Ensuring Effective Transaction Monitoring in an Instant-Payments Era

1. Introduction

From 9 October 2025, individuals and businesses across the EU have been able to initiate euro payments that reach the beneficiary in under ten seconds, at any hour of the day and on any day of the year. This development results directly from the EU Instant Payments Regulation, which makes real-time settlement the mandatory standard for euro-denominated transfers.

While instant payments benefit the wider payments ecosystem - by unlocking substantial liquidity otherwise trapped in settlement pipelines, expanding payment options for consumers and merchants, enhancing traceability by displacing certain cash transactions, and fostering innovation and financial inclusion through new digital solutions - they simultaneously compress the time available for compliance checks. Beyond potential profits enabled by instant payments, obligated entities remain entrusted with a public-interest mandate to safeguard the financial system from, inter alia, money laundering and terrorism financing.

Traditional time-based controls are structurally unsuitable for environments where transactions must be risk-assessed, verified, and executed within seconds. As payments settle instantly, the practical ability to conduct enhanced analysis or escalate suspicions to compliance officers is severely constrained. Instead, rapid settlement reduces the effectiveness of traditional rule-based monitoring, increases exposure to high-frequency micro-structuring, and enables layered fund movements across multiple accounts in seconds. This compression of time increases the risk that illicit transfers are completed before any red flag is detected, thereby undermining the preventive function that the EU Anti-Money Laundering and Countering The Financing Of Terrorism (AML/CFT) framework imposes on obliged entities.

Beyond these operational challenges, instant payments expose a deeper normative tension within EU financial regulation. The Instant Payments Regulation elevates speed, availability, and execution certainty to binding legal requirements, while the EU AML/CFT framework continues to rely on preventive obligations that presuppose time for analysis, escalation, and human intervention. These two regulatory regimes are built on very different assumptions about time. Instant payments prioritise speed and immediate finality, while AML/CFT rules are designed around investigation, escalation, and, where necessary, delay. The tension between them is therefore not just a technical issue, but a structural legal tension within the EU financial regulatory framework.

This raises broader questions of regulatory coherence and legal responsibility. Credit institutions remain subject to supervisory expectations and potential liability for failures in transaction monitoring, even where real-time execution renders traditional preventive controls impracticable. At the same time, the EU legislator has acknowledged the operational impossibility of conducting ex ante compliance checks within the instant-payment time frame, implicitly recalibrating the notion of “effective” AML/CFT controls in this context. Understanding how effectiveness should be defined, assessed, and operationalised under these conditions is therefore essential.

This contribution examines the tension between the speed required by the new EU instant payments framework and the effectiveness of AML/CFT transaction monitoring. The core question is: How can banks ensure effective detection and prevention of illicit finance when payments are executed in real time? For the purpose of this article, effectiveness is understood as the capability of monitoring systems to detect, interrupt or assess potential money laundering or terrorist financing risks.

The scope of this analysis is deliberately delimited. The analysis is confined to the European Union framework and focuses on banks and credit institutions as the primary obligated entities, with payment institutions considered only insofar as they participate in Single Euro Payments Area (SEPA) instant-payment schemes. The regulatory discussion centres on the Instant Payments Regulation, and more broadly on the EU AML/CFT Framework. Nevertheless, crypto-asset transfers, non-SEPA systems, and consumer-protection issues fall outside the scope of this article. Lastly, the focus is limited on transaction monitoring and does not address customer due diligence or suspicious-transaction reporting obligations.

2. The Legal-Technical Tension in Instant Payments

The EU’s new instant payments mandate crystallises the speed versus scrutiny dilemma. The Instant Payments Regulation amends the SEPA framework to require that euro-denominated credit transfers be executed within 10 seconds from initiation, on a round-the-clock basis. In practical terms, if a payee’s bank cannot make funds available to the payee and confirm completion to the payer’s bank within 10 seconds, the transaction is deemed failed and must be immediately reversed. This leaves little room for traditional pre-execution AML controls to operate.

Under the EU AML/CFT framework, banks are required to conduct ongoing monitoring of transactions to ensure that they are consistent with their knowledge of the customer and the customer’s risk profile. Where a transaction is known or suspected to be linked to money laundering or terrorist financing, obliged entities must promptly report the suspicion to the Financial Intelligence Unit. EU law allows institutions, where appropriate and feasible, to refrain from executing such transactions pending reporting; however, execution may proceed where postponement is impossible or risks frustrating law-enforcement objectives, provided that the FIU is informed without delay. In the context of instant payments, this exception risks becoming structurally embedded, effectively normalising what EU AML law originally conceived as a residual derogation from transaction postponement.

