Federal banking agencies are proposing a more tailored approach to third-party risk management. That doesn't make vendor oversight easier. It makes understanding the actual risk of each relationship more important.

Nuvei and Humboldt Merchant Services faced FTC actions only four days apart. The details are different, but the message to processors, PayFacs, sponsor banks, and fintechs is similar: merchant underwriting and monitoring are becoming an enforcement issue, not just an operational one.

Scams and social engineering are changing the fraud conversation because many harmful transactions are technically authorized by the customer. Payment companies need to understand the difference between valid credentials, customer consent, manipulation, merchant risk, and transaction safety.

Fraud tools are useful, but they are not a substitute for a real fraud strategy. ISVs, PayFacs, platforms, and payment companies need risk appetite, clean data, alert workflows, feedback loops, escalation paths, and people who know when the dashboard is lying.

AI agents may change how consumers and businesses shop, compare, select, and pay, but the old payments questions still matter. Agentic commerce will need clear authorization, token controls, user permissions, merchant trust, transaction context, fraud monitoring, dispute evidence, and liability clarity before “the AI did it” becomes the industry’s next favorite excuse.

ACH can look clean, cheap, and simple from the outside, but the real risk lives in authorization quality, fraud monitoring, return exposure, transaction context, and operational controls. The 2026 Nacha rule changes make it clear that ISVs, platforms, payment companies, payroll providers, and embedded finance teams cannot treat ACH as a low-cost payment feature without a real risk strategy behind it.

Everyone wants frictionless merchant onboarding until bad merchants, transaction laundering, scam activity, and card-brand monitoring programs start asking uncomfortable questions. Fast growth without real merchant monitoring is not innovation — it is future compliance pain with a cleaner user interface.