The grey-list exit was the easy part. The Travel Rule rewrite is the hard one.

On 24 October 2025, at the Paris plenary, FATF removed Nigeria and South Africa from the list of jurisdictions under increased monitoring. Mozambique and Burkina Faso came off the same day. Thirty-two months on the list for both Nigeria and South Africa, both since February 2023. The Nigerian Finance Minister, Wale Edun, said the Action Plan "was not the ceiling, but the floor of our aspirations". The Paga founder Tayo Oviosu called it "a big deal" for FDI and engagement from the West.

Reading the coverage that week, you would think the compliance bill had been paid in full. It had not. Four months earlier, in June 2025, FATF had rewritten Recommendation 16. The threshold on cross-border transfers came down to $1,000. The data quality bar went up. Structured beneficiary name, account number, country, town name. For legal entities, a BIC or an LEI or a unique official identifier. The information "should be structured to comply with established standards (e.g., ISO 20022)". The implementation deadline is end of 2030, which sounds like a runway until you remember that US and EU correspondent banks will apply the new bar unilaterally and early, the way they always do.

So the two largest economies on the continent exited a grey list and walked into a tighter version of the rule they had been trying to get clean on. The treasurer in Lagos paying a London supplier in Q4 2025 faces the same mid-chain rejection risk she faced in Q4 2023. Only now the rule that causes the rejection is stricter, and her bank has a fresh 12-month post-observation period from FATF to demonstrate she is being held to it.

I changed my mind on this in the middle of drafting it. I came in thinking the right framing was "celebration was premature". That is true, but it understates what is happening. The grey-list exit and the R.16 rewrite are not two separate stories. They are the same story. Delisting cleared the explicit flag the correspondent banks were using as a shortcut. The R.16 rewrite gave them a new, sharper shortcut. The compliance gap did not close. It moved up a layer, into the data on the wire.

What the rewrite actually changed

Under the old R.16, a UK bank routing a payment from a London corporate to a Lagos supplier needed the originator name and account number, the beneficiary name and account number, and enough address detail to satisfy domestic sanctions screening. Most of that lived as free text in the message. The intermediary banks did their own screening on what they saw. If they did not like it, they could query or return. The mid-market AP team rarely saw any of this. The bank absorbed it.

Under the rewrite, the threshold for full data is $1,000. Most B2B invoices between African corporates and their overseas suppliers cross that threshold. The required fields are structured. The address is not one line. It is street name, building number, town name, country subdivision, country code, each as a discrete element. The identifier on the beneficiary, for legal entities, is a BIC or an LEI or a unique official identifier. CGAP noted that many institutions, faced with a $1,000 threshold and the operational cost of running two regimes, "choose to require full (non-simplified) data for all transactions and choose not to implement the threshold at all". So the practical floor on a Nigerian SME paying a South African supplier is not $1,000. It is zero.

South Africa already walked through the door on the zero-threshold version. Directive 9, from the FIC and FSCA, took effect on 30 April 2025. It applies the Travel Rule to crypto-asset transfers with no de minimis. Zero-value transactions are in scope. The Financial Intelligence Centre's joint advisory said, in writing, that "neither the FIC nor the FSCA can grant exemptions from Directive 9 or FICA". Abraham Udu, the ACFCS West Africa director, called Directive 9 "over-ambitious and does not align with the risk-based approach principle for proportionality". He is right. He also has to live with it.

The exit trap, in one operational sentence

A treasury team at a Lagos manufacturer pays a Johannesburg supplier $4,800 against an invoice for components. The originating Nigerian bank wires through a US dollar correspondent in New York, which routes through a South African beneficiary bank. Three hops, three sets of screening, three places the message can be rejected if the structured fields are not populated correctly. The originating bank's checks passed. The New York correspondent NAKs on a missing structured town name on the beneficiary record. The funds are held. Eight business days later the supplier still does not have the money, the manufacturer has fielded three emails, and the AP lead is on a call to the bank trying to find out which field she should have populated.

That is what the exit trap looks like in a single transfer. The grey-list flag is gone. The correspondent bank is still doing the screening that flagged it before, on a richer rule, against data the Nigerian ERP was not designed to produce. The R.16 rewrite is the floor, and the US-based correspondent has every incentive to run a stricter rule than the floor on traffic from a recently delisted jurisdiction.

There is a Kenyan version of this story that is even harder, because Kenya did not exit. Kenya went on the FATF grey list in February 2024 and was not removed at the June 2025 plenary. The EU added Kenya to its AML high-risk list in June 2025 as well. A Nairobi corporate paying a European supplier is now carrying both a fresh R.16 data burden and an active grey-list flag. The two compound.

What PAPSS does and does not solve

The Pan-African Payment and Settlement System is the most honest answer the continent has built to dollar-correspondent dependency. It is now live in 16 countries with 15 financial institutions and 14 national switches connected, per PAPSS as of mid-2025. The CBN's April 2025 circular simplified KYC documentation for PAPSS transactions below $2,000 for individuals and $5,000 for corporates, using basic KYC the banks already hold. That is real progress on intra-African friction.

PAPSS does not exit the rule. It runs inside it. The originator and beneficiary data still has to be present on every hop. PAPSS just makes the hops shorter and keeps them on rails the African banks control. Its MANSA repository is its answer to the structured-KYC problem, but the corporate AP team still has to put the right data on the wire. The same Lagos manufacturer paying the Johannesburg supplier through PAPSS instead of through New York still needs the structured beneficiary town name. The rejection point moves. The rejection does not disappear.

What this means for an AP function paying into or out of Africa right now

The questions to ask of your current setup are not the ones your bank relationship manager will answer. They are the ones your data model has to answer. Does your supplier master hold beneficiary address as structured fields or as a concatenated string. Does the legal-entity record carry a BIC or an LEI or a unique official identifier, populated. Does your payment instruction template produce structured ISO 20022 elements on every cross-border transfer over $1,000, or only above the older wire-transfer thresholds. Do you know which payments NAKed in the last quarter, where in the chain, on what field. If the visibility ends at the originating bank's confirmation, you are running the workflow that gets caught by the rewrite.

We built the supplier business partner record as a structured document from the start, with a separate compliance block that holds Travel Rule beneficiary data as discrete elements rather than free text. That was not a flashy decision. It mattered when the June 2025 rewrite landed. It matters more now that Nigeria and South Africa are off the grey list and their banks are operating under a fresh 12-month FATF observation window with a stricter data rule on every cross-border message.

If you are running cross-border supplier payments into or out of Africa and you have not audited what your ERP actually puts on the wire against the rewritten R.16 fields, sign up at calabash.app and we will walk through one of your recent international payment instructions, field by field, and tell you which ones would have stopped at the second hop.