There is therefore a clash between what is technically required through instant payments and the legal duties of banks to examine transactions and, if necessary, refrain from carrying them out if suspicion arises. The Instant Payment Regulation itself recognizes this structural tension. Indeed, in recital 25, the EU legislator notes that screening each instant transfer against sanctions lists in real time proved “operationally impossible”. This is because flagging too many transactions that cannot be manually verified within the required short time limit automatically leads to erroneous rejections.

To remain within the 10 second execution window, institutions must rethink their compliance architecture, marking the beginning of a new era in AML/CFT monitoring. Real-time settlement requires controls that operate continuously, automatically, and with far greater analytical precision than traditional systems, reshaping both the technological foundations and the supervisory expectations of transaction monitoring. Nevertheless, regulators have acknowledged the practical limits of instant payments and stated that only the highest-risk transactions must be examined in real time, while lower-risk transfers may be reviewed ex-post.

In summary, the legal requirement for instant payments is in potential conflict with AML/CFT duties to detect and stop suspicious activity in a timely manner. The following sections of this article will explore the limitations in the traditional transaction monitoring architectures which disable banks from fulfilling their instant payments checks, and will offer potential solutions to bridge this gap.

3. Limitations of Traditional Transaction Monitoring Architectures

As previously established, traditional transaction-monitoring systems in banks were built for a slower, batch-based environment and are ill-equipped to operate effectively in today’s technologically accelerated, instant-payment landscape. They exhibit structural limitations that impede effectiveness in a real-time environment.

Firstly, traditional transaction-monitoring systems are predominantly rules-based, relying on static scenarios and threshold-setting that produce high false-positive rates. Multiple academic studies report false-positive rates exceeding 80 to over 90%, which consequently overwhelms and distracts resources from investigating actual positive hits.

Secondly, these systems depend on batch processing, meaning alerts are generated hours or days after execution. This approach is by definition incompatible with the ten-second settlement window of instant payments. Thirdly, the effectiveness of traditional transaction-monitoring systems is undermined by poor data quality, fragmented internal systems, and outdated customer information, which distort risk assessments and reduce detection accuracy. In practice, this results in either under- or over-inclusive screening outcomes.

Finally, existing architectures lack flexibility, scalability, and adaptability, making it difficult to incorporate new criminal typologies, handle growing transaction volumes, or transition toward advanced analytics such as machine learning. This technological rigidity leaves institutions dependent on outdated typology lists and static thresholds, while criminal methodologies evolve dynamically to exploit instant movement across multiple accounts and jurisdictions.

In sum, traditional transaction-monitoring systems in banks were built for a slower world. They operate mainly after suspicious activity has already occurred and still depend heavily on manual review and decision-making. This is incompatible with instant payments, where preventive controls must operate in parallel with transaction execution.

4. Potential Solutions

Navigating the balance between instant payments and AML effectiveness requires both fully implementing safeguards mandated by EU law, such as IBAN–name verification, and adopting solutions that are innovative yet acceptable to regulators.

One of the key measures of the Instant Payment Regulation which constitutes a baseline requirement is the IBAN-name verification for euro transfers, as mandated by Article 5c. This measure is necessary to combat fraud in instant payments. Ensuring compliance will involve integrating databases so that when a payer enters a beneficiary name, the system can query the payee’s bank in real time to confirm a match or a potential match before allowing submission. However, this measure is mainly anti-fraud, and has limited impact for anti-money laundering.

Also mandated by the Instant Payment Regulation, the daily screening of their customer base against EU sanctions is set to replace the transaction-based sanctions screening for instant euro payments. In practical terms, this means that banks need to have automated tools that update sanctions list changes immediately, run comparisons against all customers (and perhaps recent counterparties), and flag any accounts that should be frozen. An effective implementation will also link to transaction systems in a way that if a previously clear customer gets flagged as sanctioned overnight, any attempted outgoing instant payment from that account should be automatically stopped.

All instant payment initiations should, in principle, be subject to Strong Customer Authentication (SCA) under existing Payment Services Directive 2 (PSD2) rules. SCA can be executed within seconds, allowing some extent of fraud prevention without breaching the 10-second execution.

In addition to the above requirements, this article identifies a set of potential solutions to satisfy both the AML/CFT duties and the instant payment requirements.

A first avenue lies in moving away from static customer risk profiles towards continuous, transaction-linked risk scoring. Academic research emphasises that “dynamic risk scoring models, powered by AI and behavioural analytics, offer an innovative paradigm that enhances both precision and adaptability in detecting suspicious activity”. In parallel, academic studies on customer risk modelling show that machine-learning classification can better identify higher-risk customers in advance and significantly reduce the number of false-positive alerts. In instant-payment settings, this matters because the compliance objective shifts to prioritise and interpret risk signals immediately, using behavioural and contextual features (transaction sequences, velocity, network relations, counterparties, typology drift) that static profiles and simple thresholds do not capture. This approach also aligns with the AMLR’s emphasis on behavioural inconsistencies and contextual signals, by operationalising “ongoing monitoring” as an adaptive, data-driven process rather than a periodic, rules-based one.

