Payment Risk

Payment risk is the collective name for the risks that arise when money is moved from one party to another: that the payment is not completed, is completed late, goes to the wrong person, is fraudulent, or leaves one participant exposed to another that fails. It concerns banks, central banks, payment system operators, card schemes, processors, money transmitters and the businesses and consumers who send and receive money.

At the level of whole systems, payment risk is defined by international standards from the Bank for International Settlements, which group it into credit, liquidity, settlement, operational, legal and business risks. At the level of individual firms and customers, the most visible parts are payment fraud and disputes. Transaction risk describes the same concerns one payment at a time.

Imagine swapping a car with a stranger. You hand over your keys; they are meant to hand over theirs. If they drive off without giving you their keys, you have lost your car. If they hand over keys to a car that turns out to be stolen, you have a different problem. If the paperwork is wrong, ownership might be disputed later.

Moving money has all of these problems on a far bigger scale. Banks send each other billions every day and sometimes deliver their side before receiving the other. Customers can be tricked into paying the wrong person. Computers can fail halfway through. Payment risk covers all the ways a transfer of money can go wrong, and the rules and system designs built to stop one failure spreading to others.

• Credit risk. A participant pays out before receiving funds, and the other side fails; in payments this is close to counterparty risk.
• Liquidity risk. A participant will eventually pay but does not have the money at the moment it is due, which can hold up its own payments to others; see liquidity risk.
• Settlement risk. One leg of an exchange settles and the other does not. In foreign exchange this is known as Herstatt risk, after the German bank closed in 1974 while counterparties were still waiting for dollars; see settlement risk.
• Operational risk. Outages, cyberattacks, errors and supplier failures; see operational risk and cybersecurity risk.
• Legal risk. Uncertainty about when a payment is final or whether it can be unwound in an insolvency.
• Fraud and dispute risk. Unauthorised payments, scams and chargebacks, which fall mostly on banks, merchants and consumers.

System design does much of the work. A real-time gross settlement system settles each payment individually in central bank money, removing credit risk between banks but requiring more liquidity. A deferred net settlement system saves liquidity through netting but leaves exposures open until the settlement time. Each bank's net position is:

$N_i$ is bank $i$'s net position at settlement: positive means it is owed money, negative means it must pay in. Worked example: bank A sends 100 to B and receives 70 from B and 20 from C, so $N_A = 90 - 100 = -10$. Instead of moving 100 in gross payments, A settles only 10, but if A failed before settlement, others would be left waiting for funds they had counted on.

Other common tools include:

• Payment-versus-payment settlement for currency trades, provided by CLS.
• Central bank intraday credit, usually against collateral, to keep payments flowing.
• Collateral pools and loss-sharing rules in netting systems, and default arrangements at a central counterparty.
• Legal finality rules, such as the EU Settlement Finality Directive, which protect settled payments from being unwound if a participant becomes insolvent.
• Prefunding requirements for money transfer operators and fintechs, so that a partner never pays out before receiving funds.

The Principles for Financial Market Infrastructures (PFMI), published in 2012 by the BIS Committee on Payment and Settlement Systems (now the Committee on Payments and Market Infrastructures) and IOSCO, set the global benchmark for how systemically important payment systems manage credit, liquidity, settlement, operational and legal risk. Central banks apply them to the systems they oversee. In the United States, the Federal Reserve's Payment System Risk policy governs how banks may use intraday credit in Fed accounts.

Rules aimed at fraud and errors in retail payments have tightened:

• United States. Nacha's ACH fraud-monitoring rules require banks, originators and third-party processors to have risk-based processes to identify payments sent under false pretences; phase 1 (all originating banks and the largest originators and processors) took effect on 20 March 2026 and phase 2 (everyone else) in June 2026.
• United Kingdom. Since 7 October 2024, victims of authorised push payment fraud over Faster Payments and CHAPS can generally claim reimbursement up to £85,000, with the cost shared between the sending and receiving firms.
• European Union. Under the Instant Payments Regulation, euro-area payment providers have had to offer Verification of Payee since 9 October 2025, so payers are warned if the name does not match the account.

Merchants face chargebacks, refunds and fraud on card payments, managed through fraud risk management and attention to chargeback risk. Acquirers and payment facilitators carry the risk that a merchant fails while owing refunds, and often hold a reserve account against it. Corporate treasuries face fraud through redirected supplier payments, often via business email compromise. In each case payment risk sits within a firm's wider risk management.

• CPMI–IOSCO: Principles for Financial Market Infrastructures
• Federal Reserve: Payment System Risk