Transfer Limits and Compliance Considerations

Paystack imposes limits on transfers at several levels. These limits protect both Paystack and your business from fraud and comply with local financial regulations.

Per-transaction limits: The maximum amount for a single transfer. This varies by destination type (bank account vs mobile money) and currency.

Daily limits: The total amount you can transfer in a 24-hour period. This resets daily and applies across all transfers from your account.

Account tier limits: Your Paystack account has a tier based on your KYC (Know Your Customer) verification level. Higher tiers allow higher limits. A newly created account with basic verification has lower limits than a fully verified business account.

These limits can change as Paystack updates their policies and as you upgrade your account tier. Always check your Paystack dashboard for the current limits that apply to your specific account. Do not hard-code limit values in your application because they may become outdated.

Paystack uses tiered KYC verification. Each tier requires more documentation but unlocks higher limits and additional features.

Basic tier: Business registration and basic owner information. Gets you started with transfers at lower limits. Sufficient for testing and early-stage products.

Intermediate tier: Additional documentation such as business address verification, director identification, and possibly financial statements. Higher transfer limits.

Full tier: Complete business verification including all directors, beneficial owners, bank statements, and possibly regulatory licenses. Highest transfer limits and full API access.

To upgrade your tier, log into the Paystack dashboard and navigate to Settings > Compliance or Business Verification. Submit the required documents for the next tier. Paystack reviews submissions and typically responds within a few business days.

If your payout volumes are growing and you are approaching your current limits, start the upgrade process before you hit the ceiling. Waiting until transfers start failing because of limit violations creates unnecessary pressure on both your team and the verification process.

Even if your Paystack account can send large transfers, the recipient's account may not be able to receive them. Bank accounts and mobile money wallets have their own limits.

Nigerian bank accounts: Tiered KYC applies. Tier 1 accounts have daily transaction limits. Tier 2 and 3 accounts have progressively higher limits. If your transfer would push a Tier 1 recipient over their daily limit, it fails.

M-Pesa wallets (Kenya): M-Pesa has per-transaction and daily transaction limits that depend on the account tier. Safaricom sets these limits and updates them periodically.

Ghanaian mobile money: Similar tiered limits based on registration level. Basic registered accounts have lower limits than fully registered accounts.

You cannot check a recipient's current tier or remaining daily limit through the Paystack API. These failures surface as transfer.failed events with a reason related to limits. When you see these failures, inform the recipient that they may need to upgrade their account tier with their bank or mobile money provider.

// Pre-validate transfers against known limits
// Store your current limits (update when they change)
var TRANSFER_LIMITS = {
  NGN: {
    perTransaction: 100000000, // Example: check dashboard for actual value
    daily: 500000000,          // Example: check dashboard for actual value
  },
  KES: {
    perTransaction: 50000000,
    daily: 200000000,
  },
};

async function validateTransferLimits(amount, currency) {
  var limits = TRANSFER_LIMITS[currency];
  if (!limits) {
    return { valid: true, warning: 'No limits configured for ' + currency };
  }

  if (amount > limits.perTransaction) {
    return {
      valid: false,
      error: 'Amount exceeds per-transaction limit of '
        + (limits.perTransaction / 100) + ' ' + currency,
    };
  }

  // Check daily usage
  var todayTotal = await db.payouts.sumInitiatedToday(currency);
  if (todayTotal + amount > limits.daily) {
    return {
      valid: false,
      error: 'Would exceed daily limit. Today total: '
        + (todayTotal / 100) + ', Limit: '
        + (limits.daily / 100) + ' ' + currency,
    };
  }

  return { valid: true };
}

These checks prevent you from sending transfers that will fail at the API level. Catching limit violations before the API call saves time, preserves your rate limit quota, and gives you clearer error messages to pass to your operations team or vendors.

If you are building a payout system that handles money on behalf of third parties (marketplace vendor settlements, creator payouts, contractor payments), you may be subject to financial regulations in your jurisdiction.

Nigeria: The CBN (Central Bank of Nigeria) regulates payment service providers. If you are holding funds on behalf of vendors and disbursing through transfers, you may need a specific license or need to operate through a licensed entity. Paystack is licensed, but your platform's arrangement with Paystack determines whether you need additional licensing.

Kenya: The CBK (Central Bank of Kenya) and the Communications Authority regulate payment services and mobile money. Holding customer or vendor funds triggers regulatory requirements.

Ghana: The Bank of Ghana oversees electronic money issuers and payment service providers.

Anti-money laundering (AML): All African markets have AML requirements. If you process payouts above certain thresholds, you may need to implement transaction monitoring, suspicious activity reporting, and customer due diligence measures.

This is not legal advice. Consult with a financial regulatory advisor in your jurisdiction to understand the specific requirements that apply to your business model. The key question is: are you holding funds on behalf of others, and if so, what licensing or regulatory registration does that require?

Regardless of specific licensing requirements, keep detailed records of all transfers. Most African regulatory frameworks require financial records to be kept for 5-7 years.

For each transfer, store: the date and time, the amount and currency, the sender (your business), the recipient (name, account details), the purpose or reason, the Paystack reference and transfer code, the status (success, failed, reversed), and any failure reasons.

Do not rely solely on Paystack's records. Maintain your own database of all transfer activity. Paystack's data retention policies may differ from your regulatory requirements. Your database should be the primary record, with Paystack as a secondary reference.

For reconciliation between your records and Paystack, see reconciling payouts against recipient confirmations.

Transfer limits and compliance are not the exciting parts of building a payout system, but they are the parts that keep your business operational and legally sound.

The McTaba bootcamp covers payment systems with attention to the regulatory context of African markets.

Create a free McTaba account