Additional requirements will lie at the algorithm level, as any algorithm used should meet the transparency and oversight requirements of the EU AI Act. Indeed, the legal feasibility of AI-enabled scoring in AML monitoring is conditioned by the EU AI Act’s governance model. Under the AI Act, systems that can significantly affect individuals’ rights or interests are regulated even if decisions are not fully automated, and their outputs must remain subject to human control. In this context, Article 14’s human-oversight is particularly important. Indeed, Article 14 and Article 26(2) of the AI Act emphasise that human oversight must function as a real operational capability, with sufficient authority, expertise, and support, rather than as a formal compliance checkbox, especially given the risk of automation bias in compliance processes. Furthermore, academic work on the implementation of the AI Act’s high-risk requirements shows that transparency and interpretability under Article 13, as well as the requirement of “appropriate accuracy” under Article 15, must be translated into practical measures. These include clear documentation, relevant performance metrics, and auditable records that explain how a model works, its limitations, and the conditions under which it should be used. For AML transaction monitoring, the immediate implication is that dynamic risk-scoring models should be designed to produce interpretable reasons for elevated risk, maintain logs and traceability sufficient for internal challenge and supervisory review, and define “accuracy” in a compliance-relevant way (including false-negative tolerance, false-positive impact, and stability under typology changes), rather than as a generic predictive score.

Another approach involves the adoption of Hybrid AI, which could help detect real-time anomalies. Machine-learning-based anomaly detection can process large volumes of transaction data in milliseconds, which is more than ideal for the 10-second settlement window of the Instant Payments Regulation. For example, research demonstrates improved detection of non-obvious money-laundering networks. However, a fully autonomous blocking mechanism may conflict with the AI Act’s human-oversight requirement. Therefore, a hybrid model where AI flags suspicious flows and a rule-based or expert-system layer endorses action would align automation with legal accountability.

Finally, some banks may explore tiered processing architecture where low-risk payments are allowed as real-time payments whilst high-risk ones are not processed in real time and are instead routed through slower standard rails, where more accurate and possibly manual monitoring is applied. A similar framework is suggested by Mayo, Grabill and Wellman who examine how banks can keep offering instant payments while still managing fraud risk. They build a simulation of a payment system where banks can process both normal (slower) payments and real-time (instant) payments. In this model, banks have two main tools: first, they can set a maximum amount above which a payment is not allowed to go through instantly and must instead use the slower, standard channel. Second, they can decide how much to invest in automatic fraud detection for instant payments, knowing that these checks must be very fast and are less accurate than the checks used for standard payments. The key is to combine both tools, enabling instant payments for low-risk transfers while routing higher-risk or high-value ones through slower channels for deeper checks. This “tiered” approach reduces fraud significantly but only slightly affects honest customers’ ability to use instant payments.

5. Conclusion

The EU Instant Payments Regulation introduces a payment environment in which transfers are executed within seconds and with immediate finality. While this enhances efficiency and accessibility, it creates a fundamental tension with the preventive logic of the EU AML/CFT framework, which presupposes time for analysis and human intervention. Therefore, as time and human intervention become infeasibly limited, the only viable way to preserve AML/CFT effectiveness under these conditions is through the technological transformation of transaction monitoring.

The analysis demonstrates that traditional transaction-monitoring architectures are structurally incapable of meeting this requirement. Rule-based, batch-processed systems generate delayed alerts, high false-positive rates, and insufficient analytical depth, rendering them ineffective under the ten-second settlement constraint. At the same time, the EU legislator has acknowledged the practical limits of ex ante controls by recalibrating compliance expectations, notably through customer-level sanctions screening and the acceptance of ex post review for lower-risk transactions. Within this framework, the article identifies real-time risk scoring, hybrid AI-based anomaly detection, and tiered payment processing as legally viable mechanisms to reconcile speed with scrutiny, provided they are implemented in compliance with the AMLR and the EU AI Act.

The central takeaway is that instant payments mark a shift in the nature of AML/CFT compliance itself. This article contributes to the literature by reframing AML/CFT effectiveness in instant-payment systems as an architectural and governance-based obligation, rather than as a purely transaction-level preventive standard. In this reframing, effectiveness is no longer measured primarily by the ability to block individual transactions ex ante, but by the capacity of institutions to design, govern, and continuously adapt monitoring architectures that are capable of identifying, prioritising, and escalating risk in real time, in line with regulatory expectations and technological constraints.

