The future of payments: Best practices for building next-generation payment systems
Real-time rails, structured data, tokenization, and agentic AI are turning payments from invisible basics into a source of competitive advantage. An article by Özge Tekalp.
For decades, payments were like the pipes in a building: nobody thought about them, nobody chose a bank because of them, and they only got attention when something broke.
They were a cost center, not a selling point. That's changed. Payments infrastructure is now something an institution can actually win customers with.
The four concepts are in the title; let us zoom in step by step:
Real-time rails: payments that settle in seconds, any hour of any day. Pix in Brazil, UPI in India, FAST in Türkiye, FedNow in the U.S..
Structured data: ISO 20022. The message that carries a payment now has labeled fields for what it's for, which invoice it settles, who the parties are. The old format was mostly a free-text blob. Now a machine can read it.
Tokenization: replacing the real card number with a substitute code that only works in one place. If it's stolen, it's useless. Fraud falls and, unexpectedly, approvals rise.
Agentic AI: software that acts for a customer rather than just answering them. It can only act on what it can read, which is why it depends on the two items above.
Real-time rails make speed universal, so speed stops being a differentiator. Structured data and tokenization make each payment legible and safe to reference. Agentic AI is what consumes that legibility. Each one only pays off if the one before it is in place.
According to McKinsey's 2025 Global Payments Report, the industry generates $2.5 trillion in revenue from $2.0 quadrillion in value flows, moving through 3.6 trillion transactions worldwide even as revenue growth slowed to 4 percent in 2024, after averaging 7 percent a year over the previous half-decade. The deceleration is not a sign of saturation. Nearly half of 2024 revenue came from interest income, earned while central-bank rates sat at or near multidecade highs; McKinsey expects that stream to grow only about 2 percent a year through 2029. What the rate cushion had covered is a core business under price pressure, as volume migrates toward lower-cost rails. The industry is moving more money than ever, earning less on each movement and the next phase of growth will belong to institutions that compete on infrastructure quality rather than transaction volume alone.
That pressure is no longer only a market dynamic; it is increasingly a legal one. In June 2026, a federal judge granted preliminary approval to the long-running interchange settlement between Visa, Mastercard and roughly twelve million U.S. merchants, cutting credit interchange by 0.1 percentage point for five years and capping standard consumer card rates at 1.25 percent for eight. In the euro area, the EU's Instant Payments Regulation has required banks to send instant euro transfers since October 2025 and forbids charging more for an instant transfer than a standard one. Two of the industry's principal pricing mechanisms are now under external constraint which is precisely why the competitive question is shifting from what institutions charge for moving money to what they can offer alongside it.
The real-time standard
Instant payments have arrived unevenly.
India's UPI processed 228.3 billion transactions in 2025 and accounted for 84.8% of India's retail digital payments by volume in the first half of the year. Brazil's Pix handled 79.8 billion transactions worth R$35.36 trillion, up 33.6% in value, and carried 54.7% of all retail payment transactions in the country in the second half of 2025.
The United States is at a different stage: FedNow grew volume 460% in 2025 to $853.4 billion in value, but averaged roughly 30,000 payments a day at an average of $101,435 each. Europe has legislated rather than waited, requiring euro-area banks to receive instant transfers from January 2025 and send them from October 2025 — though the ECB reports that business-to-business uptake remains limited. For banks and insurers, the pattern points one way. Access to the rails is becoming universal and therefore confers no advantage. What differentiates is what runs on top: payouts, collections, refunds, claims settlement.
In Brazil, the central bank's Pix system, launched in 2020, has become the reference case that regulators and institutions worldwide now study directly. Banco Central do Brasil's full-year figures show Pix processing 79.8 billion transactions in 2025, moving R$35.36 trillion which is around USD 6.7 trillion a 33.6 percent increase in value over the previous year, with monthly volume approaching eight billion transactions by December. By late 2025, more than 175 million individuals were using Pix around 93 percent of Brazil's adult population along with more than 15 million businesses.
What makes Pix a genuine best-practice case is its design discipline: a single, centrally governed, zero-cost rail that both banks and fintechs must connect to under the same rules. It is a model increasingly referenced by regulators in Europe and Asia as they design their own instant-payment mandates.
The Office of the U.S. Trade Representative opened a formal investigation into Pix in September 2025, a reminder that control of a domestic rail has become a matter of trade policy as much as payments policy.
