6 ways to future-proof for FedNow's latest update

Three years in, and the Federal Reserve has announced a set of additions to its instant payments service: payee name verification for FedNow, an industry-wide fraud forum, and enhanced ISO 20022 messaging.  

Around 1,800 financial institutions are now live, including seven of the 10 largest banks, reaching more than half of all US checking and savings accounts. Not a bad effort. 

Here are five of those announcements – plus one thing the Fed didn’t say – and what US banks can do about them. 

1. New payee verification standards

FedACH Services’ payee name verification tool is being extended to FedNow via an API.  

It’s a sensible solution. 

Fraud has been the big topic in instant payments for years. The faster the payment, the harder it is to recover money stolen by scammers.  

But the Fed’s tool doesn’t work the way most people assume. It’s different to Confirmation of Payee (CoP) in the UK, and Verification of Payee (VoP) in the EU.   

The European models do the opposite: the payer’s PSP asks the payee’s PSP directly and gets back a match, a close match, a no match, or not possible, within five seconds. Payees can then either send, amend, or cancel the transaction. 

So the US has its own challenges to overcome. A first-time payee account has no history to search, and with no other banks involved, no one is accountable for the reference data.  

This measure is likely to reduce “malicious redirection” fraud, where someone is tricked into sending a payment to a wrong account. The UK Finance 2026 Annual Fraud report found that CoP and in-journey warnings have pushed this type of fraud to a record low. Despite this, total fraud losses in the UK rose by 4% to £1.28bn in 2025. Other forms of fraud, such as APP (Authorized Push Payment) are responsible for that rise in losses because CoP and VoP tools were never built to catch them. So the new payee verification checks will help to reduce fraud, but further measures (more on that below) are also required. 

What US banks should do

If you’re a credit union or PSP, you’ll need to assess your organisational structure. Someone needs to own the rules for how closely names should match, the exception queue and what to say to a customer if a name doesn’t line up. It’s also still unclear whether you need to check every payment, or just the large ones. This will dictate how many exceptions staff you’ll need to employ.

As you build your rules, it’s worth having answers for the following questions: 

• Who decides how close a name has to be before it counts as a match, and who checks that decision is still right?
• When the name nearly matches, what does the customer actually see on screen – and can they just carry on and pay?
• If a customer ignores the warning and loses the money, who pays: them or you?
  
• Does every payment get checked, or only the big ones?
• Where do the correct names come from, and how out of date is that list? 

2. Upgraded fraud capabilities

Federal Reserve Financial Services and The Clearing House will jointly co-chair a newly established X9 Fraud Forum, a space for banks to compare notes on fraud and a vital measure in the protection of instant payments. X9 is the accredited standards body — the Fed and TCH are co-chairs, not creators. 

Our view is that the forum’s value will come from pooling intelligence on “mule accounts” being used to move stolen money and the identities behind previous scams, and from creating a universal way of describing fraud.

What US banks should do

The forum is still in its early stages, but you don’t have to wait for it to mature. Participants already have account activity thresholds, negative lists, enhanced fraud reporting and correspondent net send limits — plus the network intelligence API, which launched this spring and uses receiver account data to assess risk before a payment is sent.

3. Reshaping request for payment

Request for payment flips who begins the transaction. Instead of the customer pushing money out, the party owed the money – a utility, a landlord, a merchant – sends a message asking to be paid. It arrives in the customer’s banking app with the amount and the reason already filled in. The customer taps approve, and the money goes. 

(If you want to influence how it gets built, the window is closing. You should contact your Fed relationship manager.) 

Every aspect of how the process is designed matters. The Fed’s guidance already settles part of it — Creditor Name must be populated systematically by the Sender FI, must be recognizable to the payer, and the biller must not be able to alter it. 

But there’s also a less obvious risk: reconciliation. For example, a biller requests $412.60. The wrong amount is paid, or it arrives two days late, with no reference attached. The request and the payment still have to be matched. If your systems can’t check it automatically, it becomes a daily manual task.

What US banks should do

When building your own request for payment capability, consider the following questions:

• Who is allowed to send requests to your customers, and who approves that list? 
• What will the payer see about the requester, and is it enough to decide safely?
• If a customer approves a fraudulent request, where does the loss sit? The customer, the bank, or the sponsor bank?
• Can we suspend a biller out of hours, and who holds that authority?
• Does our Payment Engine provider support RFP, and on whose timeline?

4. The $10 million limit

In November 2025 the network transaction limit rose from $1 million to $10 million, explicitly to unlock real estate, corporate treasury, payroll and vendor payments. Both US instant rails now sit at $10 million, and  Nacha is introducing a similar increase for Same-Day ACH in 2027. 

That’s what makes the Fed’s focus on insurance payouts, real estate, and auto loans a risk story. Take auto lending as an example. Before instant payments, credit, affordability, and fraud checks all happen before a loan is approved and funds are released. Switching to instant settlement introduces multiple factors that can impact the transaction:

Customer experience: each check must line up and pass in a few seconds or the ‘instant’ part of the experience is lost.

