Every released payment should carry its own proof. A payment company shows staff are trained by making the right to release held payments, change beneficiaries or approve refunds depend on a current certificate checked at source, and by keeping a filed record of each release with the approver's name. Supervisors, scheme operators and banking partners can then test any payment.
Why payment companies need the strongest version of this
Payments are depth 4 actions: they move money and are hard to undo. A payment company's agents may screen transactions, investigate exceptions, prepare refunds and recall requests, and handle merchant or customer queries. The actions that matter most, releasing funds and changing where they go, are held for a named person.
That person's competence is therefore the control. Payment companies also face a dense set of rules that touch it: strong customer authentication under PSD2 in the EU; payee name verification under the EU Instant Payments Regulation; PCI DSS for card data; FATF-based AML expectations; and, in the UK, the PSR's oversight of payment systems. Each assumes people who understand what they are approving.
What evidence should a payment company keep?
| Evidence | What a reviewer will test |
|---|---|
| Release rights matrix: action type, amount, required certificate | Could this person release this payment? |
| Certificate register, checked at the issuer | Was their certificate current on the day? |
| Practicum records on the company's own payment types | Did they practise on payments like this? |
| Filed verdicts: allowed, held, refused, withheld | What did the agent propose and why was it held? |
| Approval records with call-back evidence on beneficiary changes | Did the approver verify through a known channel? |
| Briefings on rule or limit changes | Were they trained on the rules in force? |
The AI agent training plan template for payment companies covers the training side, including how to build practicum cases from the company's own flows.
What should payments staff be trained on?
- External claims. An email with new bank details cannot authorise a payment. Staff must be tested on this until it is reflex.
- Payee verification results. What a close match, a mismatch and a no-match mean, and what to do with each.
- Withheld actions. Reversing a settled payment on the company's own rail is withheld at the platform floor for every agent at every depth. Staff should know no limit change will release it and that requests to find a way round are a warning sign.
- Urgency. Requests that press for speed are a classic fraud pattern, and approvers must not relax checks for them.
Typical gaps are covered in what payment companies get wrong about AI agent training.
An example from a scheme review
A payment institution processes merchant payouts. Its agent prepares payouts and holds any where the merchant's bank account changed within a set period. A scheme operator's review samples 20 held payouts released in a quarter.
For each, the record shows the agent's hold reason, the approver, their certificate status and the call-back made to the merchant's registered contact. Nineteen are clean. In one, the approver released the payout on the strength of an email from the merchant's domain confirming the change. The domain was genuine; the mailbox had been compromised. The approver was certified, so the finding is about judgement, and the company runs a refresher on external confirmation for all approvers, logged against each name.
Which controls make the evidence trustworthy?
- Release rights depend on current certificates, removed automatically on lapse.
- Two approvers above a set amount.
- Call-back evidence recorded against every beneficiary change.
- An append-only record of verdicts and approvals.
Regional supervisors bring their own emphasis; see MAS FEAT principles and training staff. Related sectors include logistics companies, which pay carriers at volume, and utilities, which handle refunds and payment plans for vulnerable customers. The guide to AI literacy and certification covers the general model.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Do fraud analysts need the same certificate as payment approvers?
If they release held payments, yes. If they only investigate and recommend, they need training on the agent's flags and sources, and the release stays with a certified approver.
Can agents ever release payments without a person?
Within tight bounds, a certified agent may execute routine payments at depth 3 inside the company's limits. Anything hard to undo or above those limits should be held for a person.
How should we evidence training for staff in several countries?
Use one register and one certification standard, with briefings on each market's rules logged against the staff who work in it.