India's UPI offers a model which built on interoperability among hundreds of competing banks and apps rather than a single dominant operator. According to NPCI data, UPI's annual volume reached 241.6 billion transactions in the 2025–26 fiscal year, up 30 percent year over year, with value rising to roughly ₹314 lakh crore (about US$3.6 trillion). The platform now accounts for 81 to 85 percent of India's retail digital payment volume and, by IMF and ACI estimates, represents close to half of all real-time payment volume worldwide. The lesson for institutions is not to replicate India's specific technology, but to absorb its underlying principle: open, standardized rails that any licensed participant can plug into tend to outcompete closed, single-vendor systems over the long run in adoption speed and in resilience.
Data as infrastructure
Behind the visible shift to instant payments sits a quieter one: the move to ISO 20022, a common language for payment messages. The older Swift formats carried limited information in free text. ISO 20022 carries far more, in labeled fields a computer can read what the payment is for, which invoice it settles, who exactly is sending and receiving it.
That migration passed a milestone on November 22, 2025, when the coexistence period ended and Swift's legacy payment instruction and cash reporting messages were replaced by their ISO 20022 equivalents. In the United States, the Federal Reserve had already moved Fedwire across on July 14, 2025. Swift reports almost 200 market infrastructure initiatives either implementing the standard or considering it.
The work is not finished. Message categories outside the cross-border payments scope remain in use, and a second deadline falls on 14 November 2026. From that date, cross-border payment messages containing a fully unstructured postal address will be rejected, with no fallback available. Addresses must be structured or hybrid, and they must be captured correctly when the customer record is first created, which makes this an onboarding and data-quality problem before it is a payments problem.
The temptation is to treat all this as a formatting exercise to be completed before a deadline. That would be a mistake. Structured fields are what allow reconciliation, sanctions screening and exception handling to run automatically instead of being checked by hand. An institution that simply translates old formats into new ones will have paid the full cost of the migration and collected none of the return.
Card tokenization raises the same question in a different setting: what is the institution holding, and is it an asset or a liability?
A network token replaces the card number with a substitute credential issued by the card network. It is tied to one merchant, carries a one-time code with each transaction, and refreshes automatically when the customer's card is reissued. So, a stolen token is far less useful to a criminal than a stolen card number, and a legitimate payment is less likely to fail because the card on file has expired.
Both Visa and Mastercard networks publish evidence that this improves fraud and approval outcomes at once. Visa reports roughly 30 percent less fraud on tokenized online transactions than on those using raw card numbers, though that measurement comes from its fiscal 2022 data and covers high-volume merchants specifically.
On approvals, Visa's published figures range from 3% to 6% depending on the measure and channel. Mastercard cites 3% to 6%age points of additional approvals and around $2 billion a month in recovered sales, drawing on more recent data.
One distinction matters operationally. Storing card numbers in a processor's vault removes them from your systems but changes nothing at the moment of authorization, because the raw number is still what reaches the issuer. Only a network token produces the approval lift. Tokenization is not free either: provisioning fees of a few cents per token can cancel the gain on low-value baskets, and tokens are bound to a specific requestor in ways that create switching costs if a processor resists portability.
The direction of travel is set regardless. Mastercard has committed to phasing out manual card entry for European e-commerce by 2030, which turns a commercial argument into a planning assumption.
What Türkiye has already built
Türkiye offers its own instructive case study in what disciplined, centrally coordinated infrastructure can achieve in a short window. The FAST system, launched in January 2021 under the direct authority of the Central Bank of the Republic of Türkiye, operates around the clock, with the Interbank Card Center (BKM) building value-added overlay services — QR payments, Request to Pay on top of the core rail, according to infrastructure analysis published by Lightspark.
According to a World Bank case study, the Retail Payment System (RPS) executes roughly 4 million transactions a day at an average processing time of 30 seconds, across 54 participating banks. On the card side, Zunapro's 2026 market analysis reports that Türkiye has more than 110 million active cards in circulation, annual e-commerce volume above 3.5 trillion lira, and a security architecture that has kept pace with global standards: the shift to modern, risk-based 3D Secure authentication is now complete across major issuers, with roughly 85 percent of approved transactions flowing through frictionless checks and aggregate authentication success rates above 94 percent in 2026 up from around 85 percent in the earlier OTP-based era. For a market so often defined by macroeconomic volatility, this is a quiet but important counter-narrative: the payments rail itself has become one of the more stable, well-governed parts of the Turkish financial system.
Intelligence as infrastructure
Layered on top of all of this is the most consequential shift of all: how institutions are putting artificial intelligence to work. Nasdaq Verafin’s 2026 Global Financial Crime Report found that 89 percent of financial institutions are now using or evaluating AI-based anti-financial crime solutions, with card networks and processors scoring transactions in real time to approve, decline, or step up authentication automatically. The next wave goes considerably further.
