The last few years have seen the emergence of a new payment instrument: instant payments. Instant payments allow people to transfer money from one account to another account at any time of any day within a few seconds.
While they do not offer yet the same ubiquity nor handle the same volumes as more traditional low-value ACH (Automated Clearing House) or correspondent banking payments, their take-up has been remarkable. At this stage, more than 60 markets already have live instant (or real-time) payments infrastructures whose take-up differs based on their maturity (e.g., UK Faster Payments was a precursor which went live in 2008 and processed more than 3 billion instant payments in 2021). While most of these systems focus on processing domestic payments, several initiatives are also on-going to open up these instant payments to process cross-border flows (e.g., RT-1 and TIPS are examples of pan-European instant payment systems).
While consumers and business will directly benefit from this new payment instrument, it also comes with significant challenges for financial crime compliance teams in terms of how to handle the related sanctions screening aspects. These include deciding which of these instant payments should be screened (based on each bank's specific context, risk appetite and policies) and implementing the appropriate technology solution to efficiently process the expected large volumes within the very limited time allowed.
Deciding on whether/which instant payments to screen
As for any new payment instrument comes the challenge of deciding on the appropriate risk treatment from a sanctions screening perspective and the debate is still on-going in the industry.
OFAC issued a Sanctions Compliance Guidance for Instant Payments Systems in September 2022, in which "financial institutions are encouraged to adopt a risk-based approach to ensure their sanctions compliance controls and related technology solutions remain commensurate with the sanctions risks presented by instant payment systems". While OFAC recognizes that a key feature of instant payment systems is the near real-time nature of transaction settlement, "the speed necessitated by this commercial feature should not discourage financial institutions from implementing risk-based sanctions compliance controls". Financial institutions, adopting a risk-based approach, may therefore need to be able to handle sanctions screening controls for some of those instant payments.
In Europe, the European Commission issued a proposal in October 2022 to accelerate the rollout of instant payments in euro. An important aspect of that proposal is "removing friction in the processing of instant euro payments while preserving the effectiveness of screening of persons that are subject to EU sanctions through a procedure whereby payment service providers will verify at least daily their clients against EU sanctions lists, instead of screening all transactions one by one". This would certainly make sanctions controls easier to implement for instant euro payments. Several important aspects of this proposal would remain to be clarified though, among others in terms of (a) safe harbor status for financial institutions implementing this approach, (b) the expected standards for daily screening of clients (e.g., exact set of sanctions lists, screening parameters), (c) the limitation of the proposal to EU sanctions lists only (and the appropriate management of other sanctions lists that some financial institutions may need to apply) and finally (d) the appropriate sanctions screening treatment of euro payments that may ultimately initiate or terminate outside of Europe (one-leg-out payments).
More discussions and approaches will likely emerge as instant payments become more ubiquitous across the globe and especially as their usage starts to grow for cross-border payments (as solely domestic payments are often deemed to pose a lower sanctions risk than cross-border transactions).
In the end, for financial institutions active in multiple countries or regions, the likely scenario is a risk-based approach, where each individual financial institution will decide which instant payments should be screened depending on the financial institution's specific regulatory context and risk appetite. Many factors are likely to be considered such as the nature of the payment (domestic vs international), the degree of usualness of a payment (e.g., payments to new entities), the absolute value of the transaction or the origin/destination of the payment (e.g., country/region, type of beneficiary).
A technology overhaul to handle the new instant payment specific requirements
Beyond the policy-related decisions that financial institutions will need to take to decide which instant payments should be screened, their sanctions screening technology solutions will also need to be adapted to cope with the specificities of instant payments, along a number of dimensions:
- Throughput. Domestic payments represent 20 to 50 times more volumes than the cross-border payments typically screened by financial institutions today (even significantly more when also considering card or cash transactions). A lot of these payments will become instant in the years to come. In addition, the convenience of instant payments and the continuous digitalization of commerce will further boost those volumes. Even if financial institutions decide to only screen a low percentage of their instant payments, it will represent a significant stretch on today's screening systems. At peak times and depending on its screening policy, a large bank's screening system may need to sustain a throughput of up to several thousand or more payments per second.
- Latency. Screening of instant payments will also introduce a new complexity in terms of sanctions screening: speed. Today for most ACH or cross-border payments, the time required by the technology solution to screen a payment (i.e., the latency) is often not really an issue. With instant payments -and the related expectation that settlement occurs within a few seconds- speed will be essential. Financial institutions should ensure that their screening technology allows for screening to happen in a few milliseconds on a 24/7 basis, even at peak times.
- Efficiency. Given that each instant payment needs to settle in a few seconds and therefore does not leave time for manual resolution of sanctions alerts, each screening alert unnecessarily raised (i.e., a false positive) will result in a failed delivery on the instant payments promise. Financial institutions will need extremely efficient screening technologies to avoid unnecessary friction in their clients' payments experience, especially as Open Banking allows customers to easily switch providers if they feel their experience is not optimal.
- Flexibility. Not all instant payments will represent the same sanctions risk. Financial institutions will want to dynamically change the parameters of their screening systems (e.g., threshold, policies, sanctions lists applied) depending on the specific nature of each instant payment (e.g., amount, origin/destination). Screening technologies need to be extremely flexible and allow financial institutions to dynamically change screening parameters for each transaction, even during peak times.
- Know-Your-Transactions. Transaction screening systems used to look at transactions as atomic decisions (i.e., deciding to raise an alert based only on the parameters of that specific transaction). However, given the very high volumes of instant payments, it will become increasingly important to understand the broader context of a transaction by also taking into account the customer's transactions history. It will help not only to decide whether a specific payment should be screened but also – for those payments that will be screened - reduce the number of false positives by leveraging the broader transaction context. This could include identifying in real-time payments inconsistent with a customer''s prior history, such as significantly higher value or higher frequency payments or payments made to entities with whom the customer has not previously dealt.
- API Integration. Instant payments are part of interconnected systems and transaction screening solutions need to be easy to interface with, leveraging Application Programming Interface (API) technology. Multi-channel is indeed the new norm for payments initiation and financial institutions will need to be able to easily and efficiently call their screening system from all these channels. In addition, screening will only be one of the many tasks to perform when processing instant payments. As examples, payment validation, fraud detection, confirmation of payee will also need to be handled and API-based systems will significantly ease the integration of these complementary systems.
New technologies in support of today's financial crime compliance challenges
The growth of instant payments has been remarkable and consumers and business will greatly benefit from this new payment instrument.
Instants payments however come with a series of new challenges for banks' and fintechs' financial crime compliance teams, including imposing demanding requirements on their screening systems.
While legacy screening systems are ill-suited to cope with these challenges, new screening technology solutions have fortunately emerged over the last few years. Such new solutions will allow to unlock the full potential of instant payments by helping financial institutions effectively and efficiently address the related financial crime compliance risks.
