Instant Payments Risk Controls for Banks: Who Owns the Decision?

If you run payments or fraud operations at a bank or credit union, you are probably hearing about new risk tools from the networks you use. The question that matters for instant payments risk controls for banks is not which tool to switch on. It is who decides what the tool's information means once it reaches you.

The short answer: the network can inform your decision, but it should not become your risk policy. Your bank owns that.

What networks are starting to offer

Three recent developments show how different these things are. Since April 28, FedNow has offered a network intelligence API to early adopters. A sending bank can see receiver account-level data observed over the service before it sends a payment. FedNow is also exploring how to more easily enable Payee Name Verification, which would confirm whether a payee's name matches the account details before a payment goes out.

Nacha's fraud monitoring rules are a different kind of thing altogether. They are not a service. They are obligations. In effect in phases since March 20, 2026, they require banks to establish risk-based processes to identify entries suspected of being unauthorized or authorized under false pretenses.

A data service, a capability still taking shape, and a requirement. Each shows up differently, at a different point in the payment.

Why this creates a policy problem

The natural move is to hand each signal to the team that already owns that rail. FedNow signals go to the FedNow process. ACH requirements go to the ACH process. Every one of those decisions is reasonable. Added together, the bank ends up with as many risk policies as it has rails, and nobody chose that.

The customer feels it first. The same customer can be flagged on one rail and approved on another, and the bank may have trouble explaining why.

Adoption is still uneven, which helps. Banks that have enabled send are often live on one or two rails, and many are still preparing. A bank with a single rail can set the principle once. A bank with four has to reconcile four habits. The cost of deciding early is low, and the cost of deciding late grows with every rail added.

Instant payments risk controls for banks: what should stay constant

Signals can be specific to a rail. Controls can reflect how a rail works, since irrevocability, limits and recovery options differ. What should not vary by accident is who owns the judgment and the principles behind it: how much risk the bank will accept, what happens to a customer's limits when a warning comes in, and who can override.

That is consistent governance with context-sensitive decisions, not identical outcomes everywhere.

Questions worth asking now

When a network introduces a new signal, who decides whether it changes a payment decision? Which signals are advisory, and which should trigger a control? Can you explain why a payment was allowed, warned, limited or stopped without pointing only to what the network told you?

If the honest answer is "whoever owns that rail," that is the pattern to fix. Settle the question before the number of signals settles it for you.

This is the argument I make in this week's essay in The Instant Edge, my Wednesday newsletter for senior leaders at banks and credit unions. Read it, and bring your payments and fraud leaders along.