Key concepts

On US rails the payee is a routing number and an account number. There's no directory of aliases like Pix keys or UPI's payment addresses, and no required name check, so a US request for payment needs the payer's account details up front, from onboarding, an earlier payment or an account link.

Other rails tie the account to a person or company: Pix keys must match Brazil's tax-ID records (since July 2025), UPI apps show the name the bank has on file, and the UK and EU check names before payment. The Fed sells Payee Name Verification, which works on any US rail and draws on 12 months of payment history.

Who the payer is decides who pays after a scam. Consumers are covered in the UK and, in a small way from 2027, in India. In the UK so are micro-enterprises (fewer than 10 staff and €2 million or less in turnover or balance sheet) and small charities, while a 50-person company gets no cover anywhere.

Platforms add a layer. A payables platform sending RTP payments for 2,000 small businesses through its sponsor bank sends "on behalf of" them, and RTP's new rules ask the bank to know and screen each one, with minimum requirements from March 31, 2028.

A business instant payment has more states than "sent" and "received": requested, approved, accepted, settled and final, available, applied, reconciled. A held payment breaks the habit of treating "settled" as "usable".

After settlement the states are return requested, frozen (Brazil lets a receiving bank hold a suspicious incoming Pix for up to 72 hours), returned voluntarily and reimbursed by rule. I'd model each as a state with its own timestamps, never as an edit to the original payment.

Clocks run everywhere: 20 seconds on FedNow, 10 seconds by law in the EU, under 4.6 seconds inside Brazil's settlement system for 99% of Pix, 12 months for most US data consents.

Under a 2022 schedule, the smallest RTP sending banks keep at least $25,000 in that joint account and the largest $10 million, and a payment goes out only if the bank's position covers it at that moment. FedNow needs none.

For the supplier's platform: on settlement, debit cash and credit the customer's receivable; if the bank holds the payment, debit "funds held by bank", credit suspense and apply nothing yet. A voluntary return is a new payment and a new entry. Nothing here can bounce by rule, so the ledger needs no "pending, could bounce" state of the kind ACH debits and checks need.

The stack, from the top: law (Article 4A of the Uniform Commercial Code for US business transfers, Reg E for consumers, the EU's Instant Payments Regulation), regulators' rules, scheme rules (RTP's Operating Rules of October 4, 2026, FedNow's Operating Circular 8 of April 1, 2026, the European Payments Council's rulebooks), each bank's limits and holds, then the customer contract.

Banks set tighter limits than the networks: FedNow's $100,000 default sits under its $10 million cap, and UK banks set theirs below the £1 million Faster Payments cap. Rules also decide who may charge whom. Brazilian banks can't charge individuals to send a Pix, EU banks can't price an instant payment above a standard transfer, and US open banking has no rule on data fees while the courts hold the 2024 rule.

FedNow gives banks fraud controls they set themselves: a negative list of accounts at other banks, activity limits by account and time window, a Network Intelligence API (launched April 28, 2026) showing what FedNow has seen of a receiving account, and fraud reporting. Checks that would run past the 20-second clock are skipped.

Dates I'd keep on a calendar as of October 2026:

The US open banking rule has no date at all: the rewrite by the CFPB, the US consumer finance regulator, has sat with the White House's regulatory review office since August 6, 2026, and every original compliance date is stayed. A UK reimbursement claim is judged by the rules in force on the payment date, so I'd store the rule version each payment ran under.

RTP and FedNow speak ISO 20022:

Pix, SEPA Instant and Australia's NPP use it too; UPI and Faster Payments run on older formats.

Remittance is where the standard earns its keep. The Fed's launch-era guidance says FedNow accepts up to 4,000 characters of structured remittance, where an ACH CCD+ payment carries 80. In practice data gets lost at the payer's bank portal, which may offer only a short free-text field.

Open banking has a standard per region: FDX in the US (recognized by the CFPB on January 8, 2025), the Open Banking standard in the UK, the Berlin Group's and STET's in the EU, Open Finance Brasil, and India's Account Aggregator specifications.

The US has two instant networks competing on rules: The Clearing House is owned by large banks, and the Fed runs FedNow as a public service, adding fraud tools and discounts to win smaller banks. Most small banks connect through core processors and more than 40 certified service providers (March 2026), and a company that isn't a bank reaches either network only through a bank.

Whoever owns the scheme decides whether it's a cost center or a business. Brazil's central bank and the Fed price to recover costs; The Clearing House, NPCI and the card networks answer to owners.

In open banking the bank holds the data and the sign-in step, so aggregators depend on its API and, since 2025, its fees. Wells Fargo and PNC are reported to be steering fintechs to Akoya, which Fidelity's parent, The Clearing House and 11 banks own. In the UK, Open Banking Limited runs the standard until a successor body takes over; its independent chair was named in September 2026.

Card networks have become a counterparty on bank payments too: Visa A2A launched in the UK in June 2025 with a dispute framework, and Mastercard's A2A Protect started there with Monzo, NatWest and Santander.

The US is the outlier: the CFPB is retreating, and the action has moved to courts, state attorneys general and state legislatures. New York has a bill, introduced in March 2026, that would ban data fees and cover small businesses; I've seen no sign it has moved.

A UK reimbursement is paid whether or not the money comes back; elsewhere, recovery mostly depends on the money still being there. Brazil's tracing process, MED, has recovered little: of R$24.5 billion lost to Pix scams from January 2022 to April 2026, 8.9% was returned, mostly because the fraudsters' accounts were empty by then. Almost all of that predates MED 2.0, which follows money through up to five onward accounts.

In the US, Article 4A puts a business transfer on the customer if the bank followed a commercially reasonable security procedure the two agreed, in good faith. In business email fraud the customer's own staff send the payment, so it's theirs. The beneficiary bank can rely on the account number even when the name doesn't match, unless someone there actually knew: in Studco v. 1st Advantage (Fourth Circuit, 2025), unreviewed automated alerts didn't count as knowing.

Outside the UK, payers carry most of the loss. In the European Banking Authority's and ECB's data, users bore about 85% of credit-transfer fraud losses in the European Economic Area in 2024, mostly from scams that tricked them into paying.