November 4, 2026

Monitoring Zelle, RTP and FedNow: Rules for Instant Payments

Axle Team

Key takeaways

FedNow AML monitoring starts with limits: FedNow and RTP now both allow single payments up to $10 million, so your risk appetite should live in participant-level limits by customer segment, not in the network cap.
Instant rails split monitoring into two clocks: a pre-send decision measured in seconds, and a post-send investigation that still runs on the normal SAR timeline.
The highest-yield instant-payment scenarios are first-time payee, velocity against the customer's own history, and pass-through on inbound credits to new accounts.
Request for payment is a monitoring obligation for the sending institution under FedNow's operating procedures, not just a product feature.
For inbound instant credits, sort alerts by how much of the money is still in the account, not by model score.

What FedNow AML monitoring has to do differently

FedNow AML monitoring has to work in two places. Before the payment leaves, it applies segment-based limits, payee checks and fraud holds within seconds. After settlement, it runs ordinary transaction monitoring with faster triage, because funds on an instant rail can leave the receiving account within minutes. The SAR clock does not change.

Most teams already have the second piece. They have batch scenarios that see FedNow, RTP and Zelle activity a day later as another transaction type. The gap is the first piece, and the handoff between the two.

The US instant rails at a glance

FedNow — Network limit: $10 million per customer credit transfer since Nov 12, 2025; participant default $100,000. Controls the operator gives you: Participant transaction limits, account activity thresholds (value and velocity by segment), negative list, fraud reporting. Monitoring note: Request for payment carries a sender-side monitoring expectation.
RTP (The Clearing House) — Network limit: $10 million since Feb 9, 2025. Controls the operator gives you: Participant-set limits. Monitoring note: Same scenario design as FedNow; screen both directions.
Zelle — Network limit: Set at the institution level. Controls the operator gives you: Network and bank-level controls. Monitoring note: Consumer P2P: scam and mule exposure dominates.

The jump in limits is the first thing to take to your risk committee. FedNow went from $500,000 to $1 million in June 2025 and to $10 million in November 2025. The Reserve Banks paired that with a tool built for segmenting risk.

"Federal Reserve Financial Services today activated a new account activity threshold feature for the FedNow Service, allowing financial institutions to strengthen risk mitigation efforts by defining dollar value and transaction velocity thresholds based on customer segments."
— Federal Reserve Financial Services, June 24, 2025, frbservices.org

According to the FedNow operating procedures, the customer credit transfer limit defaults to $100,000 and participants can raise it to the network maximum. If your institution has raised it, the board-approved risk appetite should say which segments get what, and why.

Pre-send vs post-send controls

Pre-send controls stop the payment. Post-send controls find the pattern. You need both, and they should not be owned by the same queue.

Pre-send (seconds, outbound):

Segment limits: lower caps for new individual accounts, higher for established commercial customers. FedNow's threshold tool supports exactly this split.
First-time payee holds or step-up authentication on payments above a segment threshold.
Velocity checks against the customer's own 30- or 90-day pattern, not a peer group.
Sanctions screening on cross-border-touching payments. OFAC's guidance leaves the decision to your own risk assessment (more in our post on real-time payments screening).

Post-send (minutes to days, both directions):

Pass-through: inbound instant credits followed by outbound transfers of a similar amount within hours.
Fan-in: many unrelated senders paying one new account, a common mule pattern.
Request-for-payment volume by customer.
Payee concentration: one customer becoming the payee for many unrelated victims.

"OFAC recognizes that a key feature of instant payment systems is the near real-time nature of transaction settlement, but the speed necessitated by this commercial feature should not discourage financial institutions from implementing risk-based sanctions compliance controls."
— OFAC, Sanctions Compliance Guidance for Instant Payment Systems (Sept 2022), ofac.treasury.gov

Request for payment is a sender-side obligation

FedNow's request for payment lets a participant or its customer ask another party to pay. It is the feature fraudsters use when they want the victim to push money with a single tap. The FedNow operating procedures put the monitoring duty on the institution sending the RFP. They say sender FIs "are expected to monitor use of RFP to identify abuses," and that at minimum monitoring must include "risk-based procedures to track the volume of RFPs sent by customers to identify potential anomalous activity."

In practice that is a scenario most rule libraries do not have. Build a simple one: RFP count per customer per day against their own baseline, with a separate threshold for accounts under 90 days old.

The irreversible-rail scenarios that earn their keep

Three scenarios produce most of the useful alerts on instant rails. Tune them on your own data before adding more (our guide to risk-based monitoring thresholds covers the method).

First-time payee above a segment threshold. Scam payments often go to a payee the customer has never paid before. Combine payee age with amount and customer tenure.
Velocity break against self. A retail customer who has never sent more than a few hundred dollars over instant rails sends five transfers in an hour.
Mule inflow and pass-through. New account, several inbound instant credits from unrelated senders, outbound within hours, balance back near zero.

FinCEN's elder exploitation analysis describes why speed matters on the inbound side.

"These payment methods provide for instantaneous transfers that allow the recipient to access the funds immediately after executing the transfer."
— FinCEN Financial Trend Analysis, Elder Financial Exploitation, fincen.gov

What "real-time" means for alert SLAs

Real-time monitoring does not mean a real-time SAR. Under 31 CFR 1020.320, a bank files no later than 30 calendar days after initial detection, and the FFIEC manual says initial detection "should not be interpreted as meaning the moment a transaction is highlighted for review." The same section recommends "an expeditious review of the transaction or the account" whenever possible.

So set two SLAs. The pre-send decision is measured in seconds and owned by fraud operations or an automated decision. The post-send alert gets a same-day triage target for instant-rail inbound scenarios, then the normal investigation timeline.

My strongest recommendation, from watching mule queues: sort inbound instant-payment alerts by the balance still sitting in the account, not by score. An alert on an account that has already emptied out is a SAR and closure question you can work tomorrow. An alert on an account still holding most of the inbound credits is a chance to restrict funds and contact the sending bank today. A score-ordered queue cannot tell those two apart, and on an instant rail that difference is measured in hours.

That ordering is easy to automate. It is the kind of first-pass triage Axle's transaction monitoring alert agents are built to handle: pull current balance, outbound activity since the credit and counterparty history, then route the case.

FAQ

What is the FedNow transaction limit?

The FedNow network limit for customer credit transfers has been $10 million since November 12, 2025. The participant default is $100,000 under the operating procedures, and each participant can set lower limits by customer segment.

Do instant payments change the SAR filing deadline?

No. The 30-day clock (60 if no suspect is identified) runs from initial detection after review, not from when the payment settled. Ongoing schemes still call for immediate law enforcement notification.

Should banks screen every domestic FedNow payment against OFAC lists?

OFAC's 2022 guidance says the decision should rest on the institution's own risk assessment and that purely domestic instant payments generally pose lower sanctions risk. Document the decision either way.

Put instant-rail alerts on an agent that works in minutes

Rose, Axle's transaction monitoring agent, investigates alerts with the account's live balance, counterparties and history so your team decides on the cases that still have money to protect. Meet Rose.

See how Axle's agents work

Axle's AI agents investigate compliance alerts and document every decision for your analysts to review.

See Axle in action

The Alert Queue

Get the next issue in your inbox

Every other Tuesday, one short read for compliance and risk teams.

Every other Tuesday. No pitches. Unsubscribe anytime.

Monitoring Zelle, RTP and FedNow: Rules for Instant Payments

See how Axle's agents work

Get the next issue in your inbox

More from the blog