How to enable instant payments (Part II: The program)

Date: Sep 16, 2024

Co-authored by Arpita McGrath (Sporttrade) and Eric Morse (Push Cash)

There are two critical components to delivering instant payments, one is utilizing an instant payment processor and the other is having a program in place to make real-time transaction decisions. In our last post, we discussed how to choose a instant payment processor. This blog post will focus on the second component, building the program needed to safely enable instant withdrawals. We recommend that you work closely with your risk and compliance teams to develop the program that’s right for your business.

Situation

It used to be acceptable to place every withdrawal request into transaction review before releasing the funds. This was considered “normal” because 1) it was the industry standard for a 3–5 day hold on funds and 2) ACH transactions would be processed daily (so it was at least 1 day wait).

Complication

Flash forward to 2024, and operators now have access to real-time payment networks for withdrawals like Visa Direct, MasterCard Send, and the “Real-Time-Payment” network. As more operators offer instant withdrawals, players are increasingly expecting immediate access to their funds. Instant withdrawals are moving from “nice to have” to “need to have.” Fortunately, there are a few great payment service providers (like Push!) which provide instant withdrawals.

The reality is that most withdrawal requests are from trustworthy players. However, when operators turn on instant withdrawals without the appropriate checks and controls, fraudsters can run away with a lot of dollars very quickly.

Resolution:

To safely deliver real time payments via the new transaction networks, operators need to ensure that they have the appropriate program in place to make risk-based transaction monitoring decisions.

Every operator will have a different risk appetite; their ability to manage risk hinges upon the maturity and sophistication of their transaction monitoring program. Operators first enabling instant withdrawals may take a very conservative approach in terms of choosing which transactions (or even patrons!) to permit for instant withdrawals. Operators may initially be highly conservative across the following metrics, then begin to open the door to larger transactions from a larger set of user profiles as they build confidence in their program.

• Transaction size: Lower transaction sizes inherently present less overall risk, as there is less money to be lost if the model incorrectly identifies transaction risk
• Account Age: If the account is known, and has been active (without any fraud) for a period of time, the likelihood of the user’s behavior switching to fraudulent activity goes down. One item to be wary of is account takeover, for this reason operators should closely monitor account activity as well as other factors such as failed login attempts, new bank account linked, etc.
• Previous Account Activity: As you get to know the user, you will begin to identify behavioral patterns from deposit, withdrawal, and play through activity. You may be more cautious of users with a smaller number of actions on your platform OR a behavior pattern that has recently changed (i.e. inactivity for the previous 6 months, followed by multiple deposits and withdrawals in a short period of time).

In order to safely turn on instant withdrawals and manage risk, you need to have high confidence in your “Know Your Customer (KYC)” and “Customer Due Diligence (CDD)” programs as well as real-time transaction monitoring to flag risky transactions.

• KYC/CDD: In order to feel that you truly “know your customer,” you must screen users at onboarding and on an on-going basis against the OFAC and sanctions watchlists. You will also want to be able to identify Politically Exposed Persons (PEPs) in order to conduct enhanced due diligence (as per your policy for higher risk customers). There are many vendors out there that offer these services; some charge a 1x fee per screening while others will charge monthly or annual fees for on-going monitoring. When choosing a vendor, you should think through what the life cycle of your customer looks like (is your user base more “one and done” or do you tend to have repeat users).
• Real-time transaction decisioning: You should develop a model to monitor user activity on your platform as well as deposit / withdrawal behavior across all linked bank accounts (i.e. deposit through one account, withdraw through another). Based upon your transaction monitoring ruleset, you should be able to green light some instant withdrawals and to put others under manual review. There are transaction monitoring vendors with off the shelf rulesets or you can develop the rules and tools internally.

Each operator will need to implement a rule set that is right for their business. Operators just getting started with instant withdrawals may want to use a vendor’s off the shelf rule set which typically draw in the following data points:

• Deposit / withdrawal ratios to a given account
• Usage of multiple bank accounts or payment methods
• Velocity: Number of deposits and withdrawals in a set period of time:
• Failed login attempts
• Multiple accounts using same device IDs
• Multiple device IDs used by the same account

Conclusion

In closing, picking an instant payment processor is only part of the journey. Good instant payment processors may support one of the real-time payment networks and a subset of users. Great payment processors, like Push Cash, will utilize all available instant payment networks and support all users.

Putting the tools and processes in place is critical to safely enabling instant payments. If you are interested in chatting more about enabling real-time payments, we’d love to chat!