Payment Run Agent

Cross-border disbursement at a multinational does not run on one payment rail - it runs on nine in parallel. A US-listed parent with European subsidiaries and UK operations releases payments through ACH (NACHA Operating Rules) for batched US supplier payments, Fedwire (Federal Reserve Regulation J) for US high-value over the USD 1M Same-Day ACH cap, RTP (The Clearing House) and FedNow (Federal Reserve, launched July 2023) for US instant payments, BACS (Pay.UK Standard 18) for batched UK supplier payments, CHAPS (Bank of England RTGS) for UK same-day high-value, Faster Payments (Pay.UK FPS) for UK instant under GBP 1M, SEPA Credit Transfer (EPC scheme) for batched euro-denominated payments, and SEPA Instant Credit Transfer (Regulation 2024/886, mandatory receive 9 January 2025 and mandatory send 9 October 2025) for euro-denominated instant. Cross-border non-EU continues on SWIFT MT103 transitioning to ISO 20022 MX (PACS.008) by 22 November 2025 under the coordinated central-bank cutover. Layer over this the OFAC strict-liability sanctions regime, which averages a USD 1.5M penalty per violation, the BSA and EU AML monitoring rules, and the SOX 404 internal-controls regime with its PCAOB AS 2201 design and operating-effectiveness testing, and the payment run becomes a coordination problem that no single AP clerk can run consistently at weekly or daily velocity.

An OFAC violation, a SOX 404 material weakness, and the SEPA SCT Inst deadline each carry seven-figure consequences

OFAC operates under strict liability. Civil penalties under IEEPA 50 USC 1705 do not require intent - the fact of the prohibited transaction is sufficient for liability. The current per-violation average penalty is approximately USD 1.5M, with cumulative annual OFAC enforcement actions exceeding USD 1.5B in 2024 across all sanctions programs. UK enforcement under the Sanctions and Anti-Money Laundering Act 2018 (administered by OFSI) and EU enforcement under Regulation 2580/2001 plus national criminal-code implementations operate on similar principles. The exposure compounds when an enforcement action also triggers SOX 404 material-weakness disclosure - a sanctions breach that bypassed disbursement controls is, by definition, a controls failure - producing the typical 4-7% share-price erosion in the trading week following the 10-K filing. For a Russell-3000 mid-cap with USD 800M market cap, a 5% impact equals USD 40M of shareholder value destroyed by a payment-release that an automated screening engine plus four-eyes log would have prevented.

The SEPA SCT Inst mandate adds a third deadline-driven exposure. Regulation 2024/886 imposes mandatory receive of SCT Inst from 9 January 2025 and mandatory send from 9 October 2025 on every euro-area Payment Service Provider offering SCT. National competent authorities under Article 5d enforce against non-compliant PSPs with administrative penalties. Corporates that depend on non-compliant banking partners face operational disruption when partner banks lose the ability to send instant payments. The Agent’s deterministic rail selection embeds the SCT Inst default into the payment policy - euro-denominated payments under EUR 100,000 default to SCT Inst from 9 October 2025 onward, with documented fallback only where the receiving bank explicitly does not support Inst (now rare).

The international payment pipeline runs 16 deterministic steps - not 8

Domestic single-rail payment runs can be modelled in 8 steps. International multi-rail payment runs cannot. The Agent splits the pipeline into 16 steps because every payment-line decision requires checking the destination corridor (US versus UK versus EU versus cross-border non-EU), the rail selection across the nine US, UK and EU schemes, the amount-and-urgency thresholds (NACHA Same-Day USD 1M cap, Fedwire over that, RTP USD 10M cap, FedNow USD 10M cap, CHAPS over GBP 1M, SEPA SCT Inst EUR 100,000 cap), the sanctions screening against the OFAC, UK, EU and UN lists with fuzzy transliteration, the AML transaction-monitoring rules under the BSA, UK MLR 2017 and EU AML frameworks, the format validation of IBANs, ABA routing numbers and UK sort codes with Confirmation of Payee where available, the SOX 404 segregation-of-duties between initiator and releaser, the PSD2 Strong Customer Authentication challenge for online release, the WORM-archive retention class (PCAOB AS 1215 at 7 years for issuer audits, FinCEN BSA and OFAC at 5 years, UK MLR 2017 and EU AMLD 2024 at 5 years), and the IFRS 9 Para 3.3.1 versus ASC 405-20 derecognition trigger.

A concrete scenario: a SEC-listed mid-cap with USD 800M revenue, EU operations across Germany, France and the Netherlands alongside the UK, and weekly payment-run cycles with 1,200 supplier payments across USD, GBP and EUR. On a typical run, the Agent identifies 1,200 due open-items, screens them against the OFAC, UK, EU and UN sanctions lists producing 4 fuzzy-match positives for AML-officer review (3 cleared as transliteration false-positives, 1 confirmed and blocked with SAR filing), runs AML transaction monitoring producing 2 structuring-pattern alerts (both cleared), validates 1,200 payee records across IBAN, ABA and sort-code formats with 6 format errors flagged for vendor correction, selects 480 ACH, 18 Fedwire, 2 RTP, 320 BACS, 8 CHAPS, 12 FPS, 320 SEPA SCT Inst, 36 SEPA SCT, and 8 SWIFT MT103 transitioning to PACS.008, generates 9 ISO 20022 PAIN.001 batches alongside the NACHA, BACS Standard 18 and CHAPS messages, runs duplicate-payment detection finding 0 duplicates against 90-day history, verifies liquidity across 4 debtor accounts in 3 currencies, enforces segregation of duties with 2 different releasers per debtor account, captures four-eyes release with PSD2 SCA challenges, transmits via SWIFT FIN, EBICS and SFTP-with-PGP per bank contract, captures bank ACK on all submissions within 30 minutes, and reconciles next-day BAI2, CAMT.053 and MT940 confirmations - 1,196 matched, 4 returned by beneficiary banks and routed to AP for re-issuance.

