Why Your Payment Risk Strategy Is Stuck in the Past

Jessica Albright · 2026-09-25

Remember when banks had time to breathe? Payments moved in batches, and that slow pace gave risk teams hours to scan for suspicious activity before money ever left the building. It was a comfortable buffer. But comfort doesn't cut it anymore. Real-time payments, open banking, and AI-driven commerce have blown up that buffer. Now, if your risk management isn't embedded directly into every step of the payment, you're already behind. ### The Old Way Worked—Until It Didn't The traditional batch model was like a security checkpoint at the entrance of a building. Everyone lines up, gets checked, then moves on. Simple. Predictable. But today's payments don't line up. They flow continuously, from app to app, across borders, in seconds. And they're often irrevocable. That means the window to catch fraud has shrunk from hours to milliseconds. "In modern payments, everything is fast and complicated," says Matthew Gaughan, Tech & Infrastructure Analyst at Javelin Strategy & Research. "Even more with things like agentic commerce coming into play, where there might not even be a human present in a transaction." His report, *Embedded Risk: Risk Management Finds a Home in the Tech Stack*, makes one thing clear: the processes of the past—where risk was a separate department—don't fit the current landscape. ### Why Risk Can't Be a Bolt-On Anymore Many banks still try to layer modern risk tools on top of legacy systems. Gaughan compares it to forcing a square peg into a round hole. "If you try to bolt on that type of infrastructure on top of legacy architecture that isn't built for it, it puts an extra strain on the system." And that strain shows. Payments today are asynchronous—they don't follow a predictable cadence. They're event-driven, often automated, and increasingly global. Legacy mainframes, for all their power, are too rigid for this new reality. So what's the fix? Moving from centralized, manual reviews to modular risk services embedded directly into payment workflows. ### What Embedded Risk Actually Looks Like Embedding risk doesn't mean adding more checkpoints. It means weaving risk controls into the fabric of every transaction. That includes: - **Identity verification** at the point of customer onboarding - **Orchestration management** to route payments intelligently - **Event logging** for real-time auditing and compliance - **Sanctions screening** and **anti-money laundering (AML)** checks running continuously This approach lets institutions adapt quickly to new technologies and regulatory demands. It also reduces friction for customers—because risk checks happen in the background, not as a roadblock. ### The Bottom Line Risk management isn't a back-office function anymore. It's a core part of the payment experience. And if you're still treating it like a separate step, you're not just behind—you're vulnerable. As Gaughan puts it, "The processes of the past don't meet the needs of the current technological landscape." The question is: does yours?