Why Was My Payout Frozen? PayPal, Stripe and Shopify Payments Sanctions Holds Explained

Last reviewed: 8 October 2026. Payment providers don't publish their full screening logic; this guide relies only on what they state publicly. It is not legal advice.

Quick answer

Payment providers are regulated, and they must not process payments for sanctioned persons or embargoed places. When a payment, a payout or an account looks like it might involve a sanctions issue, they pause it and review it. The message in your admin or inbox is the authoritative explanation; generic advice online is not. Answer exactly what the provider asks, with documents, and don't guess.

You usually can't make a provider skip its review. You can make it rarer by keeping restricted destinations and parties out of your order flow before a payment is ever taken, and by being able to show what you checked.

Why providers pause payments

Every major provider has its own sanctions program because it is directly liable for the payments it processes. What they say publicly:

• PayPal / Venmo. PayPal states that Venmo "screens payment activity and flags any payments that may violate U.S. economic sanctions administered by" OFAC. If the note on a payment raises concerns, the payment is paused and the sender is told it is "in review." The company says it aims to review and contact users "in 72 hours or less" (PayPal newsroom). PayPal has its own enforcement history: in March 2015 it paid OFAC $7,658,300 to settle 486 apparent violations, after OFAC found its screening didn't correctly identify potential SDN matches and agents dismissed alerts.
• Stripe. Stripe's restricted businesses page prohibits dealing with persons located in, resident in or nationals of Cuba, Iran, North Korea, Syria, or the Crimea, Donetsk and Luhansk regions. It also prohibits persons on US, UK, EU or UN restricted-party lists, naming OFAC sanctions and the Commerce Department's Denied Persons and Entity Lists.
• Shopify Payments. Shopify's page on Shopify Payments account holds says holds "are account specific." Among the possible causes it lists information requirements, incorrect bank details, product eligibility, an incompatible business model, sanctions based on business location, and creditor or legal actions.

Payment processors were penalized when their screening failed. Payoneer paid OFAC $1,400,301 in July 2021 over weak screening algorithms, failure to monitor IP addresses and flag addresses in sanctioned locations, and software that auto-released flagged payments during backlogs. BitPay paid $507,375 in February 2021 for not using buyers' location data. Providers have every reason to be cautious.

Three kinds of hold, three different fixes

What's held	Typical trigger	Who it's really about
A single payment ("in review", "pending")	A name, note, country or IP on that payment looked like a possible sanctions issue	Your customer or the transaction
Your payouts	Account verification, risk review, or a compliance concern about your activity	You, or a pattern in your orders
Your whole account	A sanctions or legal concern about your business, its location or its owners	You

The fix depends on which one it is, which is why the provider's own message matters more than anything else.

What to do when it happens

1. Read the exact notice. Shopify's guidance is that "the best source of information to resolve the issue is either the notification in your Shopify admin or the email that's sent to the store owner." The same applies to PayPal and Stripe.
2. Answer only what's asked, factually. Providers commonly ask what was sold, to whom, where it was shipped, and the purpose of the payment. Provide invoices, order details and shipping documents.
3. Don't ship while a sanctions review on that order is open. If the payment is paused because the buyer may be sanctioned, shipping the goods could be the violation.
4. Don't tip the buyer off. If you contact the customer, keep it neutral: "your payment is being processed" or "your order is under review." Don't mention a suspected sanctions match.
5. Check the party yourself. Screen the customer, the recipient and the company against the lists that apply to you, and check the destination. If you find a credible match, stop and get legal advice. Some regimes require reports, for example blocked-property reports to OFAC for US persons. In the UK, mandatory OFSI reporting applies to "relevant firms."
6. Keep a record of the hold, what you provided and what you decided, whatever the outcome.

Why a sudden spike in international orders draws attention

Providers don't publish their rules, but the public enforcement record shows what regulators expect them to watch: sanctioned-country addresses and spelling variants, IP and location data, and names close to listed persons. A store that suddenly receives many orders to forwarders in countries near Russia, or to addresses in Ukraine that resolve to occupied regions, looks very different from one shipping domestic orders. That is a risk signal for the provider and for you. See freight forwarder and reshipping red flags.

How to reduce holds before they happen

You can't control a provider's screening, but you can make sure orders that would trip it never reach payment capture or shipment unreviewed:

• Screen before you capture. If you use manual payment capture, screen the order first and capture only once it's clear. Shopify Payments card authorizations generally lapse after 7 days, so the decision has to fit inside that window.
• Check billing and shipping countries separately, including city and region, not only the country dropdown.
• Screen companies as well as people. B2B and wholesale orders often carry a company name that's never checked.
• Re-screen your existing customers when lists change. Most new designations are of people who were clear before.
• Keep decision records so you can answer a provider's questions with evidence instead of memory.

How MatchAudit helps

MatchAudit is a sanctions screening app for Shopify, available on the Shopify App Store. It's designed around the steps above:

• Hold every new order until it is screened is an optional setting. With it on, every open fulfillment order is held, and the order tagged matchaudit-pending, as soon as Shopify reports the order, even if MatchAudit's screening service is busy. The hold is released only by a clear result or a reviewer's Allow order.
• Capture only cleared orders. MatchAudit's Shopify Flow trigger Order screening cleared can start Flow's Capture payment action, so an authorized payment is captured only after screening. MatchAudit itself never captures, voids or refunds a payment.
• The authorization deadline on each case. For manual-capture orders, the case shows when the card authorization lapses: 7 days after authorization for Shopify Payments. Shopify reports the exact expiry only to Shopify Plus stores.
• Compliance alerts without customer data. The Flow trigger Order flagged for sanctions review carries the reason, matched lists, highest match score and a review link, but no customer names or addresses. You can safely send it to a staff inbox or chat channel.
• A record for every decision. If a provider asks what you checked, you can export the case as a private PDF. It shows the screened parties, the sanctions and country-risk evidence, your decision and reason, the fulfillment-hold state and the list versions used.

Frequently asked questions

Why did PayPal hold my payment for a compliance review? PayPal says it screens payments for possible OFAC sanctions issues and pauses flagged payments for review. Common triggers include names, payment notes, addresses or countries resembling sanctioned ones. The email or notice from PayPal is the authoritative explanation.

How long does a sanctions review take? Providers set their own timelines. PayPal publicly says it aims to review and contact Venmo users in 72 hours or less. Reviews can take longer if information is requested and not provided.

My payout is frozen. Is my store being investigated for sanctions? Not necessarily. Shopify lists many reasons for account holds, from missing information and bank details to product eligibility. Sanctions based on business location is only one of them. Read the specific notice.

How do I avoid payout holds when selling internationally? Keep embargoed destinations out of your shipping zones, screen buyers and recipients before capture and shipment, check companies on B2B orders, and keep records of what you checked.

Related reading

• Does Shopify screen your customers for sanctions?
• OFAC compliance for ecommerce
• How to screen Shopify orders against sanctions lists and keep proof

Official sources

• Shopify Help Center, Shopify Payments account holds: help.shopify.com
• Stripe, Restricted and prohibited businesses: stripe.com
• PayPal Newsroom, Keeping the Venmo Community Secure: The Company's Approach to OFAC Compliance: newsroom.paypal-corp.com
• OFAC, Settlement with PayPal, Inc. (25 March 2015): ofac.treasury.gov
• OFAC, Settlement with Payoneer Inc. (23 July 2021): ofac.treasury.gov
• OFAC, Settlement with BitPay, Inc. (18 February 2021): ofac.treasury.gov