In the Decision Layer, 14 of the 16 steps are rule-based (R), 0 are LLM-suggestion (A), and 1 is human (H) for four-eyes release approval. The remaining step (sanctions match disposition) routes deterministically to the AML officer for human investigation when a fuzzy-match flag triggers - the Agent never silently clears a sanctions match. Every other step - duplicate detection, format validation, rail selection, liquidity check, SCA challenge, transmission, reconciliation - is a deterministic application of accounting standard, scheme rule, or compliance regulation.

Sanctions and AML clearance is the regulatory linchpin

Big-4 audits and FinCEN and OFAC examinations focus heavily on the sanctions and AML clearance evidence chain. The Agent operates against the union of the OFAC lists (the SDN List, the Sectoral Sanctions Identifications List and the Foreign Sanctions Evaders List), the UK FCO Consolidated Sanctions List, the EU Restrictive Measures List, and the UN Security Council Consolidated List - all updated daily from the source authorities. Fuzzy-matching covers exact name match plus transliteration variants (Cyrillic-to-Latin, Arabic-to-Latin, Chinese pinyin), abbreviation variants, and corporate-structure variants (subsidiary identification through ultimate-beneficial-owner registries where available). False-positives are managed under a documented investigation procedure - the AML officer reviews the match evidence, performs Customer Due Diligence and Enhanced Due Diligence under UK MLR 2017 Reg 28-35 and BSA 31 CFR 1020.220, and clears only with documented rationale. False-negatives are the strict-liability exposure - hence the cross-list union and the daily list pull.

AML transaction monitoring runs against patterns in vendor, amount, corridor, frequency and timing. Structuring (multiple sub-threshold payments to evade BSA CTR USD 10,000 reporting), unusual-volume thresholds versus the 90-day vendor baseline, high-risk corridor flags (FATF grey-list and black-list jurisdictions plus internal corporate risk-rating), and timing-cluster patterns all trigger alerts that route to the AML officer for a SAR or SAR-equivalent decision under BSA 31 CFR 1020.320, UK MLR 2017 Reg 28 and EU AMLD 2024. The Agent’s Decision Log captures every alert with the rule that triggered it and the officer’s disposition - producing the FinCEN-inspection-ready evidence chain that compliance officers spent decades assembling manually.

Cross-rail finality and derecognition timing prevents reconciliation drift

Payment finality varies sharply by rail and matters for both operational recovery and accounting derecognition under IFRS 9 Para 3.3.1, with ASC 405-20 as the US GAAP equivalent. ACH supports returns up to 60 days for consumer R10 unauthorised-debit and up to 2 banking days for most return reasons. Fedwire is final and irrevocable on confirmation. RTP and FedNow are final and irrevocable on confirmation per The Clearing House and Federal Reserve scheme rules. SEPA SCT supports R-transactions for up to 5 business days. SEPA SCT Inst is final and irrevocable on confirmation. CHAPS is final on confirmation. BACS supports recall under limited conditions for up to 2 working days. The Agent records expected-finality at release time and posts derecognition only on confirmed payment under IFRS 9 (and ASC 405-20 in US GAAP) - never on file initiation. Returns within the same accounting period reverse cleanly. Returns crossing period-end flag for IAS 8 or ASC 250 evaluation by the Journal Entry Agent for prior-period error-correction analysis.

Integration ecosystem: SAP S/4HANA F110, Oracle Fusion Payments, Workday Settle Payment, plus payment-factory platforms

The Agent integrates natively with the major international ERPs: SAP S/4HANA brings the F110 Automatic Payment Run together with Bank Communication Management and Multi-Bank Connectivity (MBC); Oracle Fusion Cloud Financials combines Payments, Cash Management and iPayment for ISO 20022 message generation; Workday Financial Management pairs the Settle Payment business process with Bank Account integration and secondary-ledger postings; Microsoft Dynamics 365 Finance uses the Vendor payment journal with Electronic reporting (ER) for ISO 20022 PAIN.001; Oracle NetSuite runs SuitePayments across the Vendor Bills and Bill Payment workflows; and Sage Intacct AP Payment Services covers US ACH and check with multi-entity disbursement. For payment-factory architecture, Kyriba treasury management combines a bank-connectivity hub with sanctions screening and a payment workflow; FIS Quantum, GTreasury and ION Treasury cover corporate treasury; and Bottomline PTX (Payments Transaction Exchange) adds integrated Cyber-Crime detection. Bank connectivity per relevant rails runs through SWIFT FIN with the MX migration via SWIFT direct connectivity or a Service Bureau (Bottomline, Broadridge, AccessPay), Federal Reserve FedLine for Fedwire and FedNow, a NACHA-certified ODFI for ACH, a BACS-approved Service User for the UK, EBICS with T-version and H006 keys for German and EU corporate banking, or a bank-direct API (US Open Banking through FDX, EU and UK Open Banking through PSD2 XS2A). Audit-evidence integration covers Deloitte ASM, PwC Halo, EY Helix and KPMG Clara via standardised payment-run export formats with PCAOB AS 1215-compliant metadata. WORM-archive integration covers Amazon S3 Object Lock, Azure Blob Immutable Storage and Google Cloud Storage Bucket Lock with retention-class tagging per PCAOB AS 1215 (7 years for issuer audits), SEC Rule 17a-4 (6 years for broker-dealers), FinCEN BSA and OFAC (5 years), and UK MLR 2017 and EU AMLD 2024 (5 years) - all generated as deterministic templates with audit-trail metadata for SOX 404 evidence packs and PCAOB substantive testing.