Instant payments settle in seconds and, once executed, the sending bank cannot pull the money back on its own. Any mistake an AI agent makes is therefore final unless the payee's side agrees to return the funds. Every control that matters has to sit before execution: payee checks, amount bounds, authentication, provenance of instructions and a person on anything unusual.
What do instant payment rules require, and why does that make payments irreversible?
Instant payment schemes credit the payee's account within seconds, at any hour, every day. The EU Instant Payments Regulation requires payment service providers that offer euro credit transfers to offer instant ones, and to verify the payee's name before the payer authorises. Brazil's Pix and Mexico's SPEI work on the same principle of near-immediate settlement. Our explainer on what instant payments are covers the mechanics.
Speed is the point, and it removes the old safety margin. A batch transfer could be stopped while it waited for the next cycle. An instant payment cannot. After execution, a recall is a request to the payee's provider, which usually needs the payee's consent or evidence of fraud. If the payee has already moved the funds, there may be nothing left to return. We set out the concept in irreversibility in payments.
The rules also ask providers to screen for fraud and sanctions in ways that work at that speed, and they let payers set limits on what they send instantly. Everything has to be decided in the seconds before money moves.
Who does it apply to?
Banks, e-money institutions and payment institutions that offer instant credit transfers, and any business that sends them on its own account. In the EU the Regulation sets the obligations for euro payments; other markets have their own schemes and rules, but the irreversibility problem is the same everywhere.
For agents, two groups matter. Providers running agents in operations, such as exception handling or corporate payment preparation. And businesses whose finance agents prepare outgoing instant payments from their own accounts.
What does irreversibility mean for an agent that acts?
A person who sends money to the wrong account usually hesitates first. An agent does not hesitate unless something stops it. Three failure modes are specific to agents.
False instructions. An agent reads an email that says a supplier's bank details have changed and prepares a payment to the new account. That is the classic invoice redirection fraud, now executed faster. The instruction came from outside, and nothing in it was verified.
Loops and repeats. An agent that retries after a timeout may send the same payment twice. With instant settlement, both arrive.
Scope creep. An agent built to prepare payments is given a connection that can also send them. Nobody decided it should move money; the permission simply existed.
This is why we treat moving money as depth 4: the agent may only execute payments within bounds once it has been certified to do so on the customer's own cases. Below that, it prepares and a person sends. And some actions are withheld for every agent at every depth, such as reversing a settled payment on our own rail, because the platform should never pretend that an irreversible action can be undone by an agent.
Which controls must sit before execution?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Payee is who the payer intends | Verification of payee before authorisation; any mismatch holds the payment for a person | Verification result stored with the payment |
| Instructions are genuine | Changes to payee details accepted only from sealed or signed sources; an external email cannot authorise a payment | Provenance class recorded for each instruction |
| Amounts are bounded | Per-payment and daily limits per agent, below the customer's own limits | Limit checks in the verdict record |
| New payees are slowed down | First payment to a new payee held for a named person | Hold records with approver identity |
| No duplicates | Idempotency check on payee, amount and reference before sending | Duplicate checks logged, blocked repeats recorded |
| Customer authentication | Strong customer authentication completed by the customer, never by the agent | Authentication result linked to the payment |
| The agent's authority is current | Depth 4 only with a valid certificate; a run that clears no depth drops it to depth 1 the same day | Certificate status at the moment of action |
Exceptions deserve their own design. Our playbook on how to handle instant payment exceptions with an AI agent covers rejected, returned and disputed payments, where the agent gathers facts and a person decides.
What will a supervisor or auditor ask?
- Which agents can initiate or release instant payments, and at what depth?
- Show us what happens when verification of payee returns a mismatch.
- Where do payee detail changes come from, and how is the source verified?
- What stops the agent sending the same payment twice?
- Pick a payment the agent sent. Show the checks, the bounds and the certificate in force.
- How do you test these controls, and how often? An agent can help here, as our piece on whether an agent can test compliance controls explains, but a person signs off.
What do the instant payment rules not cover?
They set out how instant payments work and what providers must offer. They do not say how a provider should govern an agent that prepares or sends payments; that comes from operational risk, conduct and model risk expectations, and in the EU from DORA for ICT risk. They do not settle who bears a loss when an agent was deceived; that depends on payment services law, contracts and the facts. For the wider limits on banking agents, see what AI agents in banking may and may not do.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Can an agent recall an instant payment it sent by mistake?
It can draft a recall request and gather the evidence, but the return depends on the payee's provider and often the payee. Treat recall as a hope, not a control.
Should an agent ever send instant payments without a person?
Only within tight, certified bounds: known payees, verified details, amounts under limits, and a current certificate. Anything outside those bounds is held.
Is a delay before first payments to new payees allowed?
Providers and businesses can add their own holds as risk controls, as long as they meet their obligations to customers. A short hold on a new payee is one of the cheapest controls against fraud.