Tareq Shaheen explains why Europe’s drive for greater control over payments could leave financial institutions managing a more fragmented and operationally demanding ecosystem

Europe wants greater control over its payment infrastructure. But achieving it could initially leave banks managing more infrastructure, not less.  

That is the tension at the heart of Europe’s push for greater digital sovereignty. For decades, European payments have relied heavily on US-owned infrastructure. According to the European Central Bank, US companies currently process 61% of European card payments.  

Until recently, that dependence attracted relatively little concern. But geopolitical relationships have changed, and policymakers are increasingly questioning what happens when critical infrastructure sits outside their direct control. Some in the European Parliament have even raised concerns that Washington could potentially “cut off” access to key systems. 

Payments are therefore being treated less like a background utility and more like the critical infrastructure they have become. 

The response is already taking shape. The European Central Bank is developing the digital euro, designed to give European citizens access to sovereign digital money. The European Payments Initiative has launched Wero, a pan-European wallet intended to support instant payments across the continent. Domestic instant payment schemes are also continuing to evolve. 

Politically, the direction makes sense. Operationally, it creates a new challenge. 

Europe is adding payment rails, not replacing them 

New regional systems will not make existing global networks disappear overnight. Banks will still need to work with established schemes such as SWIFT, Visa and Mastercard while also supporting the digital euro, Wero, domestic instant payment systems and potentially further regional networks as they emerge. And that creates a much more complicated environment. 

Each system can bring different technical requirements, APIs, rules and messaging standards. Connecting to them takes time and investment, while maintaining those integrations creates an ongoing cost. Differences between schemes can also slow product development and make cross-border payments harder to manage. 

The result is a payments environment built around multiple rails rather than a small number of dominant networks. 

For financial institutions, the challenge is therefore not simply connecting to new sovereign infrastructure. It is being able to manage old and new payment systems side by side without creating a patchwork of separate processes. And that complexity does not stop at the infrastructure itself. 

Fragmented rails create fragmented risk 

Connecting to every payment rail is only useful if a bank can still understand what is happening across them. A payment might start on one system, pass through another and arrive in a different format. Along the way, information can be translated, reformatted or, in some cases, reduced. 

This makes it harder to follow the full journey of a transaction. 

A payment that appears unremarkable within one channel may form part of a much more concerning pattern when viewed alongside activity elsewhere. Funds could be split across several payment types. Transactions could be routed through different channels to disguise their origin. An indirect connection to a sanctioned entity might only become apparent once relationships across multiple payments are considered together. 

Standards such as ISO 20022 help by creating a richer and more structured approach to payments data. But implementation is not identical across every system. Some rails carry detailed information, while others may truncate fields or use different naming conventions. 

Those inconsistencies matter for compliance. Sanctions screening depends on accurate names and identifiers. Transaction monitoring depends on being able to recognise patterns. When the underlying information varies from one system to another, financial institutions can either miss genuine risk or compensate with controls that generate more false positives. 

The problem becomes even greater when each payment type is monitored separately. If card payments, instant payments, account-to-account transfers and wallet transactions all sit in their own environments, compliance teams may only ever see individual pieces of the picture. What looks normal in one system could become suspicious when combined with activity elsewhere. 

Financial institutions therefore need more than connectivity. They need to be able to follow the information and risk across different rails as easily as the payments themselves. 

Banks need one view across many systems 

As the payments ecosystem fragments, the answer is not to build another silo for every new scheme. 

Instead, financial institutions need a common layer that can bring payment activity together across systems. 

A centralised payments hub can help orchestrate transactions from multiple sources and translate different messaging formats into a consistent structure. This gives institutions a way to analyse activity across payment types rather than treating each rail as a separate environment. 

The same principle applies to compliance. 

Bringing data together allows transaction monitoring and sanctions controls to work across channels. Instead of asking whether a single payment looks suspicious, institutions can examine whether it forms part of a wider pattern spanning several systems. 

