According to the provisions of the USA Patriot Act, the stipulations of the Customer Identification Program (CIP)  and the requirements for a Bank Secrecy Act/Anti-money Laundering Compliance Program, software that facilitates payment cannot be made available for download unless the physical address and/or identity of the recipient is identified and verified.

31 CFR 103.121 - Federal regulations requiring the CIP.

In addition, no company may 'export' financial software to certain countries listed on the Commerce Control List, which currently includes Cuba, Iran, Iraq, Libya, North Korea, Sudan, and Syria. http://www.access.gpo.gov/bis/ear/pdf/740.pdf The location and user identity of a download cannot be reasonably determined during an online transaction to comply with this export regulation. All software classified as "payment software" must ship to a physical address to comply with export regulations.

Due Diligence is required as cited in the US Securities Act to determine that the end user is not an individual that is likely to commit fraud, launder money, or fund terrorism.

The Federal Trade Commission (FTC) recently prosecuted Versa Check Brand, owner of Q-Chex software for their use of easy to download payment processing software.

http://www.ftc.gov/opa/2006/10/qchex.shtm

A federal judge ordered "Q-Chex" to cease its current method of online payment processing, which U.S. regulators said facilitated fraud. U.S. District Court for the Southern District of California, alleged that the company's practices violate federal law and successfully obtained an injunction to stop such practices.