Every major GCC market now has an instant payment system running around the clock: SARIE instant payments in Saudi Arabia, Aani in the UAE, Fawran in Qatar and Fawri+ in Bahrain. They are no longer new infrastructure. For payment firms, the question is whether their connectivity, compliance and fraud controls fit the way each system works.

The GCC systems

  • SARIE instant payments (Saudi Arabia): run by Saudi Payments, a SAMA subsidiary, since 2021, alongside SAMA's SARIE high-value system. Supports transfers by mobile number and is the rail behind open banking payment initiation in the Kingdom.
  • Aani (UAE): run by Al Etihad Payments, a CBUAE subsidiary, since October 2023. Payments can be addressed by mobile number instead of IBAN, and the CBUAE sees Aani as the settlement layer for open finance payments.
  • Fawran (Qatar): run by Qatar Central Bank since early 2024. It supports transfers by mobile number or alias and, since October 2024, online purchases through the QPay national e-commerce gateway.
  • Fawri+ (Bahrain): run by BENEFIT since 2015, making it the region's longest-running instant retail payment service, and used for open banking payments under the CBB framework.

Direct participation is generally limited to banks; licensed payment institutions and exchange houses usually connect through a sponsoring bank or a tiered access model set by the central bank. The sponsor agreement should define prefunding, liability and what happens when prefunding runs out.

The irrevocability problem

Once an instant payment settles, it cannot be recalled through normal banking channels. With a SWIFT payment a recall can be sent and funds held while a case is investigated; an instant payment credits the beneficiary in seconds. That is what makes these systems useful, but it changes the fraud and AML model. Controls that work after the payment on older rails, such as holding funds or recalling them, are not available. The only effective point of control is before the payment is authorised.

The fraud type that grows fastest with instant payments is authorised push payment (APP) fraud, where the victim is persuaded to make the payment themselves. Nothing fails technically, so the payment looks legitimate at every check. The UK's reimbursement rules show what follows: firms carry direct losses and invest heavily in behavioural scoring and payee checks. Mobile-number addressing makes payments easier but also makes it simpler for a fraudster to receive funds.

Fraud controls that work on irrevocable rails

  • Pre-payment behavioural scoring: models that score each instruction in real time using device and session data, the payer's history, the beneficiary's history and the value and timing of the payment. Overnight batch models are not enough.
  • Payee name checks: showing the payer the name on the receiving account before they confirm. A mismatch breaks many impersonation scams.
  • Mule account detection: watching for new accounts that receive many transfers from unrelated senders in a short time, so that receiving firms can act quickly.
  • Friction for new payees: a short delay or extra confirmation for a first payment to a new beneficiary, which breaks the sense of urgency that scams depend on.
  • Real-time sanctions screening: screening before the instruction is sent, not in an overnight batch after settlement.

Liquidity management around the clock

Instant systems run 24 hours a day, every day. End-of-day settlement, overnight funding and intraday credit from a clearing bank were not designed for that. Participants need intraday forecasts by time window, automatic top-ups when settlement balances fall below set levels, contingency credit lines that can be drawn within minutes, and reconciliation that runs continuously against the system's settlement data rather than once a day.

What payment firms should do now

  • Confirm that sanctions screening runs before the payment, not after settlement, for every instant payment flow.
  • Test fraud model performance on instant payments separately; good overall results can hide weak performance on this channel.
  • Check liquidity processes for nights, weekends and public holidays.
  • Review any sponsor bank agreement for prefunding and settlement risk terms.
  • Plan for payee name checks and stronger controls on new payees, which regulators in the region are likely to expect.