That is particularly important as sovereign and regional payment networks continue to grow. The more fragmented the infrastructure becomes, the more valuable a common data and intelligence layer will be. 

Technology alone, however, will not solve the problem. 

Banks also need operating models, architectures and data strategies designed for a world in which payment types continue to proliferate. Adding new rails without thinking about how information, compliance processes and decision-making will work across them simply moves fragmentation from the external market into the institution itself. 

Sovereignty will not mean simplicity 

Europe’s push for payment sovereignty is rooted in a legitimate concern. Payments are now critical infrastructure, comparable in importance to energy, transport and communications, and governments understandably want greater control over the systems on which their economies depend. 

But greater sovereignty does not automatically mean greater simplicity. 

In the short term, it is likely to mean more networks, more standards and more payment journeys for banks to manage. The institutions that navigate this transition successfully will be those that can support that diversity without allowing their own operations, data and compliance controls to become fragmented alongside it. 

Baiba Miezere, Group Product Development Director at Eastnets 

The payments industry has spent years treating fraud prevention as a detection problem. PSD3 reframes it as an infrastructure problem, and that distinction matters enormously for how institutions should now be thinking about their technology stack. 

The Regulatory Signal Worth Reading Carefully 

PSD3 is frequently discussed in terms of its compliance burden: stronger authentication, expanded liability, tighter rules around authorised push payment fraud. But the more important signal is structural. By increasing liability for fraud losses and accelerating the shift toward instant payment rails, the regulation is effectively forcing fraud prevention out of the back office and into the transaction execution path itself. While PSD was concentrating more on cards, pull payments, reversible transactions, PSD3 addresses rapidly growing pain-point in financial market: instant payments, irreversible push payments, open banking Account-to-account payments, real time fraud.   

This is a meaningful change. For most institutions, fraud review has historically happened after the fact, a monitoring function that flags anomalies, investigates cases, and seeks recovery. That model was always imperfect, but it was manageable when payment cycles gave you hours or days. Instant payments collapse that window to seconds. Once funds move, recovery options are limited. The liquidation point, where fraudsters convert access into irreversible transfers, now happens faster than most legacy fraud systems can respond. Fraud methods have also rapidly evolved: social engineering scams, synthetic identities, account takeovers, authorised push payment fraud – all requiring shift from traditional post-transaction rule-based monitoring to real-time cross-payment channels detection, combined with behavioural biometrics and artificial intelligence layer.  

PSD3 doesn’t just tighten rules. It implicitly requires a different architecture, different tooling. 

Why Behavioural Intelligence Is Now Central, Not Optional 

The fraud typologies that PSD3 is most focused on, particularly APP fraud and account takeover, share a common characteristic: they’re hard to catch at the transaction level alone. A payment instruction may look entirely legitimate in isolation. The anomaly only becomes visible when you layer in behavioural context: Is this consistent with how this customer normally behaves? Is the session access pattern unusual? Is the same device and behavioural pattern spotted across other accounts and payment methods?  Has the beneficiary relationship changed recently? 

This shift explains why the industry has been moving toward a more integrated approach to fraud prevention. To comply with PSD3 and evolving fraud, institutions shall combine entity-level risk profiling, session-level intelligence, and transaction-level risk scoring to create a fuller view of risk before a payment is executed. 

The challenge is that, in most institutions, these capabilities remain siloed. Behavioural analytics may sit in a separate system or be missing altogether, while transaction monitoring is split across channels, with one solution for cards and another for wire transfers. This often leaves instant payments, account-to-account payments, crypto payments, and buy-now-pay-later flows insufficiently covered, especially when detection and decisioning must happen within milliseconds. 

The result is a fragmented control environment, with no unified decision point that brings all relevant signals together before a payment is released. 

The gap between these layers is where fraud increasingly lives. Schemes evolve precisely to exploit the seams between detection systems. Static rules, however sophisticated, are inherently reactive, they catch what’s already been seen. The more durable approach combines rules-based detection for known patterns with unsupervised machine learning that identifies deviations from normal behaviour without requiring prior fraud examples. This handles both the known unknowns and the genuinely novel. 

