How it works

How an instant payment runs, step by step

The distributor's invoice again, in five stages, on RTP or FedNow. The supplier's bank sends a request for payment with the invoice attached, the payer checks the payee's name and approves, and the scheme settles in seconds. Before it settles, a payment can be rejected for a limit or a timeout, and nothing moves. After that, the payer can only ask for a return, which the supplier's bank may refuse.

1. Requested. The distributor's platform asks its bank to send a request for payment with the amount, due date and invoice number, for a network fee of a cent. The bank must have registered the distributor as a request sender, and the distributor needs the retailer's routing and account number, since the US has no directory like Brazil's Pix keys. A request creates no duty to pay. What can go wrong: the retailer's bank isn't on the network or doesn't take requests. RTP's rules say the sending bank must then be told, and the distributor falls back to ACH, a wire or a card.
2. Approved. The payer's bank presents the request, and the retailer's AP team approves it (usually two people), declines it or lets it expire. The payee's name gets checked here: a duty on the payer's bank in the EU, an optional service in the US. The bank also applies its own limits: FedNow's default for a customer payment is $100,000, under a network limit of $10 million. What can go wrong: the request is a fake, sent through a legitimate sender's account. Both networks give the payer's bank a warranty claim against the sender's bank within 95 calendar days.
3. Sent. The payer pushes: its bank sends a pacs.008 for $50,000 with the remittance and the request's reference. RTP checks that the bank's prefunded position covers the amount and reserves it. FedNow checks the bank's balance or overdraft room at the Fed, then any negative list and activity limits the bank has set. FedNow allows 20 seconds end to end, 1 to 5 of them for the receiving bank; the EU's legal limit is 10 seconds. This is the diagram's mark: final in seconds. What can go wrong: the Rejected exception starts here.
4. Credited. The scheme settles and the supplier's bank answers: accept (money available at once), reject, or accept without posting, which settles the money but holds it for a legal or compliance review. On RTP, the bank is expected to decide by 11:59 p.m. the next business day, and a refusal means a refund as a new payment. What can go wrong: a held payment looks paid to anyone reading the network status, so I'd keep the invoice open until the bank releases it.
5. Reconciled. The supplier's bank notifies the distributor, the remittance is read, and the platform matches the end-to-end ID and invoice number to the open invoice, so that statement, ledger and ERP agree. What can go wrong: the retailer paid from an account the platform has never seen, or a bank portal dropped the remittance, and the money sits as unapplied cash.

Rejected comes off the sent step, for a limit or a timeout. The cause can be too little money or prefunding, a limit, a negative-list hit, a closed account or the clock. Nothing settles, so there's nothing to reverse; the retry needs a new message ID, a higher limit or another rail.

Return asked comes off the credited step, and the answer may be no. A duplicate, a wrong amount and a fraud all end the same way: the payer's bank sends a request for return (camt.056). On RTP the receiving bank must answer within 10 banking days and needn't return anything. On FedNow the request must come within 60 calendar days and gets an answer by midnight Eastern time the next business day. A return, when it happens, is a new payment. RTP banks now flag fraud with a reason code (including payments induced by a fraudster, since March 31, 2026), and from March 1, 2027 they must report within two business days. If there was no request at all, just an email with "new bank details", the payer bears the loss unless the receiving bank sends the money back.

Cheat sheet: the main instant rails

The counts don't compare well: UPI and Pix include tiny payments between people, while RTP and FedNow carry mostly bank and business flows.

Reach is the weak spot in the US. In the Richmond Fed's count for Q1 2026, 19.7% of US banks and credit unions were on FedNow, 13.6% on RTP and 9.6% on both. Joining is voluntary, and the Richmond Fed points to alternatives that already feel instant (Zelle, Visa Direct, Same Day ACH). Canada's Real-Time Rail targets a Q4 2026 launch. Where a central bank ran the rail and pushed everyone onto it, as Brazil's did with Pix, reach came first and volume followed.

How open banking starts a payment and reads an account

Open banking's two jobs run on two kinds of consent: a year-long consent to read an account doesn't authorize a single payment.

Pay by bank for an invoice

Picture a UK accounting-software company collecting a £4,800 annual subscription from a small architecture practice. The invoice carries a "pay by bank" link to a page run by a payment initiation provider authorized by the Financial Conduct Authority (FCA).

1. Bank chosen. The practice picks its bank, and the provider prepares the payment: amount, payee account and name, reference. What can go wrong: the bank isn't supported or its API is down, so the page needs another option.
2. Approved at the bank. The provider creates a payment consent through the bank's API, and the payer lands in its banking app, signs in with two factors, sees the amount and payee, and approves. The provider's token is tied to that one consent. What can go wrong: the payer abandons or fails the sign-in, and no money moves.
3. Sent. The provider submits the payment, and the bank checks funds and limits and sends it over Faster Payments. What can go wrong: a rejection for funds, a limit or a fraud hold leaves the invoice open.
4. Confirmed. The provider learns "settled" or "rejected" by polling or a webhook. It's a confirmation from the payer's bank, stronger than a card authorization, though the provider can hear it later than the bank knows it. What can go wrong: a timeout leaves the status unknown; ask the bank, and don't release goods before "settled".
5. Reconciled. The money lands in the software company's account (or the provider's safeguarded account, then onward), and the reference matches the invoice. A refund is a new payment back.

For recurring bills there's the variable recurring payment (VRP): the payer approves one consent with limits per payment and per period, and the provider then starts payments without the payer present. Sweeping VRPs, between a person's own accounts, are live. Commercial VRPs, for paying a business, start with utilities, regulated financial services and government; regulators expected payments from Q1 2026, and only vendors report the June 2026 launch. The industry says commercial VRP needs at least 75% of current accounts reachable.

In the US there's no regulated payment initiation role. "Pay by bank" there means an account link through an aggregator, which returns a real or tokenized account number, and then an ACH debit (returnable for 2 banking days on a business account) or an RTP or FedNow push. Chase, PNC and U.S. Bank return tokenized account numbers that work only for ACH and RTP, and Chase's stop working when the consent lapses.

Reading an account

Most US open banking traffic proves an account belongs to the customer before the first debit or payout. A platform embeds an aggregator (Plaid, MX, Finicity, Akoya, Yodlee); the customer signs in at the bank, which gives the aggregator a scoped OAuth token instead of a password; and the aggregator returns the account number, owner's name, balance or transactions. The same connection feeds lending decisions, treasury dashboards and cash application. Large banks have moved aggregators onto APIs, while screen scraping (signing in with the customer's own password) lingers at small banks and credit unions.

Consent expires. At most US banks in Plaid's documentation it lasts 12 months, and at Chase the customer picks 6 months, a year or no end date; in the EU the bank can skip a fresh sign-in for 180 days. When consent lapses the feed stops, along with any tokenized account number tied to it.

Since July 2025, JPMorgan charges aggregators for data, arguing that in June 2025 only about 13% of their requests to Chase followed something the customer had just done. Plaid signed a paid agreement in September 2025 and Yodlee, Morningstar and Akoya followed by November, all at undisclosed prices.

Elsewhere the balance differs. In the UK about 80% of open banking API calls read accounts: 2.94 billion calls in July 2026 against about 40 million payments a month. In Brazil, Pix payments started through Open Finance grew from 7.4 million in 2024 to 64.5 million in 2025, out of almost 80 billion Pix payments.