AI governance: Applying existing rules
AI-enabled fraud is testing response capability. Members need clear ownership, monitoring and oversight of AI controls, alongside practical guidance.
41% of Pulse respondents said AI governance lacked practical implementation guidance.
AI-enabled fraud is a leading concern. Across two FC360 session polls, 56% of responses selected it as the risk increasing fastest relative to organisational response capability. Separately, the Pulse Survey identified demand for more practical guidance on implementing AI governance.
Existing rules already apply to firms’ use of AI. Members should document ownership, approvals, monitoring and escalation for AI used in fraud and AML controls. The policy question is where further practical examples would help firms apply those responsibilities consistently.
The challenge for leaders is to strengthen protection against AI-enabled fraud while governing AI used within their own defences. These are connected responsibilities: adopting more sophisticated tools also requires clear ownership, testing and evidence that controls work in practice.
For each AI use in fraud and AML, members should be able to explain its purpose, who approves its deployment, how performance is monitored and when staff must intervene. Reviews should consider missed fraud, false positives and customer impact, alongside detection rates. Chris Ainsley’s assessment highlights the opportunity: stronger tools can support prevention, but leaders need evidence of the difference they make.
"I’ve always been optimistic. We have more sophisticated tools and preventative capabilities than ever before. People working in fraud prevention see the difference their interventions make."
Chris Aisley, Head of Fraud Prevention, Santander.
"Verification can no longer be a single event at onboarding. Synthetic identities, deepfaked selfies and AI-generated documents mean a point-in-time check is easier to defeat than it used to be."
Azy Shojaeian Group Chief Compliance and Risk Officer and MLRO, Pockit and Monese.
Key statistic
Respondents who feel outpaced more often plan AI investment
Among Pulse respondents who reported experiencing AI-enabled fraud in the previous 12 months, 76% said it was increasing faster than their organisation could respond.
In a separate comparison, respondents who felt outpaced more often selected AI fraud prevention as one of their likely investments more often than other respondents.
These associations do not establish what caused investment plans or whether spending will produce stronger controls.
Among FC360 registration respondents, 44% selected AI and machine learning as the biggest opportunity in financial crime prevention. Leaders should turn that potential into measurable improvements in detection, prevention and customer outcomes.
of Pulse respondents who felt outpaced by AI-enabled fraud selected AI fraud prevention among their likely investments for the next 12 months.
Source: The Payments Association Pulse Survey, 2026.
Demand for practical implementation guidance
In the Pulse Survey, 41% said AI governance lacked practical implementation guidance across the industry. Among that group, 51% selected internal AI governance among their likely investments for the next 12 months, compared with 29% of other respondents. This association does not establish that a lack of guidance caused the investment intention.
In the joint Bank of England and FCA 2026 AI survey, 94% of respondents reported firm-wide AI policies, principles or standards. This describes reported governance arrangements among participating firms; it does not establish the effectiveness of fraud and AML controls.
The FCA’s October 2026 good-practice examples cover governance, accountability and oversight across AI uses. They do not create new requirements. Members should apply relevant existing obligations and use the examples to review their controls.
CP26/38 separately consults on updates to the Financial Crime Guide, with responses due by 24 December 2026. The Pulse Survey records perceived gaps in practical guidance; it does not directly measure how governance approaches differ between firms.
Anna Sweeney, head of advisory, fscom
Interview takeaway: AI can increase both the scale of fraud and the capacity to detect it.
Simon Miller, director of policy, strategy and communications, Cifas
Interview takeaway: Adaptive analytics and behavioural intelligence can help firms respond to more scalable, sophisticated attacks.
Erez Nounou, Product Director EMEA, Bottomline
Interview takeaway: Connecting risk signals can improve detection as AI increases the scale of fraud.
In the AI in practice session, 3 of 10 respondents selected legal or regulatory constraints as the biggest barrier to scaling AI, 3 selected skills and talent, and 3 selected explainability or governance. These ten responses are illustrative and do not establish a ranking of barriers across firms.
AI-initiated payment disputes: where members want clarity
The report identifies uncertainty among session participants about disputes involving AI-initiated payments. That uncertainty should be distinguished from the legal position: a poll does not determine who is liable.
Members deploying AI agents should document delegated authority, payment controls, audit trails and dispute handling under current rules. The Association should use worked examples to identify where further clarification is needed, including disputes involving unauthorised activity, execution errors and fraud.
HM Treasury’s July 2026 consultation on modernising payment services regulation considers how the framework should adapt to innovation, including agentic payments. The Association’s request should focus on specific unresolved scenarios rather than suggest a general absence of applicable rules.