Five Seconds to Say No

Money now moves faster than the review of it

Instant payments have crossed the line from pilot to infrastructure. FedNow marked its third year of operation in 2026 with more than 1,800 financial institutions live on the network, and The Clearing House’s RTP network processed roughly 142 million payments worth about 576 billion dollars in the second quarter of 2026 alone. For a growing share of the money moving through US banks, settlement is now measured in seconds, not days.

These rails have two properties that rewrite the compliance problem. They are push-based, and they are final. Once a payment is sent, it cannot be modified, canceled, or recalled. On FedNow, the receiving institution has up to five seconds to answer each incoming payment: accept it, reject it, or accept it without posting. The accept-without-posting option is narrow, and a bank that uses it generally has to return the funds or post the payment by the next business day. In practice, the moment to stop a prohibited payment is the moment it arrives.

Speed is not a defense

Regulators have been deliberately light on prescription here. OFAC does not mandate a specific screening process for instant payments, and it has indicated that instant payments confined to accounts at US banks generally present lower sanctions risk. FedNow itself does not require real-time transaction screening. It would be easy to read that restraint as permission to screen less.

That reading is a mistake. Sanctions compliance is effectively strict liability: if a prohibited payment settles, the violation has occurred, and the speed of the rail that carried it is not a mitigating fact. The absence of a prescribed process is not the absence of an obligation. It simply means the obligation now has to be met inside the clock the rail imposes.

It helps to separate two controls that are often blurred together. Sanctions screening is a gate: it decides whether a specific payment is allowed to proceed. Suspicious activity monitoring is a lens: it studies patterns across days and transactions to decide what to do about a customer. Only the gate has to live inside the five-second window. Forcing pattern-based monitoring into that window adds latency and failure points without adding protection; the discipline is knowing which control actually has to decide in real time, and which one does not.

The real constraint is data, not milliseconds

A five-second budget sounds like an engineering problem, and plenty of vendors are happy to sell it as one. Comparing a name against a list is fast, and it is getting faster. The hard part is not the match; it is the judgment. In the time available, a program has to decide whether a fuzzy hit is the sanctioned party or an innocent namesake, and for most of the volume it has to decide without a human in the loop.

That is where the quality and the context of the underlying data decide the outcome:

1. Thin data over-matches. A list entry that is little more than a name and a country will flag thousands of ordinary customers who happen to share it. Every false positive either blocks a legitimate payment or burns the window waiting for a review that cannot finish in time.
2. Thin data under-matches. That same sparse record misses the alias, the transliterated spelling, or the context that would have identified the real target. The payment settles, and it cannot be undone.
3. Stale data screens against yesterday. A watchlist that is hours or days behind is screening against a world that no longer exists. New designations land, and payments clear against a list that has not caught up.

None of these is a speed failure. Each is a data failure that the speed of the rail simply exposes. The window does not create the weakness; it removes the slack that used to hide it.

Regulators penalize bad data, not fast rails

The cost of getting this wrong was underlined in October 2026, when US authorities imposed more than 1.2 billion dollars in penalties on a major bank for anti-money-laundering and sanctions failures, an action the Treasury described as among the largest in its history. The resolution spanned three agencies and included a separate sanctions settlement covering hundreds of apparent violations across multiple programs.

What the sanctions findings describe is instructive. Regulators pointed to payments involving blocked banks, a failure to properly prioritize sanctions alerts, and delays in updating watchlists. Read that list again: it is not a story about transactions moving too quickly. It is a story about alert prioritization and stale reference data. The enforcement exposure that regulators actually act on is the currency and the quality of the data a program screens against, and the ability to tell a material hit from noise.

The window is about to get harder

The pressure is set to intensify. In April 2026, the Federal Reserve Board proposed changes to Regulation J that would allow FedNow to carry the US leg of international payments. Cross-border flows are precisely where sanctions exposure concentrates, and they are exactly the flows that a domestic-only risk assumption was never built to cover.

The industry has already flagged the collision. In June 2026, The Clearing House and the Bank Policy Institute warned that the five-second response requirement could push banks to answer nearly every cross-border payment with accept-without-posting, and urged the Fed to modify FedNow’s timeout and response timeframes for international traffic. Strip away the procedural language and the message is plain: the instant-payment window and rigorous cross-border screening are on a collision course, and institutions that have leaned on a lower-risk domestic assumption will need a sharper screen, not a slower one.