The Payments Pulse: The Checkpoint Moves Inside the Payment

Mastercard can now put a risk score on a stablecoin transfer before the money moves. The service, called Stablecoin Security, launched October 19 at Money20/20 in Las Vegas. It checks where the funds came from, whether a restricted party is involved and whether the transfer looks like a scam, all through one API call.

The same week, the OCC finalized its rulebook for US payment stablecoin issuers. Starling Bank said its AI investigator clears a monitoring alert in 17 seconds. And a power failure in a Google Cloud region took parts of Revolut and several UK banks offline for most of a working day.

Four stories, one pattern. The checkpoint is moving inside the payment. Controls that used to sit around the rails (the after-the-fact audit, the review queue, the vendor questionnaire) are being built into the rails and run at execution time. For high-risk merchants that changes when you learn about a problem. It’s before settlement now, not at the next review.

1. The OCC writes the issuer standard

On October 21 the OCC released its final rule implementing the GENIUS Act for payment stablecoins. It covers reserve backing, redemption, custody and risk management for issuers under OCC jurisdiction. The rule and the Act take effect January 18, 2027. According to Decrypt’s coverage, issuers get a bit more reserve flexibility than the draft allowed, and third-party reward arrangements are reviewed case by case.

The gap matters as much as the text. Anti-money-laundering and sanctions requirements aren’t in this rule. They’re coming in a separate rulemaking with Treasury. So acquirers get a defined standard for issuer solvency this January, and a standard for issuer conduct later.

We’d read that as a sequencing signal. In The Rules Are Stalling. The Rails Aren’t we made the case that the rails keep moving while the rulebook lags. This rule is one piece of it catching up, and banks and processors will use it to ask which issuers sit behind the flows a merchant touches.

What operators should do: build an issuer register. A merchant paying affiliates in a dollar stablecoin, for example, should be able to name the issuer, say where the reserves sit and show that the issuer is on a path to GENIUS compliance. “We use whatever the exchange offers” won’t hold up in your next onboarding or renewal review.

2. Mastercard screens the transfer, not the account

On card rails, the network sits in the middle and can score every transaction. Stablecoin transfers settle on open ledgers with no such chokepoint, which is why compliance teams treat them as high-friction. Stablecoin Security is Mastercard’s answer: take the card world’s risk data, combine it with blockchain analytics, and return a score before the payment completes.

The details are worth reading. Launch partners are Borderless.xyz and Keyrails, and it starts in North America, with worldwide availability expected in 2027. Mastercard says its own study found nearly 60% of the stablecoin transfer events it analyzed were complex, multi-step transactions, which is exactly where simple wallet screening misses things. It also plans to expand through BVNK, the stablecoin infrastructure company it acquired in August.

Put that next to the OCC rule and you get a clear direction. It’s the same tightening we described in The Perimeter Is Tightening on Every Rail at Once, now reaching open ledgers. Stablecoins are being pulled inside the regulated perimeter, and the card networks intend to run the checkpoint.

What operators should do: ask your PSP or payout provider whether your transfers will pass through a screen like this, what a held transfer looks like and who gets told. Then check the wallets you pay out to. A risky destination will now stall the payment, not just flag it for next week’s review.

3. AI investigators decide in seconds

Starling Bank said on October 21 that it built an agentic investigator into its core banking engine. It takes a transaction-monitoring alert, investigates, writes the audit trail and issues a decision in about 17 seconds. That’s the bank’s figure, with no baseline or independent check published.

What Starling hasn’t said is just as telling. It hasn’t disclosed how much human review sits behind those decisions, whether the model is built in-house or licensed, or what its alert volumes and false-positive rates look like. A 17-second decision is impressive. A 17-second decision nobody can explain to an examiner is a liability.

For high-risk merchants this lands close to home. Chargeback monitoring, KYC refreshes and transaction review eat headcount. Agentic tooling will cut the cost per case. It’ll also raise the bar, because once your PSP can investigate in seconds, regulators will expect it to. It’s the logic behind Compliance Is Becoming the Infrastructure: when the check is part of the system, the record of what it did is part of the product.

What operators should do: ask your PSP for the decision log behind any automated call. You want to see what the system looked at, what it decided and who can override it. If they can’t show you, assume an examiner will notice too.

4. A London outage shows resilience is a control too

On Tuesday, October 20, problems began shortly after 07:00 BST in Google Cloud’s europe-west2 region, which Google traced to a power event at a third-party facility. Revolut logged more than 1,500 outage reports by 08:00. Lloyds, Halifax, Bank of Scotland and HSBC customers reported problems, and so did Royal Mail, DPD and Rightmove. Most services were back by mid-afternoon. The FCA said it was in contact with Google and seeking more information.

Two days later FCA chief executive Nikhil Rathi used the incident in his Mansion House speech to illustrate concentration risk from cloud and AI providers. He argued for outcome-based supervision over tick-box compliance.

Here’s the part that applies to multi-acquirer stacks. Having three acquirers isn’t redundancy if routing, fraud scoring and settlement for all three run in one cloud region. A processor that can reroute card traffic to a second acquirer in minutes but can’t move its fraud scoring out of London hasn’t solved the problem. It’s moved it. We made the broader point in Every Rail Just Became a Liability Surface, and a regional outage is the plainest version of it.

What operators should do: ask each provider where routing, fraud scoring and settlement actually run, and when they last tested a failover outside that region. Under outcome-based supervision, “our vendor went down” is a weaker defense than it used to be, and examiners will want to see that you asked before the outage, not after.

What this means for operators

The common thread is timing. Each of these changes moves a check from after the payment to during it, and that has practical consequences.

Automated decisions need a paper trail. Whether it’s your PSP’s AI or your own, you should be able to answer three questions about any automated decision: what it saw, what it decided and who can override it.

Resilience belongs in the compliance file. Map where routing, fraud and settlement run, name your failover, and write down the last time you tested it.

Contracts matter more. Ask partners how they handle pre-execution screening failures, who bears the cost of a held transfer and how fast you get an answer. A payout that sits in review for two days is a cash-flow problem for you, and the contract should say who pays for it.

Pick a starting point. If you only have time for one thing this quarter, list every stablecoin issuer, wallet provider and cloud region your payment flow depends on. That single page answers most of the questions your acquirer, your regulator or your next partner is going to ask.

The bottom line

For years, risk controls were something you passed. This week’s news says they’re something the payment runs through. The firms that’ll keep access to the rails are the ones that can see their own flows as clearly as the network does.