Outside the Measures: What R16 Does With the Prepaid Risk

When the Financial Action Task Force (FATF) published its draft implementation Guidance for the revised Recommendation 16 (R16) on 24 June 2026, it did something that deserves more attention than it has received. At paragraph 184, it set out with unusual candour why prepaid cards are not like the other instruments sharing their form factor. Customer due diligence is sometimes not conducted on prepaid cardholders. Cards can be passed to third parties unknown to the issuer, because multiple cards may be issued against a single registration. The cards are reloadable, and the Guidance gives the example of small retail shops that are not regulated entities for anti-money laundering purposes. Yet having described the problem accurately, the Guidance places the remedy outside the standard it was writing.

My article on"The Point of Sale Blind Spot" that the card exemption had been carried into the revised standard largely untouched, and that the boundary between purchase and transfer was doing more work than it could bear. The draft Guidance answers part of that. It does not answer this part. The prepaid question is not ignored in Chapter 6; it is acknowledged, characterised and then handed to somebody else.

FATF names the risk precisely

The candour of paragraph 184 is worth dwelling on, because standard-setting documents rarely concede this much. R16 sets equivalent requirements between credit, debit and prepaid cards, the paragraph states, before immediately noting that prepaid cards may demonstrate unique features. Three are given. The cardholder may never have been identified. The card may be in hands the issuer knows nothing about. The card may be topped up through a channel that carries no obligations at all.

Each of those observations attacks the premise of the card exemption. That exemption has always rested on identifiability: transactions flow through networks with their own controls, issuers and acquirers can be located through directories, and merchants are onboarded by an acquirer following due diligence, a requirement the Guidance reinforces at paragraphs 187 and 188. Limited originator information in the payment message is tolerable because fuller information exists elsewhere, held by an institution that can be reached.

That premise fails outright for one class of instrument. Paragraph 184 concedes as much: where no due diligence was conducted, the fuller information waits nowhere at all.

The remedy leaves the R16 standard

Having established that, the Guidance disposes of it in a single closing sentence. Control measures should be applied on a risk basis, it says, and it offers transaction amount caps and velocity limits as examples. Those measures are placed, in terms, "outside the measures of R16".

Read it carefully and two things are missing. There is no addressee: the sentence does not say whether the expectation falls on issuers, on acquirers, on countries or on supervisors, and each would discharge it differently. And there is no indication of level. A cap of five thousand and a cap of fifty both satisfy a sentence that specifies neither, which matters because the effectiveness of such a control is entirely a function of where it is set.

The construction is familiar. A risk is identified, a direction of travel is indicated, and the mechanism by which anyone would demonstrate compliance is left unwritten. The difference from other examples in the same document is that here the drafters have gone further and stated that the measure does not belong to the standard at all.

The remedy belongs to no Recommendation

The Guidance is careful elsewhere about where obligations live. Paragraphs 38 to 40 draw the boundary between R16 and Recommendation 10 with some precision: R16 does not prescribe the full range of customer due diligence obligations, which sit under Recommendation 10, while R16 adds targeted verification requirements tied to payment transparency. A reader who asks why prepaid cardholder identification is not an R16 matter has therefore been given an answer. It is a Recommendation 10 matter.

That answer does not reach the measures paragraph 184 actually names. Transaction amount caps and velocity limits are not customer due diligence. They are not identification, verification or record keeping. They are product design constraints, and no Recommendation claims them.

Recommendation 10 does not require them; paragraph 184 states that R16 does not. The Guidance identifies a control, commends it, and leaves it attached to nothing.

The consequence is more than untidiness. A control located inside a Recommendation is assessed when that Recommendation is assessed; a firm can be examined on it, and a country can be marked down for its absence. A control located outside every Recommendation is a suggestion. It can be adopted seriously, adopted nominally or ignored altogether, and nothing in the assessment methodology distinguishes between the three.

Nor do caps and velocity limits do the work that identification does. A cap constrains the size of a single anonymous transaction; it does nothing about structuring beneath it, about multiple cards issued against one registration, or about the aggregate flow that results. Velocity limits govern frequency on one instrument, not distribution across many. These are sensible controls and they reduce exposure. What they do not produce is a name that an investigator can follow.

Europe conditioned anonymity on purchase

The comparison with the European approach is instructive, and it is uncomfortable.

