News & Insights

The complete UMCA guide to agentic payments, trusted-agent protocols, the fraud gap, new typologies, A2A rails, and model governance. One place for everything a bank needs on this topic.

Trusted-agent protocols live on card rails. Account-to-account rails have no equivalent. For Canadian, European, and US banks on A2A, in-house agent-aware fraud detection is the only line of defence.

Prompt injection payouts, mandate deception, social engineering through the agent, compromised agent sessions, and mule payouts inside the mandate. A practitioner's field guide.

Trusted-agent protocols confirm the agent is valid and has a signed mandate. That is identity and authorisation. It is not fraud detection. Here is the specific gap and how banks close it.

AI agents will shortly be making payments on behalf of customers across cards, A2A rails, and crypto. The payment networks have moved; banks have not. The lay of the land and where the fraud gap sits.

OSFI Guideline E-23 treats AI assistants used for fraud and AML decisions as models. If analysts rely on them, the institution owes a model inventory entry, independent validation, and governance evidence.

A grounded AI assistant reads the bank's own transactions and cites them. A generic LLM like ChatGPT guesses from training data. For fraud and AML work the difference is operational, legal, and regulatory.

An AI fraud investigation copilot works alongside analysts, grounds its answers in the bank's own transaction data, and shortens case review. How it differs from generic chatbots and when it makes sense to deploy.

EU lawmakers finalised the PSD3/PSR compromise texts in April 2026, mandating AI-driven fraud detection, adaptive authentication and cross-institution intelligence sharing across 27 member states by mid-2027.

FinCEN's April 2026 Notice of Proposed Rulemaking would fundamentally reshape Bank Secrecy Act programs, shifting supervisory focus from box-checking to demonstrable risk management. Comments close June 9, 2026.

FinCEN and OFAC jointly proposed the first comprehensive AML/CFT and sanctions framework for permitted payment stablecoin issuers — and explicitly recognize AI-based monitoring as a mitigating factor.

The new Anti-Money Laundering Authority is now active in Frankfurt, with direct supervision of 40 high-risk cross-border institutions starting in 2028 and the EU AML Regulation applying from July 10, 2027.

ESMA confirms the EU-wide MiCA grandfathering window closes July 1, 2026. After that date, any crypto-asset service provider without CASP authorization must stop EU operations.

From October 9, 2025 every Eurozone PSP must perform IBAN-name verification on credit transfers under the Instant Payments Regulation. We unpack the fuzzy-matching tradeoffs and what comes next for non-Eurozone PSPs by 2027.

The UAE's new AML law elevates proliferation financing to a standalone offense, and the Central Bank's April 2026 guidance pushes licensed financial institutions toward real-time monitoring and dynamic, risk-based CDD.

The Saudi Central Bank's new Counter-Fraud Fundamental Requirements Framework replaces the 2017 rules, mandating a senior-led governance committee and maturity-based anti-fraud programs across the finance sector.

A practical look at the 2026 NACHA ACH fraud-monitoring requirements and how institutions can prepare to stay compliant and secure.