Why Risk Management Is Moving Into the Payment Itself

Emily Jones · 2026-09-25

Remember when payments took a day or two to settle? That slow, batch-processing world gave banks a built-in safety net. They had time to scan for suspicious activity, run back-office reviews, and catch fraud before money moved. It was a set-it-and-forget-it approach that worked for decades. But payments don't work that way anymore. Real-time transfers, digital wallets, and embedded finance have changed everything. And that old safety net? It's full of holes. According to Matthew Gaughan, Tech & Infrastructure Analyst at Javelin Strategy & Research, risk management has shifted from a supporting role to a core part of every transaction. In their report, *Embedded Risk: Risk Management Finds a Home in the Tech Stack*, Gaughan explains that to keep up with modern payments, risk tools must run continuously, respond instantly, and operate transparently. That only happens when risk controls are woven into the entire system, not bolted on afterward. ### The Old Ways Are Slowing Us Down Risk has always been part of payments. But a perfect storm of trends is forcing a rethink. - **Real-time payments** are now widely available and popular. The catch? They're instant and often irreversible, leaving almost no window to detect and stop fraud. - **Open banking and embedded finance** have made financial services more interconnected and invisible. Payments can happen anywhere, anytime, often without a traditional bank in sight. - **AI and cloud computing** are reshaping how payments are personalized, streamlined, and delivered. "In modern payments, everything is fast and complicated," Gaughan said. "With things like agentic commerce, there might not even be a human present in a transaction. The processes of the past—where risk was separate from the payment flow—don't meet the needs of today's technological landscape." ### Why Batch Processing Can't Keep Up In the past, payments moved in predictable batches. There was a cadence, a rhythm. Mainframes handled massive volumes, and risk checks happened between batches. It was powerful, but rigid. Today's payment flows are asynchronous. They happen in real time, across multiple rails and geographies. Trying to bolt modern risk infrastructure onto legacy systems is like putting a sports car engine in a horse-drawn carriage. It strains the whole system. "If you try to bolt on that type of infrastructure on top of legacy architecture that isn't built for it, it puts an extra strain on the system," Gaughan explained. "Now, payments and data flows are more asynchronous than they ever were." ### The Shift to Embedded Risk So what's the solution? Banks are moving away from centralized systems and manual reviews. Instead, they're adopting modular risk services that plug directly into payment workflows. This means risk tools are integrated into nearly every part of the institution—from verifying customer identity to managing orchestration to creating event logs. Longstanding functions like sanctions screening and anti-money laundering checks are part of the same fabric. This level of integration is no longer optional. With complex payment rails, global transactions, and evolving fraud tactics, a modular, embedded risk framework lets institutions adapt quickly. Conventional systems just can't keep up. ### The Road Ahead Despite the clear benefits, many financial institutions are still hesitant to invest in modernizing their risk infrastructure. But as payments get faster and more complex, the cost of standing still will only grow. The future of risk management isn't a separate department or a batch process. It's embedded in every transaction, every moment, every byte of data. It's the difference between reacting to fraud and preventing it before it happens. For businesses and banks alike, the message is clear: risk isn't a back-office function anymore. It's the front line of modern payments.