Europe reached the opposite conclusion, and it did so with conditions rather than adjectives. Article 12(1) of Directive (EU) 2015/849 allows obliged entities to disapply certain customer due diligence measures for electronic money only where five conditions are satisfied together.

Those conditions are cumulative and they are demanding. The instrument must not be reloadable, or must carry a maximum monthly transaction limit usable in one Member State only. The maximum amount stored electronically must not exceed that same figure. It must be used exclusively to purchase goods or services, it cannot be funded with anonymous electronic money, and the issuer must monitor transactions sufficiently to detect unusual or suspicious activity.

The arithmetic was tightened three years later, and the architecture was left alone. Directive (EU) 2018/843 cut both the monthly transaction limit and the stored value ceiling from EUR 250 to EUR 150, disapplied the derogation altogether for cash redemption or withdrawal above EUR 50 and for remote payment transactions above EUR 50, required acquirers to accept anonymous prepaid cards issued in third countries only where the issuing regime is equivalent, and allowed Member States to refuse such cards on their territory entirely. The reasoning is stated plainly in the Directive's own recitals: general purpose prepaid cards have legitimate uses and contribute to financial inclusion, but anonymous ones are easy to use in financing terrorist attacks. Regulation (EU) 2024/1624 replaces this directive-based regime with a directly applicable single rulebook from 10 July 2027.

Two of those five conditions deserve particular attention, because Chapter 6 uses both and uses them differently. Purchase-only use, at Article 12(1)(c), is in Europe a condition of being permitted to remain anonymous. Issuer monitoring, at Article 12(1)(e), is another. In the draft Guidance, purchase-only use is instead the trigger for relief from transparency obligations, and monitoring-type controls are precisely what paragraph 184 places outside the standard.

Two regimes have drawn the same line and reached opposite conclusions from it. In one it marks the edge of what may stay anonymous. In the other it marks the point at which the questions stop. A firm operating across both is not managing a difference in stringency; it is managing a difference in what the line is for.

Firms inherit an unbenchmarked judgement

For institutions, the practical consequence is that a control the Guidance describes as appropriate has no stated content, and responsibility for giving it content falls where it usually falls.

Issuers of prepaid products should be able to say what caps and velocity limits they apply, how those figures were derived, and against what risk assessment they were set. Deriving them from competitor practice or from scheme defaults is not a risk-based judgement; it is an inherited one. Where an institution issues instruments that can be acquired without identification, it should also establish what it could produce if a competent authority asked who held a given card, and treat the answer as a finding rather than a fact of life.

Acquirers and firms relying on the exemption face the mirror question. Applying simplified treatment to a card transaction means relying on somebody else's merchant onboarding and, where the instrument is prepaid, on somebody else's product controls. That is a reliance arrangement in substance whatever it is called internally, and it should be documented, evidenced and periodically tested as one.

Above both sits a governance point. Card exemption treatment is rarely surfaced to a board as a decision; it is inherited from scheme rules and systems configuration and seldom revisited once set. A firm that cannot say when its exemption logic was last examined against the revised standard has not reached a proportionate judgement about it. It has reached no judgement at all.

The question the exemption avoids

FATF should be given credit for paragraph 184. It would have been easier to leave prepaid cards inside a general statement about equivalent treatment and say nothing further. The drafters instead described the vulnerability in plain terms, which is the necessary first step toward addressing it.

What follows the description is where the difficulty lies. The Guidance identifies a class of instrument for which the exemption's founding assumption does not hold, and then declines to adjust the exemption, directing attention instead to controls it places beyond its own scope. The risk is acknowledged in the text and absent from the requirements.

Transparency standards work by ensuring that somebody, somewhere, can answer a question about who moved value. For most instruments R16 now answers it well. For one instrument the standard concedes that nobody may be able to answer it, and responds by suggesting the amounts be kept small. Keeping the sums modest is not the same as knowing whose they are.

Do you know which of your card flows depend on an instrument nobody has ever identified, and could you evidence that position tomorrow?

If the caps and velocity limits sitting behind it were inherited from scheme defaults rather than set against your own risk assessment, we can help you establish the position and defend it; contact us.

At OpusDatum, we help firms navigate the evolving payment transparency landscape with clarity and rigour. Our work on wire transfer regulation tests whether the exemptions a firm relies on would survive supervisory examination, and whether the controls sitting behind them are documented and evidenced or merely assumed.