Freehills Kramer, 2025.

UAE: MTS Bank licence revoked. Central Bank of the UAE press release, 31 March 2023.

Singapore. Allen & Gledhill.

China. Kommersant UA, February 2024; NV, November 2024.

Turkey. bne IntelliNews / Reuters, February 2024.

Armenia, Kazakhstan, Central Asia. Central Bank of Armenia via The Moscow Times; Eurasianet, March 2025; RBC via Novaya Gazeta Europe, December 2025.

This article is for information only and does not constitute legal advice.