Preventive effectiveness can therefore no longer be achieved through static rules and delayed intervention, but depends on technologically advanced monitoring systems capable of matching the speed of financial flows. In the instant-payments era, safeguarding the integrity of the EU financial system requires aligning legal obligations with technological capability, ensuring that compliance is embedded in the architecture of payment execution rather than applied after the fact.

6. Future Research

Given the pace of technological and regulatory evolution, several fields merit deeper research. For instance, the deployment of advanced analytics and hybrid AI models within AML systems raises unresolved questions about how supervisory authorities will enforce transparency, explainability, and accountability requirements under the EU AI Act. In addition, traditional reporting procedures may no longer suit a world where funds move in seconds. Finally, this also raises the question of how instant payments will affect foreign exchange operations. This suggests the need to explore and venture through real-time cooperation models between banks and FIUs.

Bibliography

Academic Sources

Basu Devraj and Tetteh Godsway korku, Using Automation and AI to Combat Money Laundering (University of Strathclyde 2024)

Berkan Oztas and others, 'Transaction monitoring in anti-money laundering: A qualitative analysis and points of view from industry' [2024] 159 Future Generation Computer Systems <https://doi.org/10.1016/j.future.2024.05.027> accessed 18 November 2025

Berkan Oztas, Enhancing Anti-Money Laundering: Development of a Synthetic Transaction Monitoring Dataset (IEEE International Conference on e-Business Engineering 2023)

Charles Paul and Charles James, Real-Time Anomaly Detection in Financial Systems Using Hybrid AI Models (2025)

Daniel Schnurr, Effective Implementation of Requirements for High-Risk AI Systems Under The AI Act: Transparency and Appropriate Accuracy (Center on Regulation in Europe 2025)

Dattatray Vishnu Kute and others, 'Deep Learning and Explainable Artificial Intelligence Techniques Applied for Detecting Money Laundering–A Critical Review' [2021] 9 IEEE Access 82300-82317

Directorate-general for financial stability, financial services and capital markets union, 'New EU rules make instant euro payments faster and safer' (Europa, 10 October ) <https://finance.ec.europa.eu/news/new-eu-rules-make-instant-euro-payments-faster-and-safer-2025-10-10_en> accessed 17 November 2025

Endre Jo Reite and others, 'Improving client risk classification with machine learning to increase anti-money laundering detection efficiency' [2024] 28(1) Journal of Money Laundering Control <https://doi.org/10.1108/JMLC-03-2024-0040> accessed 17 December 2025

European banking authority, Final Report - Guidelines amending Guidelines EBA/2021/02 on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions (‘The ML/TF Risk Factors Guidelines’) under Articles 17 and 18(4) oF Directive (EU) 2015/849 (EBA 2014) 40

FATF, Opportunities and Challenges Of New Technologies For AML/CFT (FATF 2021),

Judith Arnal and Fredrik Andersson, Making instant and inclusive payments a reality in the EU (Centre for European Policy Studies 2024) 1-2

Katherine Mayo and others, Fraud Risk Mitigation in Real-Time Payments: A Strategic Agent-Based Analysis (Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence (IJCAI-24) 2024) 157-165

Mário Cardoso and others, LaundroGraph: Self-Supervised Graph Representation Learning for Anti-Money Laundering (ICAIF '22: Proceedings of the Third ACM International Conference on AI in Finance 2022) 130-138

Melanie Fink, Human Oversight under Article 14 of the EU AI Act (Leiden University - Europa Institute 2025)

Muhammad Rafiq and Muhammad Khalid Sohail , 'Adopting regulatory technology for anti-money laundering in banking: Key enablers and barriers in a RegTech model' [2025] 10(0) Sustainable Futures <https://doi.org/10.1016/j.sftr.2025.101377> accessed 27 November 2025

Warren Liang and others, AML in the Age of Instant Payments: Risks, Detection Challenges, and Real-Time Compliance Solutions (Research Gate 2025)

Warren Liang, Dynamic Risk Scoring Models in AML: Leveraging AI and Behavioral Analytics for Adaptive Compliance (2025)

Wenyu Bi and others, 'Machine Learning-Based Pattern Recognition for Anti-Money Laundering in Banking Systems ' [2024] 4(11) Advanced Computing Systems 30-41

Yavuz Selim Balcioğlu and others, 'A turning point in AI: Europe's human-centric approach to technology regulation' [2025] 23(1) Journal of Responsible Technology

Laws & Regulations

Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC [2015] OJ L 141/73

Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024 establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828

Regulation (EU) 2024/886 of the European Parliament and of the Council of 13 March 2024 amending Regulations (EU) No 260/2012 and (EU) 2021/1230 and Directives 98/26/EC and (EU) 2015/2366 as regards instant credit transfers in euro [2024] OJ L 886