# Payments Risk Assessment

> Drafts a payments risk assessment for a fintech, money transmitter, BaaS platform, neobank, wallet, or sponsor-bank program: a matrix-shaped artifact denominated by rail (ACH, Same Day ACH, wire, card debit / credit, FedNow, RTP, P2P, check, cross-border correspondent, virtual-currency on-ramp), by customer segment (consumer, SMB, payroll-on-demand, gig, BNPL, cross-border remittance, high-risk vertical), and by US-state and corridor geography. Carries fraud, BSA / AML, sanctions, operational resilience, third-party / sponsor-bank dependence, customer-harm / UDAAP, and reporting-control views, with concentration sub-tables for sponsor-bank, processor, and BIN-sponsor exposure. Output suits a sponsor-bank annual review, a state MTL exam preparation file, an internal audit kickoff, or an enterprise risk committee read-out. Best for: - A program operator, sponsor-bank program-management team, or money transmitter is running its annual or semi-annual payments risk assessment and second-line is owning the artifact

- Skill: `anotb/payments-risk-assessment` (Agent Skill, multi-file: 11 files)
- Install (CLI): `npx skillmds@latest add anotb/payments-risk-assessment`
- Raw SKILL.md: https://api.skillmd.com/api/skills/anotb/payments-risk-assessment/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: anotb (https://skillmd.com/u/anotb)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/anotb/payments-risk-assessment

---


# Payments risk assessment

A payments risk assessment is the artifact a sponsor-bank reviewer, a state-MTL examiner, an internal auditor, or a risk committee expects to see at the start of an annual cycle, a program review, or a delta-risk review when a rail, segment, or corridor changes. The work is to denominate the program in rails, customer segments, and geographies, then read fraud, BSA / AML, sanctions, operational resilience, sponsor-bank / processor / BIN-sponsor dependence, customer-harm / UDAAP, and reporting controls against each cell. The shape is a matrix, not a narrative. The skill stops at draft; the second-line lead, the BSA officer, the head of payments compliance, or the sponsor-bank operating committee owns sign-off.

This skill produces the assessment as a markdown artifact (`templates/default-output.md` shape) and a structured record (`schemas/payments-risk-assessment.schema.json`) that downstream skills consume. The matrix is rail-by-rail, segment-by-segment, and geography-by-geography; the cross-cutting risks (fraud, AML / sanctions, op resilience, UDAAP, reporting, cyber) layer on top with pointers to the deep-dive skills that own the detail. Concentration is three sub-tables, not one line.

## Ask first

Before drafting, get plain answers. Most engagements answer them in the first conversation; default and flag where they do not.

- **What is the program operator role.** Fintech program operator, BaaS platform, program manager, wallet operator, neobank, payments processor, money-transmitter-only, BNPL provider, payroll-on-demand provider, cross-border remittance provider, virtual-currency on-ramp / off-ramp. The role drives which sponsor-bank construct, which money-transmitter analysis, and which CFPB applicability questions belong in the matrix. Do not assert MSB-vs-not categorically; the FinCEN administrative-ruling library is configuration-specific.
- **Which rails, segments, and geographies are in scope.** Rails: ACH, Same Day ACH, wire (Fedwire / CHIPS), card debit, card credit, FedNow, RTP, P2P (Zelle, Venmo, Cash App-style), check, cross-border correspondent, virtual-currency on-ramp. Segments: consumer, SMB, payroll-on-demand, gig-economy disbursement, BNPL borrower / merchant, cross-border remittance sender / receiver, high-risk vertical (gambling, adult, MSB-customer, cannabis-adjacent). Geographies: US states (each carries its own MTL / NMLS posture), corridor countries, sanctioned-jurisdiction proximity. The scope sets the matrix; missing rails or segments mean missing risk.
- **What triggered the assessment.** Annual or semi-annual cycle, sponsor-bank annual review, state-MTL exam letter, processor or BIN-sponsor change, sponsor-bank change or wind-down, new rail or corridor going live, post-incident reset, larger-participant-rule applicability check. The trigger sets the audience and the depth.
- **Who is the audience.** Sponsor-bank operating committee, sponsor-bank TPRM team, state-MTL examiner via NMLS, CFPB EXAMS team where the larger-participant rule designates the firm, internal audit, board risk committee, ERC. The audience drives length and tone, not content; the matrix stays the matrix.
- **What is the source posture.** Public-only (the firm has not been engaged yet), public-plus-firm-policy, public-plus-firm-policy-plus-system-of-record-evidence, connector-aware (live ledger, processor-portal, NMLS, sponsor-bank reporting feeds). Posture sets the evidence ask. Aspirational posture is not a posture.

