Before the Money Moves, the Institution Has to Be Clear

At the end of June 2025, attackers used legitimate credentials to gain access through C&M Software, a technology provider that connects financial institutions into Brazil’s payment infrastructure. Police later alleged that an employee had provided credentials and access that helped enable the attack.

Brazilian police said at least R$800 million was diverted. BMP, one of the institutions affected, said reserve accounts belonging to six financial institutions had been accessed. Some of the stolen funds were subsequently converted into crypto.

What is interesting to note, is that Pix itself was not breached. The attackers exploited a trusted connection into the broader payment infrastructure.

The lesson extends beyond Brazil. A payment system can operate exactly as designed and still move a bad instruction. Once an instant payment settles, the sending institution cannot simply recall it.

That makes the decision before settlement much more important.

This is an extension of what I’ve been talking about for the last month.

We aren’t only talking about instant payments. This is something that has been building for years as technology evolves and the velocity at which decisions need to be made increases.

Digital banking gave customers easier access to their financial lives. APIs made it easier to tease out information out of older systems and build better experiences around it.

Now expectations are evolving again. It is no longer enough for systems to give us information. We increasingly expect them to interpret our data, behavior and needs, recommend what to do next, and, increasingly, act on our behalf.

(You might see that expectation in ordinary banking experiences. Ask your bank bot about a duplicate payment and you may find yourself wondering why you had to ask, and why it didn’t flag the problem and suggest a resolution before you asked. We are getting accustomed to technology anticipating what we need.)

Money movement is following the same path. Payroll, emergency disbursements, brokerage funding and business payments feel strangely constrained when so much of the rest of our lives operates 24/7/365.

Technology is no longer the limiting factor.

The problem is technology is evolving faster than the oversight structures underneath it. Organizations continue to add new capabilities, but many of the policies, controls and decision processes surrounding them were designed for a world where there was more time between initiation, review and settlement.

Information surfaces faster. Decisions happen faster. Money moves faster. Oversight has not kept pace.

You may have noticed a consistent theme across the last four issues of The Instant Edge.

• Context. ISO 20022 gives institutions richer structured information about the payment, including purpose, parties and remittance information. Agentic systems can add even more context around the transaction, including who initiated the instruction, under what authority and under what conditions.

• Ownership. The core has a role as system of record. Fraud and identity systems verify authority and authenticity. The payment hub helps orchestrate the payment to its destination. But as the transaction crosses all of them, one question can become surprisingly difficult to answer: Where does responsibility for the full transaction decision actually sit?

• Variability. AI agents are probabilistic. They can take a different path or produce a different result when asked to perform the same task again. That does not mean the institution’s decision standard should also be variable.

• Time. Fraud tactics change quickly, and AI makes it cheaper and easier for attackers to test new approaches. A fraud signal that reaches you after an instant payment settles may help explain what happened, but it cannot prevent the payment that already occurred.

These are different symptoms of the same underlying problem.

Information can move faster. Decisions can be made faster. Money can move 24/7. But many institutions still do not have a clearly owned place where those inputs come together and influence the transaction before the money settles.

Most financial institutions are not short of oversight.

There are risk appetite statements, policies, approval paths, fraud rules, governance frameworks, committees and escalation procedures. Those things continue to be important.

The question is whether they can influence the transaction in time.

A risk policy does little good if the relevant signal reaches the payment after it has been released. A sophisticated fraud model cannot stop a transaction if it only generates an alert after settlement.

And strong authentication can confirm that the person initiating the payment really is your customer. It cannot necessarily tell you that the customer has been manipulated into sending to a criminal.

The transaction itself still matters. But the decision increasingly needs to incorporate context around it: identity, authority, behavior, intent, risk, and the conditions under which the payment is being initiated.

The Bank of International Settlement has been exploring this same principle. Project Mandala tested a compliance-by-design approach for cross-border payments in which required regulatory checks could be completed before funds were released.

Mandala is an experimental project, not a blueprint for a financial institution’s payment architecture. But it demonstrates an important principle:

Controls are most effective before the outcome is final.

I use the term Real-Time Control Layer™ for this missing architectural responsibility.

It is not another product category, and it is not a replacement for your core, fraud platform or payment hub.

It is the place in the architecture where the institution can bring together the information relevant to a transaction, apply its approved policy and risk posture, and make a dependable decision before value moves.

Its value is consistency even as the environment changes.

Add a new rail. Change an AI model. Initiate through a different channel. Introduce tokenized deposits or stablecoins. Fraud tactics evolve.

You should invent a new decision model every time the technology changes.

What needs to remain consistent is the institution’s ability to answer:

Is this transaction permissible?

That is what I mean by a stabilizer.

Instant payments did not create problem. They expose it because the consequences are immediate rather than hidden inside a batch cycle or delayed settlement process.

With FedNow and RTP, settlement is fast and final. Both systems have formal return-request and return processes, but the sending institution cannot simply recall a settled payment. Prevention therefore matters much more than assuming the money can be pulled back afterward.

The same architectural challenge applies to embedded finance, digital wallets, open banking, agentic commerce, stablecoins and tokenized deposits. Each introduces another way for information, instructions or value to move quickly across institutional boundaries.

Without a coherent control architecture, the natural response is to deal with each one independently: another integration, another control, another approval process, another team responsible for one portion of the transaction.

That is how modernization becomes fragmented.

You cannot predict every technology that comes next.

You should not have to reinvent your controls every time new technology is introduced.

This reframes some of the modernization questions I hear most often.

The first question should not be which AI platform to choose, which rail to add or which fraud product to buy. Those decisions sit underneath a more fundamental question:

Where does your institution actually decide what is permissible before money moves?

From there, I would want senior leaders to understand four things:

• Who owns the full transaction decision today? Not one component of it, but the decision across identity, authority, risk and payment execution.

• Does richer transaction information actually influence that decision? Or are you collecting more data without changing what happens before release?

• Can a material risk signal reach the transaction while the institution can still act on it? Or does it mostly improve investigation afterward?

• When you add a new rail or form of money movement, are you extending a common control architecture? Or creating another independent set of controls?

These questions are more important than deciding whether you need instant payments.

Over the past year, I have written about instant payments, ISO 20022, AI, fraud, stablecoins and tokenization. I increasingly see them converging on the same institutional challenge.

Financial institutions have access to more innovation than ever. The hard part is how the organization can keep up as the technology, risks, and expectations around it keep changing.

This is also the bigger story I am working through in my book. Modernization is not primarily about predicting what technology comes next. It is about creating an architecture that can accommodate change without starting over every time.

Technology will keep advancing. Customer expectations will continue to rise. AI will improve. Attackers will adapt. New ways to move money will continue to emerge.

Organizations can’t anticipate it all. But they can be clear about what is permissible, who has the authority to decide, and make sure their policies and controls can influence the transaction before the money moves.

As you look across your own payment architecture, where is that decision being made today?

If this is a conversation your leadership team, board, or industry group is having, I’m always interested in continuing the discussion.I speak with senior leaders and industry groups about how instant payments, AI and emerging forms of money are changing the architecture of institutional control. If this is part of your agenda, I’d be glad to continue the conversation.