The Swift Dimension That Often Gets Overlooked 

Much of the conversation around PSD3 and instant payments focuses on domestic retail rails, which makes sense given where consumer fraud volumes are concentrated. But high-value cross-border payments represent a distinct and underserved risk surface. 

Swift traffic sits largely outside the scope of consumer-focused fraud tools. Yet correspondent banking flows carry significant value, and the attack vectors, compromised operator credentials, fraudulent payment instructions, manipulation of debit confirmations, are well-documented. The ability to monitor Swift messages at multiple interception points, cross-reference MT900 confirmations against MT103 instructions, and, critically, issue stop-and-recall instructions via the GPI tracker for payments already in-network, meaningfully extends the intervention window beyond what’s possible on domestic rails. 

Very few fraud prevention architectures address this channel natively alongside retail payments. That gap deserves more attention as institutions think about end-to-end coverage. 

From Compliance Burden to Architecture Decision 

The institutions that will navigate PSD3 most effectively aren’t those that treat it as a compliance checkbox. They’re the ones that use the regulatory moment to reassess their fraud prevention architecture more fundamentally, asking not just “what do we need to do to comply?” but “what does a genuinely real-time, multi-channel fraud prevention capability actually look like, and do we have it?” 

That question tends to surface uncomfortable answers. Fragmented point solutions. Offline analysis loops. Gaps in channel coverage. Detection capabilities that operate after execution rather than within it. Manual fraud investigation processes. Rapidly growing fraud volumes that institutions are expected to manage without proportionally increasing investigator teams and operational costs. 

The regulation provides the mandate. The harder work is architectural: building or acquiring a unified control layer that sits within the payment workflow, combines behavioural and transactional signals, covers the full range of payment rails, and makes preventive decisions in real time rather than purely detective ones after the fact. Done well, this approach can strengthen detection, improve the customer experience, reduce operational costs, and significantly increase the effectiveness and productivity of fraud investigators.  

That’s not a product category. It’s an infrastructure requirement. And PSD3 has just made it non-negotiable. 

Hassan Zebdeh, Financial Crime and Payment Advisor at Eastnets, outlines how banks can achieve stronger compliance outcomes by embracing more efficient, connected ways of working. 

Compliance has become one of the most resource-intensive functions inside modern banks. Year after year, institutions invest more people, more technology and more time into meeting expanding regulatory expectations, yet many find themselves no closer to achieving meaningful reductions in risk. Or cost. 

At the same time, financial crime is evolving daily, payments are moving in real time and regulators are increasingly focused on outcomes rather than process. While effort may increase, effectiveness doesn’t always follow suit. The systems and processes that once supported compliance in a pre-AI age are now being stretched to their limits, revealing a widening gap between what institutions put in and what they get back. 

This growing imbalance raises a critical question for the industry: how financially sustainable is the current approach to compliance, and what needs to change if banks are to keep pace with risk and regulation? 

The growing strain on compliance

Regulatory compliance can now account for more than 13% of operating costs, yet many banks continue to struggle with the same operational challenges. For most, rising spend has become the default setting for keeping up with regulatory obligations, rather than a reliable way to improve how risk is managed in practice. 

Part of the challenge lies in how compliance has evolved. In recent years alone, banks have had to absorb a wave of new and evolving requirements – from the EU’s AML Package and DORA’s operational obligations to global FATCA/CRS reporting deadlines and many other regulations globally. The response to these changes has often involved layering new controls, systems and processes onto existing ones, adding complexity without fundamentally rethinking how compliance has changed. 

The result is an environment that’s increasingly fragmented and difficult to scale. Compliance teams are expected to deliver faster detection, clearer auditability and stronger risk differentiation, while still relying on operating systems shaped by outdated processes and disconnected data. And yet, a single alert can take anywhere up to 22 hours to action – while some instant payments schemes require decisions in seconds, other nations still operate within minutes or longer. Sanctions lists are also changing, with the Office of Foreign Assets Control (OFAC) imposing sanctions on [https://”/]over 1,300 individuals and entities in 2025 alone, with this likely to double in 2026​. Banks are having to manage risk continuously, even as they attempt to modernise operations that were never designed for today’s pace, landscape or scale. 