When `scope` is supplied, the skill consumes it (`institution.type`, `institution.primary_regulators`, `sector_overlay_set`, `cross_cutting_overlay_set`, `persona.role`, `source_posture`). When it is not supplied, ask the questions and default to public posture if the practitioner declines. Note in the artifact that scope was not formalised.

## How the matrix gets built

The assessment has the same spine across program-operator types. A senior reviewer fills it in roughly in the order the program is structured, not in lockstep.

The frame opens with the **program summary**: program-operator role, sponsor banks (each one named by role, not by brand), processors front-end / back-end / gateway, BIN sponsors per network, ledger provider, KYC / CIP vendor, fraud-decision vendor, sanctions-screening vendor, geographic footprint by US state and corridor, customer base size by segment, current-cycle volume and value by rail. The summary is one page. Detail goes into the matrix rows.

The **risk universe by rail** is the first matrix. One row per rail in scope. Columns: inherent risk; the top three rail-specific failure modes (these are not generic — ACH carries unauthorised-return-rate breach against current NACHA thresholds, administrative-return-rate breach, Same Day ACH cutover errors, WEB Debit account-validation failure under the rule effective March 19, 2021; card carries chargeback-rate program escalation, fraud-rate program escalation under the network's monitoring program, BIN-sponsor reporting failure; FedNow and RTP carry settlement-finality irrevocability, request-for-return-of-funds latency, ISO 20022 message-field anomalies; cross-border correspondent carries OFAC-screening latency, correspondent-bank de-risking, FX-disclosure timing under Reg E §1005.31 subpart B); key controls; residual risk; top three KRIs (rail-specific, not portfolio-level); owner role. Cite each failure mode by file path into `references/source-anchors.md` rather than restating the rule text.

The **risk universe by customer segment** is the second matrix. One row per segment in scope. Columns: inherent risk; top failure modes (UDAAP themes per segment, dispute / chargeback profile, AML / sanctions profile, fraud-pattern profile); key controls; residual risk; top KRIs; owner. Segment-level UDAAP is the highest-frequency examiner finding in this lane: account-closure / hold without notice or recourse, fee-disclosure-vs-actual reconciliation, FDIC-insurance representation under the FDIC misrepresentation rule (12 CFR Part 328 Subpart B), Reg E §1005.11 timing failures presented as both Reg E and UDAAP, BNPL fee and dispute presentation, dark-pattern risk in onboarding. Pull the cross-cutting conduct overlay in by default; pull the consumer-compliance deep-dive (`consumer-compliance-fair-lending/udaap-risk-review` with the payments-fintech overlay) for the substantive review.

The **risk universe by geography** is the third matrix. One row per US state in scope plus one row per corridor country if the program operates cross-border. Columns: licensing posture (MTL via NMLS; Money Transmitter Modernization Act adoption status for the state; MSB registration where applicable; state DFI / DOB registration; specialised licences such as NYDFS BitLicense for VC activity, CA DFPI under the CA Money Transmission Act and California Consumer Financial Protection Law); top failure modes (state UDAP regime, state breach-notification statute, state cross-border remittance rules); key controls; residual risk; owner. Default-to-USA on the geography row is wrong; the operative obligations are state-by-state.