Financial data: credit files refresh on furnisher cycles measured in weeks, not seconds, so a lender’s decision is based on out-of-date information.

Liquidity: always-on lending means money needs to be available at any hour, even when an auto dealership closes a sale at 3pm on Saturday.

What US banks should do

As these issues emerge, you need to figure out if your partners can complete credit checks and release funds in seconds. You need to define which checks to complete before sending any money, and what can wait until afterwards. And you will need a system for when credit reports change the initial lending circumstances, but the money has already been sent.

5. ISO 20022

The Fed’s enhanced ISO 20022 messaging arrives in Q4 2026. It’s being presented as groundwork for more seamless cross-border payments. But FedNow isn’t becoming an international payment service — it only controls the domestic portion. The upgrade enables something called ‘One-Leg Out’ (which you may have seen in Europe). This is a payment where a sender or receiver is based outside the US, but FedNow only settles on the US side. But at the moment this is more theoretical than a genuine possibility.  

Currently Regulation J stops FedNow participants from using any intermediary other than the Reserve Bank. This is why the service has remained domestic-only. The Fed proposed changing this in April 2026 and comments closed in June. The Clearing House and Bank Policy Institute supported the goal but also raised concerns. Both questioned whether FedNow’s five-second response window leaves enough time for real-time sanctions and compliance screening on the international leg.  

FedNow runs 24x7x365, but the non-instant banking world has cut-offs, holidays and business hours. This mismatch hits hardest on sanctions screening: while a domestic FedNow payment clears in seconds, the cross-border leg involves FX, global sanctions lists and counterparties in other jurisdictions. What gets screened, when, and who’s liable if a name matches a sanctions list after the US leg has settled, are details that still need to be decided. The institutions running the country’s largest correspondent books have told the Fed these are unresolved, so you need to design around these details, not the messaging specs. 

What US banks should do

A small group of early adopters has already joined early testing on the enhanced formats. As with request for payment, the window to shape it is closing. If you want to be involved, now’s the time.

6. 24/7 liquidity

Liquidity wasn’t mentioned in the Fed update, but each item on the list assumes the money is available. 

FedNow isn’t prefunded. Payments settle in the participant’s — or its correspondent’s — Federal Reserve master account. Don’t expect the service to reject payments for insufficient balance or overdraft capacity: standard intraday and overnight overdraft fees apply, the Reserve Banks don’t intend to open the discount window outside standard hours, and a Reserve Bank may temporarily block a participant from sending value messages if its intraday overdraft reaches a level posing heightened risk. 

So the risk isn’t failing to prefund. It’s accruing overdraft exposure across a weekend, with no discount window, no Fedwire to square the position, and a cycle date that rolls at the 7:00 p.m. ET Fedwire close — including weekends and holidays. You can’t use the old batch-era model of funding to a daily cycle. The tool for it is the liquidity management transfer (pacs.009), which settles without seeking confirmation from the receiving institution.

What US banks should do

Make one person accountable. They’re the one who gets woken up at 3am when a balance needs topping up. If you can’t name that person now, then start thinking who it should be. 

If you’re a PSP, you have even more to think about. Your funds come from a sponsor bank, so the forecast, buffer and top-up triggers have to be agreed and tested before a busy weekend, not during one. 

The gap will narrow, but not soon. Fedwire Funds Service hours expand to 22x6 (Sunday to Friday, including weekday holidays) for implementation in 2028 or 2029, with no change to the treatment of daylight or overnight overdrafts on weekends and holidays. Two to three years of weekend exposure is a good reason to name that person now. 

What does this mean for you?

These updates do not sit in isolation. Behind payee name verification, fraud measures and ISO messaging you need to figure out the same things:

• How closely details match before flagging a problem
• Where flagged payments are sent for review
• What triggers a fund release
• How to carry out sanctions checks
• How new message data gets translated in your system
• What you tell a customer when something fails

Build this layer once rather than for each new feature. When fraud screening, funding decisions, and exception handling all sit above the payment rail, then the next Fed rollout means a minor adjustment, not a brand new project. 

And remember: connection speed is not readiness. The update mentions one participant who was onboarded and went live in a record-setting five days. That’s onboarding. It only gets you connected. Readiness depends on how well prepared your systems are.

How RedCompass Labs can help

We have helped institutions launch and scale instant payments in more than 20 markets, including SEPA Instant, FedNow, RTP, Pix and UPI, and we’ve worked with Payments Canada on Canada’s Real-Time Rail ahead of its Q4 2026 launch. We’ve seen much of this roadmap before. We’ve helped it land somewhere else, navigating the same pitfalls. 

Whether you are already live, connecting directly, or joining through a sponsor or service provider. 

Find out how the Payments Expert Agent can help.