Payment Controls in the Age of AI (AFP 2026 Preview Discussion)

The Payments Podcast by Bottomline

Episode Transcript

Owen McDonald (Host): Welcome to The Payments Podcast. I'm your host, Bottomline managing editor Owen McDonald. For treasury and payments teams, speed and security are becoming part of the same conversation. Instant payments continue gaining ground. APIs are changing how companies automate, and AI is moving quickly into areas like payments and vendor validation.

Every improvement in speed and automation creates the same quandary. Where do the controls belong? That's most relevant as treasury and finance folks head to the AFP 2026 Conference, where fraud prevention, payment security, and smarter automation are high on the agenda. Joining me to talk this out is Julie Mingus, director of payments practice at the Association for Financial Professionals. Julie brings both the AFP perspective and hands-on corporate payments experience, including her previous work leading major payments initiatives at Cinemark.

Julie Mingus, director of payments practice at the AFP, welcome to the payments podcast.

Julie Mingus (Guest): Well, thank you so much. I'm so happy to be here today and super excited to talk about payments and fraud.

Owen: Me too. I couldn't have said it better, Julie, and I'm so glad you're here. Let's begin. As treasury and payments professionals head to AFP 2026, instant payments and fraud controls are very hot topics for attendees. With payments getting faster, Julie, how do companies maintain strong fraud controls without letting urgency become an excuse to bypass them?

Julie: You know, this is a great topic for the fact that, as we want things faster, we as humans sometimes tend to overlook some of the steps that take it to get there faster. And faster payments should never compress your processing time, or it should compress your processing time, but not control your discipline. That discipline is so important, and companies need to continually review, in my opinion, how existing controls perform across any type of payment, whether it's same-day ACH, RTP, wire, check, any kind of money movement.

You know, confirm that you have the required information, that it's reliable, and it's moving between your systems securely, as we continue to incorporate more efficiencies across/inside the organizations.

And with your providers, you cannot lose focus of that. But you also need to keep it scalable. Make sure it's standardized. You know, don't use email, don't use informal workarounds.

Owen: We're gonna get to that in a minute. But, yeah, I hear exactly what you're saying, and that's the big problem, you know, urgency overcoming process, and, clearly, you're not a fan of that!

Julie: No! It's really important that teams continue their current processes with all of the various controls that are in place, whether it's segregation of duty, or your file transmissions, or how you collect the data. But that doesn't mean that you have to stop being more advanced with ability to make same day payments and those types of things, from that perspective. Fraudsters will try to do anything to make you mitigate those practices.

So, you stand firm. Teach your teams to stand firm and say no. Don't mitigate those things. To me, fraud controls are more important today than they were twenty years ago.

Owen: Agreed. Moving on. You've talked about moving payment activity and you just foreshadowed, Julie. You've talked about moving payment activity out of email and those kinds of channels and keeping it inside controlled workflows and ERPs. How important is that kind of centralization to preventing fraud before it ever enters the payments environment?

Julie: Oh, it's very important. It's probably one of the most key controls out of all of this. Centralization of all of these workflows is very important. It's the foundation. That is your base.

That's where you're going to stop that fraud prevention because, as you said, fraud starts before the payment's ever even determined and before it ever gets in the system - so your request or your approvals or any modifications or changes, any supporting documentation should flow through your ERP or your payment portal that you have. Not everybody has the same thing, so keep that controlled workflow. Keep your organization consistent, you know, with the access to the rights, segregation of duty, validation of any rules or audit trails. Don't have anything come through email.

If it does come in an email, you tell them to push it back, push it in through the system where it belongs. Empower your people to be able to do that, but keep your controls in place. I mean, your goal is to create one governed path into payments regardless of the type of payment, but then have your exceptions clearly identified. I mean, you're not going to be able to identify all the exceptions, but have a place for your exceptions on how you handle those inside of your systems. Don't make it informal.

Keep everything formalized.

Owen: Right. Just taking something like email out of the loop. Yes. Completely. Huge win, right?

Julie: Yeah. You take your email out. You take any kind of, phone call, you know, manual process out. You take those and remove it. Don't even let it be part of that situation.

Owen: Now, Julie, you led a major API project at Cinemark that touched both card and AP payments. What did APIs materially improve, and what should a treasury or payments team understand before trying to automate payments at scale using APIs?

Julie: Oh, yes. That's a big one. You know, your APIs will improve your timeliness and consistency, of the information that you're moving between yourself, your organization, and your bank or your PSPs.

It it reduces manual handoffs. It supports the faster updates and the reconciliation. It's automation that is both external and internal. This is a thing people may not really think of. You can use APIs internally. I can now share payment information, a whole payment file with the accounting team to go ahead and enter into the ledger or treasury for cash flow and looking at working capital components.

Even putting this data into a data lake that is a centralized hub so everybody's looking at the exact same information so that it's not parsed here and there. Your APIs, they can define your authentication. They can help define approval requirements so that systems can't get circumvented or processes are not circumvented.

Owen: That's a great point.

Julie: You can have exception handling codes that are built into your APIs that remove manual processes on your team. So if you have a check that has a manual step that's associated with it, let the API drive that. Don't have to do an email to the bank, or have something returned. It's something that is a really big step, and it's something that you need to make sure you have mapped out clearly and that you test properly.