The **concentration views** are three sub-tables, not one line. Sponsor-bank concentration: top-N share by deposits, volume, customer count; scenario impact under single-sponsor exit; appetite posture; standby sponsor and dual-sponsor architecture status. Processor concentration: top-N share by volume and value per rail; scenario impact under single-processor outage or consent-order; rail-by-rail redundancy status. BIN-sponsor concentration: top-N share of card volume and outstanding cards; scenario impact under BIN-sponsor exit or fraud-rate program escalation; debit-vs-credit and network-by-network coverage. Cross-link to `third-party-operational-resilience/concentration-risk-review` (with the payments-fintech overlay) for the portfolio-level analysis; raise the flag here, do the deeper analysis there.

The **cross-cutting risks** layer the topics that cut across rails and segments. Fraud (rail-specific signal denominators; faster-payments irrevocability driven typology shift); AML / sanctions (cross-link to `financial-crime-governance/aml-model-monitoring` and `sanctions-screening-qa` with the payments-fintech overlay; corridor-by-corridor screening cadence; Travel Rule applicability under 31 CFR §1010.410(f) for transmittals at threshold); operational resilience (rail-availability against impact tolerance; sponsor-bank cutover capability; in-flight-clock preservation under transition); customer-harm / UDAAP (theme-by-theme control review against current CFPB Supervisory Highlights and Circular series); reporting and data quality (denominators, granularity, timeliness; Reg E §1005.11 dispute-data timing as both an internal KRI and an examiner-facing report); cyber (NYDFS Part 500 where applicable; GLBA Safeguards §314.4; sponsor-bank cyber-notification chain; processor and fraud-decision vendor cyber posture; cross-link to `risk-reporting/cyber-disclosure-readiness` for the disclosure leg). Each topic gets a row with risk owner, top three KRIs, and the deep-dive skill reference. Do not restate the deep-dive analysis here; this is the matrix view.

The **risk-appetite posture** lays a green / yellow / red read across the top-quintile cells of the matrix above against firm appetite. Where firm appetite is not on file, mark `[evidence needed]` rather than fabricating a threshold. Trigger conditions for red-to-amber escalation are named per cell.

The **KRIs and reporting cadence** dictionary names each KRI with definition, source system, threshold (where set; otherwise `[evidence needed]`), owner role, and reporting cadence (board, ERC, sponsor-bank operating committee, sponsor-bank TPRM, state-MTL annual report). Rail-specific KRIs sit alongside cross-cutting KRIs.

The **recommended remediation portfolio** ties items back to specific risk references with action, owner role, target date, and evidence link. The portfolio is the bridge from assessment to work plan; it does not approve or decide.

The artifact closes with **open items and named follow-ups**, **source citations with date**, and the **recommended disposition** (`baseline-accepted`, `accept-with-conditions`, `remediate-then-re-baseline`, `escalate`). Disposition is a draft recommendation. The named approver — head of payments compliance, BSA officer, sponsor-bank chief compliance officer counterpart, board risk committee — decides.

## Quality bar

Every material claim cites a source from `references/source-anchors.md` (or a loaded overlay) by file path; unsupported claims are marked `[evidence needed]`. The matrix denominators are rails, segments, and geographies (a generic enterprise taxonomy with payments-flavoured failure modes dropped in is not this artifact). Concentration is three sub-tables (sponsor-bank, processor, BIN-sponsor). State geography rows do not default to "USA". The §1033 status note repeats wherever §1033 obligations are touched: the rule was finalised October 22, 2024 but is in a stayed compliance-date posture and a CFPB-initiated reconsideration with an ANPR — date-stamp each citation and record which dates are stayed, which are operative, and which are subject to further rulemaking. The CFPB payment-app larger-participant rule (November 2024) is nullified by PL 119-11 effective May 9, 2025; do not carry a direct-CFPB-supervision row anchored to that rule. The Section 1071 small-business-lending rule was revised May 2026 and applies only where the program originates small-business credit. MSB-vs-not is configuration-specific against the FinCEN administrative-ruling library, not a categorical claim. Faster-payments rails (FedNow, RTP) carry settlement-finality irrevocability and the recovery mechanic is request-for-return-of-funds, not chargeback. NACHA and card-network rule citations are paywalled and carry the disclaimer "current edition; specific sections to be confirmed against the firm's licensed copy". Named institutions appear in narrative only when they are public defendants in a finalised enforcement action with a published consent order. The artifact is a draft and the named approver decides.

