EnquiriesNews and research, read with a risk practitioner’s questions. Facts first; our interpretation clearly marked.
EMVCo published a draft framework for card-based agentic payments, introducing an Intent Services concept for managing consumer-authorised intent across participants. The announcement’s public feedback period ended on 30 September 2026. This is a draft framework, not a final specification or a merchant mandate.
Read the briefingEMVCo announced a request for feedback on verifiable digital credentials for card-based payment authentication. The announcement describes work under development; it should not be read as proof of universal availability or an implementation deadline.
Read the briefingBanca d’Italia published its report on fraudulent payment transactions for the first half of 2025. It reports an overall fraud rate of 0.003% by value, with differences across instruments and channels. Payer manipulation remains the predominant form of bank-transfer fraud in this report.
Read the briefingThe EPC published version 2.0 of its Verification Of Payee matching recommendations. The document addresses character conversion and the handling of spelling differences, initials, phonetic variations and business names. It describes how providers can distinguish a match, close match and no match, while leaving responding providers responsible for their matching outcomes. These are matching recommendations, rather than a universal scoring algorithm.
Read the briefingThe EPC announced development of SCARLET, a framework for accepting EU Digital Identity Wallets in payment authentication. Its planned work covers contractual relationships, operational rules and technical specifications. The announcement follows a board decision on 24 September. The EPC describes a development programme, with consultation and a first rulebook planned for 2027; it does not announce an already operational scheme.
Read the briefingFIDO Alliance's 2026 Passkey Index reports that passkeys accounted for 36% of successful sign-ins in its contributing organisations. Its executive summary also reports a 93% success rate for passkey sign-ins, compared with 78% for traditional multifactor authentication, and shorter sign-in times. These are observations from the index participants, not measurements of every online service or a guarantee for a particular deployment.
Read the briefingIn a speech about digital money and tokenisation, ECB Executive Board member Piero Cipollone described a digital euro pilot planned for the second half of 2027, lasting twelve months, with 36 selected payment service providers. The speech distinguishes technical preparation from a decision to issue. Any issuance decision remains dependent on the legislative process rather than being settled by participation in the pilot.
Read the briefingThe EBA published final guidelines on third-party risk related to non-ICT services. The publication describes a proportionate framework aligned with DORA and focuses attention on critical or important functions. It addresses the relationship across its lifecycle, including assessment, contractual arrangements, monitoring and exit planning. The document is a supervisory framework with its own scope and implementation arrangements, rather than a checklist applicable to every business.
Read the briefingThe European Supervisory Authorities issued a statement on cyber risks associated with frontier AI models. It highlights the potential for faster vulnerability discovery, attacks on shared infrastructure and exploitation of common points of failure. The statement organises its risk mitigation discussion around prevention, detection and management, and encourages supervisory dialogue. It concerns operational resilience, rather than endorsing a particular AI tool or model.
Read the briefingOpen Banking Limited reported cumulative totals exceeding one billion open banking payments and 100 billion API calls across the UK's CMA9 banks since launch. Its release also recorded 2.81 billion API calls during June 2026. The figures describe different activities and time windows: a payment count is not interchangeable with an API request count, and the cumulative totals are not monthly volumes.
Read the briefingThe PSR's APP scams dashboard, updated on 30 July, covers the first quarter of 2026. It reports that 89% of the value of reimbursable claims was returned to victims, amounting to £72.6 million in that quarter. The dashboard tracks reimbursement outcomes within its reporting scope. These figures should not be read as the percentage of scam attempts stopped or the share of all fraud losses recovered.
Read the briefingThe European Supervisory Authorities published their first annual overview of major ICT incidents reported through DORA. The report covers 3,383 incidents and identifies a cross-border dimension in around one third of them. System failures and external events were important causes, while cybersecurity incidents represented a smaller share. The publication examines reported major incidents, rather than estimating every outage or attempted attack across the sector.
Read the briefingEMVCo published version 1.0 of its Electric Vehicle Open Payments Use Case document. It describes how EMV Secure Remote Commerce can support card payments at charging stations using ISO 15118 Plug and Charge. The publication aims to support interoperability with existing charging infrastructure and follows industry consultation. It is a use-case specification, not evidence that every charging operator has implemented the solution.
Read the briefingThis 2025 central-bank explainer describes the euro-area instant-payment rollout associated with the October 2025 implementation milestone. It outlines continuous availability, rapid execution, payee verification and customer-set limits. The article provides historical context for understanding today's payment journeys. Its description of the rollout should be read within the relevant institutional and geographic scope, rather than extended to every payment provider or currency.
Read the briefingThe BIS Innovation Hub's 2024 Nexus report presents a blueprint for linking domestic instant-payment systems. Developed with central banks and payment-system operators in Southeast Asia, it covers governance, oversight, commercial arrangements and technical design. This is foundational reading about the architecture of cross-border connectivity. The report describes a blueprint and implementation direction, rather than proving current availability for a particular corridor or customer.
Read the briefingWe link to primary publications, distinguish publication dates from the period studied, and separate reported facts from Antifrog’s interpretation. Items are selected manually; this page does not refresh automatically. No sponsored placement.
Evergreen source explainers