Making matters harder, many firms are struggling to find and retain professionals with the right mix of legal, technical and operational expertise to work on these older platforms too. Experienced professionals are retiring en-masse, while nearly half of the new entrants lack the right experience needed to step into these roles effectively. Then again, why would the modern workforce want to work on outdated systems when they can choose new, more agile players within the industry? 

Taken together, this all culminates into a costly endeavour. There is little being done on a broader scale to address the underlying mismatch between rising complexity and operational capacity. Therefore, to keep pace with risk and regulation, we need an entirely different approach; one that focuses more on how compliance is designed, connected and executed. 

Reimagining compliance for a real-time world

For banks willing to rethink how compliance operates, this moment presents a clear opportunity to not only strengthen oversight, but to escape a cycle of rising cost and diminishing returns. As regulatory expectations rise and financial infrastructure accelerates, institutions have a chance to move beyond reactive expansion and build compliance frameworks that are both more effective and more economically sustainable. 

An efficiency-driven compliance framework is central to breaking this cycle. Rather than increasing headcount or layering new processes each time risk or regulation evolves, the focus needs to be on improving how compliance work is performed. By reducing duplication and allowing better decision-making at scale, efficiency helps banks contain costs while improving outcomes, addressing the root cause of the compliance cost trap. The question becomes; how can organisations unlock these improvements? In practice, this shift is anchored in four core capabilities that together redefine modern compliance. 

First, automation helps decouple compliance effectiveness from both headcount growth and large-scale system change. By streamlining the likes of data collection, enrichment and alert handling on top of existing environments, automation reduces manual effort without requiring a full ‘rip and replace’ approach of legacy platforms. This lowers the cost of day-to-day compliance activity while improving consistency and investigation speed. 

Next, risk-based approaches make sure resources are applied where they make the most difference. In practice, this means deeper scrutiny for higher-risk customers, geographies or transaction patterns, while allowing faster, lighter-touch processing for low-risk activity. With AI models and agents, banks can learn from historical patterns, detect subtle anomalies and adapt to evolving fraud and financial crime typologies, using a risk-based approach to automatically reduce false positives. But by tailoring controls to actual exposure, institutions can improve outcomes while reducing unnecessary operational burden. 

The third capability is streamlined reporting. This can be a time-consuming component of compliance, but automated, standardised reporting helps institutions meet regulatory obligations more efficiently, particularly across jurisdictions. By producing consistent, explainable and audit-ready outputs, financial institutions can reduce the recurring cost of manual reconciliation, remediation and regulatory engagement – all while strengthening compliance confidence. 

Finally, interoperability underpins efficiency. Compliance systems rarely operate in isolation and replacing them outright is too costly and disruptive. Interoperable environments, however, allow institutions to modernise incrementally – connecting existing systems, eliminating duplication and extending the value of current investments – without downtime or operational risk. 

Together, these four capabilities help shift compliance away from perpetual cost growth and toward a more stable, scalable model. Efficiency simply becomes the next frontier. Not as a shortcut, but as the mechanism through which banks strengthen defences, control costs and remain resilient in an increasingly demanding regulatory environment. 

Escaping the cost trap

As regulation becomes more outcome-focused and financial crime continues to evolve, banks are being pushed to reconsider not how much they spend on compliance, but how effectively that investment is put to work. 

Efficiency now represents the next frontier of compliance. And those institutions that rethink how compliance is designed, connected and scaled will be better positioned to strengthen defences, control cost growth and respond faster to change.  

The opportunity ahead is to move compliance beyond perpetual expansion and toward purposeful design. For banks, regulators and the wider financial ecosystem, the objective is clear: build compliance frameworks that are fit for the future, resilient by default and capable of keeping pace with risk – all without letting cost become the limiting factor.