## Adaptation

Assessment depth and length scale to the trigger and the audience. A sponsor-bank annual-review file reads longer than a quarterly delta-risk review. A board-risk-committee read-out collapses the matrices to heat-map summaries with the supporting rows in an appendix; a state-MTL exam preparation file leads with the state geography row and the MTL / NMLS posture, with the rail and segment matrices supporting. A new-corridor delta review focuses on the affected corridor country, the affected rail rows, and the cross-cutting AML / sanctions and operational-resilience overlays; the unchanged rows summarise to a status line. Sector overlay loading is fixed (this skill is the payments-fintech sector flagship; the overlay is `references/sector-overlays/payments-fintech.md`). Cross-cutting overlay loading follows scope plus the rule that conduct and cyber are default-on for any payments program touching consumers and rails respectively, and privacy is default-on where the firm processes NPI through fraud or AML monitoring beyond the baseline.

## Pointers

- `references/source-anchors.md` — citations and excerpts for the named anchors.
- `references/sector-overlays/payments-fintech.md` — payments-fintech sector flavour (this is the sector flagship; the overlay carries the rail-specific, sponsor-bank-specific, money-transmitter-specific detail and the §1033 status note).
- `references/cross-cutting/cyber.md`, `conduct.md`, `privacy.md` — cross-cutting flavour. Conduct is default-on for any consumer-facing program; cyber is default-on for any program with processor / ledger / fraud-decision vendor exposure (substantively all of them); privacy is default-on where customer-data flows for fraud and AML monitoring extend beyond baseline.
- `references/firm-overlay.md` — firm-installed policy, taxonomy, decision forums and sign-off owners, risk-appetite thresholds beyond the regulatory baseline; consumed when present.
- `templates/default-output.md` — assessment template.
- `schemas/payments-risk-assessment.schema.json` — structured-output contract for downstream consumption.
- `examples/` — BNPL program operator preparing its annual assessment after a CFPB action wave; cross-border remittance fintech reassessing risk after adding RTP and a new corridor.
- `TROUBLESHOOTING.md` — recurring pitfalls (generic taxonomy with payments flavour dropped in; default-to-USA geography; sponsor-bank-only concentration; treating BNPL as a single rail; missing the faster-payments irrevocability shift; categorical MSB assertions).

The plugin-level shared references (`references/source-map.md`, `references/policy-control-library.md`, `references/public-regulatory-scenarios.md`) sit at the plugin root and are consulted alongside the skill-level files.

## Output

Default to drafting against `templates/default-output.md`. Render as Word, Excel, PowerPoint, or Markdown when the audience or workflow asks for it; a sponsor-bank annual-review file usually rides as a Word document with the matrices in Excel appendices, a board read-out as a deck. Produce the structured record at `schemas/payments-risk-assessment.schema.json` when downstream automation or a registered consumer needs it. Downstream consumers: `concentration-risk-review` reads the three concentration sub-tables for portfolio-level analysis; `fintech-partner-controls` reads the rail and segment rows for the sponsor-bank-facing controls inventory; `payment-operations-incident-review` reads the rail, segment, and geography baselines when an incident lands; `aml-model-monitoring` and `sanctions-screening-qa` read the corridor-by-corridor view and the cross-cutting AML / sanctions row; `udaap-risk-review` reads the segment matrix for the conduct overlay; `regulatory-change-management/exam-brief` reads the geography matrix and the MTL / NMLS posture for state-track exam preparation. The schema is the cross-skill contract; additive changes only. Add fields, do not rename or repurpose them. A breaking change is a versioned migration with the downstream skills told in advance.