Reengineering AML in the Era of Instant Payments

When the Federal Reserve lifted FedNow’s transaction limit from $1 million to $10 million last November, the regulatory change transformed instant payments from a retail convenience into a corporate treasury rail. High-value instant wire transfer that once gave compliance teams until the end of the day for review now requires real-time decisions. But for many financial institutions, the controls governing those transactions are still built for a world in which compliance teams had hours to react.

See Also: AI Impersonation Is the New Arms Race—Is Your Workforce Ready?

With instant payments now carrying institutional-scale transaction values, financial institutions face mounting pressure to reengineer not only their detection algorithms, but the entire investigative workflow that follows. Anti-money laundering teams must balance customer expectations for frictionless payments with the rising threat of irrevocable, high-value losses. Experts say this requires a fundamental redesign of AML operating models, and not merely a technology upgrade.

Regulators have explicitly acknowledged this shift. In the European Union, the Instant Payments Regulation requires euro transactions to be completed within 10 seconds while maintaining effective AML and sanctions controls, pushing banks toward real-time architectures and periodic sanctions screening in specific cases. Similarly, U.S. authorities emphasize a risk-based, technology-enabled approach to sanctions and AML compliance for instant payment systems.

While FinCEN may not fine a bank for a 24-hour delay in filing a SAR, the U.S. Treasury and the Federal Reserve have made it clear through Operating Circular 8 that banks must have “reasonably designed” programs.

“For a high-value instant rail reasonably designed is increasingly interpreted as a pre-settlement check, which in practice means using real-time monitoring systems to review for AML risk before sending the transaction to FedNow,” said Lenny Gusel, head of fraud solutions for North America at Feedzai.

Investigation Bottlenecks

A common misconception is that real-time AML simply means “running existing monitoring rules faster.” Serpil Hall, strategic advisor at Datos Insights, told ISMG that banks believe that adding more rules improves detection quality. In reality, industry studies consistently show that roughly 95% of AML alerts generated by traditional systems are false positives, overwhelming compliance teams and degrading detection effectiveness rather than improving it.

“This is why regulators and supervisors increasingly support risk-based, data-driven and behavioral approaches, including carefully governed machine learning models,” Hall said.

Banks also need to understand that real-time transaction screening alone cannot prevent financial crime, Hall said. Authorities such as FATF, the ECB and the Federal Reserve stress that effectiveness depends on upstream controls, including accurate onboarding data, strong identity verification and ongoing customer risk assessment across the full life cycle.

Another misconception, said Jeanette Waye, vice president for risk and consulting at PaymentsFirst, is that banks believe real-time AML is fully achievable today and can identify suspicious activity at the individual transaction level. “There is also a tendency to treat fraud and AML as separate functions, when they increasingly represent different points in the same financial crime life cycle,” Waye said.

The New Risk Model

Financial institutions are being forced to fundamentally re-architect how and when they manage risk, which means shifting controls upstream in the transaction life cycle rather than relying on post-event monitoring. Traditional AML frameworks, built for retrospective review, are giving way to pre- and intra-transaction decisioning models that assess risk before a payment is ever released, Hall said, adding that control emphasis is moving earlier in both the customer and transaction life cycle.

This shift places far greater reliance on behavioral profiling, continuous risk scoring and a deeper understanding of customer activity over time, rather than evaluating transactions in isolation. Practitioners say this evolution is as much about strengthening upstream controls as it is about speeding up detection. Robust customer due diligence, ongoing screening and dynamic risk profiling are becoming critical inputs for real-time decisioning, ensuring that most transactions are effectively risk-assessed before they enter the narrow execution window of instant payment rails.

At the same time, richer data standards such as ISO 20022 are enabling more contextual and intelligent controls. “Real-time payments built on the ISO 20022 standard include far richer data fields, which help institutions better understand the context of a transaction,” said Gusel of Feedzai.

Data fields such as payment purpose or embedded invoice details enable institutions to move beyond blunt, threshold-based rules toward more nuanced, risk-based decisions that can distinguish between routine corporate payments and anomalous activity. At the front end, institutions are also reinforcing guardrails related to onboarding and transaction controls.

“As the opportunity for post-transaction intervention becomes more limited, institutions are placing greater emphasis on detecting and mitigating risk before a payment is released,” Waye said. These changes reflect a broader perspective in which AML is no longer primarily a back-end compliance function, but a preventive, intelligence-led control embedded across the entire customer life cycle.

Speed vs. Control: Tradeoffs?

For many institutions, the rise of instant, high-value payments has created what appears to be an impossible choice: Stop a transaction they can’t fully assess within seconds or allow it to proceed and absorb the risk. But practitioners increasingly reject the idea that speed and control are inherently at odds. “The long-term solution should not be forcing institutions into that tradeoff,” says Will Lawrence, CEO and co-founder of Bretton AI. Instead, the industry is focusing on reengineering workflows so decisions can be made faster without sacrificing rigor.

A key part of that change is better segmentation. Rather than applying uniform controls, institutions are increasingly routing low-risk transactions through straight-through processing while reserving intervention for high-risk or anomalous activity. This approach relies heavily on improved data, behavioral analytics and more efficient investigation processes, Lawrence said. Technology providers argue that modern tools can reduce, rather than increase, friction.

“With the right AI-powered tools in place, financial institutions can detect and mitigate financial crime in real time while still enabling legitimate transactions to move quickly,” Gusel said, adding that the notion of a forced tradeoff as a “false dichotomy.” In practice, the tradeoff is not eliminated but redistributed. Risk decisions are increasingly made earlier – before the payment enters the real-time execution window. This enables institutions to balance speed and control without defaulting to blunt, disruptive interventions.

Uneven Transformation: Keeping Up the Pace

The pace of transformation across the industry remains uneven. Large financial institutions are moving aggressively to modernize real-time monitoring. But smaller and mid-sized institutions face significant constraints tied to legacy systems, cost pressures and reliance on core providers.

Much of the challenge lies not in detection capability but in operational scalability. “Compliance teams are not only operating with much tighter time windows, but are reviewing higher-value payments that represent much larger financial risk,” said Bretton AI’s Lawrence. For many institutions, the ability to evolve is closely tied to the vendor ecosystem. Core processors such as Fiserv, FIS and Jack Henry play a critical role in enabling access to real-time monitoring capabilities, Gusel said.

Regulatory and fraud pressures are likely to accelerate the change. Experts note that major shifts in AML have historically been driven by enforcement rather than voluntary transformation. With fraud losses rising and instant payment volumes growing, institutions may have little choice but to adapt. The result is a widening gap: while transformation is underway, it is far from uniform, raising the risk that weaker links in the financial system could become targets for exploitation.

“While there is strong awareness of the need to evolve, the pace of change is often tied to vendor capabilities and available resources,” said Alaina Ackley, director for audit with PaymentsFirst. The transition is underway, but far from complete, Ackley said.