Owen: Well, it certainly seems like more people are getting on the API bandwagon. Not that it's new, but it's it's doing new things, I guess.

Julie: It's doing new things, and it allows a flow that's much more seamless and timely. And if you do it with the APIs, there's no intervention from a manual standpoint, so there's no data impacted. You don't have to worry about that. You're not having to go back and rescrub data from that perspective.

Owen: AI applies broadly across B2B payments today. Julie, we chatted recently, and you pointed to a very practical AI use case: validation. Where do you see AI genuinely strengthening prepayment security in 2027, let's say, and such as vendor or transaction validation? And where should companies be careful at over automating given the state of security today?

Julie: Yes. Absolutely. AI is a great tool, but you need to do it in the way that makes sense. One of the most practical to me, near-term uses of AI for payments on that validation layer is that additional validation. It could be from a vendor change.

You're going to look at against trusted records, ensuring that maybe that's the correct bank information or a correct company name, or if they change their company name, you can utilize those tools. You can also use it to identify maybe unusual transaction patterns. So if you consistently have a payment type that constantly is changing, someone's requesting a change, utilize that as a flag that that's not quite right because you shouldn't have this many changes. Look for inconsistencies. It could be bank instructions that are not quite consistent all the time, but it would pass through a system, so to speak, to get out the door.

Owen: And AI, in other words? Yeah. Right.

Julie: In AI, yes. You want to make it utilize the exceptions.

Like, let AI create your exception bucket for humans to review and then make a decision factor from that. That'll help your team kind of focus where your risk is the highest, to me. But I do think you have to be very careful because here's what you don't want it to do is to initiate and release any of your payments. You need to make sure that you still have some sort of controls and review of that. You want to make sure that you have high quality data that you're working with on the AI.

AI is a great tool, but it shouldn't be the answer to all things. You still have to have the accountability from the human oversight. And I think it really should. You can use it to establish better controls on the front end to make those decisions. So that, like, if it's a new vendor type, then maybe you have a little bit more scrutiny over that. But if it's just a basic change of an area code change and it changes all the records for that area code, that might be a little bit different.

So you really need to make sure you understand in your organization how robustly your AI would be with it, you know, within the policy and procedures.

Owen: Sure. We know that more and more companies are pulling their rules together, I guess, you would say, on AI usage, and it's getting tighter, I would say.

Julie: It is getting tighter, and I think you need to have that governance and then that review of that. You know, we all want things that are simpler and faster and smarter, but we still need to make sure at the end of the day that all the controls are there. Because at the end of the day, you are liable. Your company is liable for that. And it can be a very good tool, and we utilized it a lot at my last company, and it worked. However, you still had the human controls over it.

Owen: Right. That always seems to be the last word in that sentence, 'is keep the human in the loop'. This is the final question, and, again, you were just alluding to it. For decision-makers attending AFP this year, how should they make the business case for spending more on payment security and validation, Julie? Doesn't seem a hard sell to me.

So how can banks, PSPs, and other partners help prove the value of security investments?

Julie: Yeah. That's a good one. You know, at AFP 2026 this year, you know, treasury and payments leaders have over 20 sessions that are going to address different types of payments with fraud or business case or expansion of payment types. And you really should focus your business case. One, connect your security investment to operational and financial outcomes.

What is your goal at the end of the day? Obviously, it's kinda like an insurance policy. You may not need it right away, but you're gonna pay for it. You know, you want to look at avoided losses, fewer manual interventions. You know, we have, the stop payments fraud act of '26 is making its way through the government to approve this.

This gives banks the ability to hold payments to validate or PSPs. So you, as a company, need to make sure that you're not falling into that with, you know, having to be in that hold pattern, so to speak. Right. You want to look at your volumes. You want to scale your risk.

Do you have risk today? If you don't have risk today, that doesn't mean you won't have it in the future, but don't just be complacent that, oh, we don't have risks, so we don't have to worry about it. We haven't had fraud, so we don't have an issue. It will find you if you don't keep it buckled down. It's going to be there!

They really should look at, with their banks and PSPs, what other partners are doing to benchmark with your payment types, and look for different things to resolve, types of alerts or control failures, false positives. These are all things that come in that somebody has to touch on these payments at some point in time. That manual labor is much pricier than some of these controls, at the end of the day, and you don't catch everything. So I feel like these business cases are quite important. 

You need to build that base of 'what is your outcome'? And it may not be the same as the next company that you talk to. So look at what your company is trying to solve, or you specifically, and then work through that with your PSPs and your banks. I do think that their business cases should be reviewed on a much more regular basis with all of these payment type changes coming down the pipeline.

Owen: Wise words! And there we have it. Faster payments, APIs, and AI can all improve the way companies move money. As the AFP sees it, automation works best when strong validation and better controls are built into the payment from the outset. Our sincere thanks to Julie Mingus of the AFP.

To our audience, the smartest people in B2B payments, thanks for listening. Hit subscribe. Catch us again on your favorite podcast platforms, including Apple, Spotify, Blubrry, iHeartRadio, and YouTube. Bye for now. 

The Payments Podcast from Bottomline.