McKinsey reports that early agentic-AI deployments are reducing manual workloads by 30 to 50 percent, and its Global Banking Annual Review 2025 counted more than 160 agentic use cases announced across fifty of the world’s largest banks in 2025 alone. Investment is concentrating fastest where the pressure is greatest. Verafin puts 2025 fraud losses at $517.4 billion, up 8.2 percent, within an estimated $4.4 trillion of total illicit financial activity; 90 percent of the financial crime professionals it surveyed reported more AI-driven attacks over the past two years, three-quarters expect to expand their own use of AI in detection, and the largest banks plan to increase AI investment by around 20 percent in the coming year. The strain behind those numbers is real: in Verafin’s European survey, only 22 percent of respondents said they had adequate resources, people or technology, to combat financial crime.
The distinction that actually matters here is a simple one. Intelligence deployed as a defensive patch produces marginal gains. Intelligence deployed as core infrastructure reasoning across systems, prioritizing genuine risk, and freeing human specialists for the judgment calls machines still cannot make produces compounding ones.
It is worth pausing on what that kind of infrastructure looks like in practice, because the phrase gets used more often than it gets explained. Eren Erdoğan, founder and CEO of Wagmi Tech, an Istanbul-based software company, describes a three-layer architectural shift he sees unfolding across the institutions his firm works with: “Agentic AI marks a turning point here. Not an isolated chatbot, but an autonomous layer that speaks to every back-end system and acts proactively. We see this transformation in three steps:
MCP Server: a common language. An institution's portfolio, market data, KYC, and banking APIs all speak different languages. The MCP Server layer translates these APIs into a unified format that AI can reach through natural language. Jointly supported by both Claude and OpenAI, this standard lets the back end speak one language, the precondition for a truly seamless customer relationship.
Agent: an advisor that talks. This is where the agents built on top of the MCP Server come into play. The client asks in plain language, and the agent, connected to the MCP Server, synthesizes portfolio, risk profile, and market into a clear, personalized answer. It doesn't replace the human advisor; it makes that advisor scalable.
Orchestration: a coordinated system. This is the layer that turns the whole structure autonomous, so the agents that were built can be managed and work together. Risk profiling, recommendation, and reporting agents coordinate under a conductor, and the client experiences one intuitive interaction.
We've tested this architecture in the field. We built Türkiye's first Payment MCP Server and a WhatsApp-based Collection Assistant. Since collection in Türkiye runs largely over WhatsApp, we delivered the service right there. The point is no longer offering better interfaces to bank and payment-system customers; the era of offering agents that actually carry out the service has begun. What we're discussing next is this: to manage customer onboarding and KYC flows faster and more easily, agentic-AI flows are gaining importance both in customer interaction and in internal operations. Within mobile apps, the conversation is no longer just about user-friendly interfaces but about the agents to be offered to the customer, so that requests like portfolio queries, report queries, campaign communications, and personalized recommendations are handled directly through an agent.”
Erdoğan's framework maps cleanly onto what global institutions are spending billions to achieve, and it underlines something worth stating plainly: this architectural shift is not the exclusive domain of tier-one global banks. The institutions leading the transformation in their own markets, at their own scale, are building the same foundations, a unified back-end language, agent layers that make advisors scalable, and orchestration that turns complexity into a single, intuitive client experience.
The common thread
The principles to take away are:
Build the rail before you build the feature. Real-time infrastructure is fast becoming a baseline expectation rather than a premium tier.
Treat structured data as a strategic asset rather than a compliance burden. The ISO 20022 migration is an opportunity, not merely a deadline.
Tokenize card credentials wherever card data touches your systems. The fraud reduction and authorization uplift that Visa and Mastercard both document make it one of the few payments upgrades with no real trade-off.
Deploy AI where it changes outcomes, not where it merely changes appearances. Embed it into core transaction and compliance flows.
Build the translation layer first. Whether the goal is agentic fraud detection, personalized service, or autonomous compliance monitoring, none of it works without first giving an institution's disparate systems a common language to speak.
The institutions that internalize these principles will not simply process payments faster. They will use the payment layer itself as a genuine source of competitive differentiation. That is the real shift underway. Payments are no longer the quiet last step of a transaction. Increasingly, they are the place where trust is either earned or lost.
Digital Reinvention community
With Qorus memberships, you gain access to exclusive innovation best practices and tailored matchmaking opportunities with executives who share your challenges.