Is Waiting on Real-Time Payments a Strategy or a Risk?

The first is regulatory recognition. The Reserve Bank of Australia has designated the NPP as a “prominent payment system”, placing it under the same formal oversight framework applied to Mastercard, Visa, and eftpos. That designation carries a specific meaning: the RBA judges that disruption to the NPP could cause significant harm to confidence in Australia’s financial system.

For directors, that is not a technology signal. It is a governance signal. A payment system managed at that level of regulatory scrutiny is part of critical national infrastructure, and boards that are not actively considering their exposure to it are carrying an unexamined risk.

The second is legacy rail uncertainty. Most organisations’ payment operations still run on infrastructure that is heading toward structural change. BECS, which in 2024 facilitated approximately 3.5 billion payments worth $17.4 trillion, is on a transition path with no fixed end date, governed instead by industry readiness and coordinated planning. Cheques are moving faster, with Treasury’s published milestones confirming issuance ends 30 June 2028 and acceptance ends 30 September 2029. The direction of travel is not in question. What is in question is whether each organisation will be ready when the transition arrives or scrambling to catch up.

The third is mounting fraud exposure. Total card fraud in Australia reached $913 million in calendar year 2024, with card-not-present transactions accounting for 92 per cent of that figure. Nearly one in ten Australians experienced card fraud in 2024–25. That level of exposure shapes customer behaviour, drives regulatory expectations, and creates reputational obligations that boards cannot delegate entirely to operational teams.

The question of how payments are designed and protected is increasingly a question of whether customers trust the organisation with their money.

In payment infrastructure, first-mover advantage is the wrong frame. Unlike consumer apps or new digital channels, payment rails are operationally embedded, systemically sensitive, and consequential when they fail.

The organisations that have navigated payment transitions well, such as the UK, Netherlands, Brazil, and India, did not succeed by moving first. They succeeded by identifying the right use cases, designing trust into the experience, and scaling only once they had evidence.

We believe the right board question is not should we lead? It is: where does controlled early action reduce future risk? Early action is justified when it materially reduces exposure that already exists — in settlement flows where delayed confirmation creates downstream exceptions, in refund or payout moments where speed and certainty lower dispute volumes, or in payments where confirmation of receipt is required before access or service is granted. In each case, real-time payments are not introducing new behaviour. They are removing friction from behaviour that already exists.

Here is a three-step framework designed to replace a vague instinct to “wait and see” with a structured, reviewable executive decision.

Where is risk already present in current payment flows? Assess across card-not-present fraud and associated customer protection obligations, settlement delays and poor funds visibility, reputational consequences of payment failures, and dependence on batch or declining instruments whose transition paths are now moving. This step grounds the board conversation in existing pain, not hypothetical opportunity.

Can learning be isolated without systemic risk? The test is whether one use case — one journey, one channel, one customer segment — can be ring-fenced. If containment is not achievable, early action may be premature. If containment is achievable, deferring that learning may be creating more risk than it avoids.

Will acting now reduce future cost? Early action builds organisational readiness, generates evidence for future scale decisions, and reduces uncertainty in future migration planning. The earlier that learning begins, the more control the organisation retains over how and when it expands. From these three steps, the framework produces three clear postures.

• Where exposure is high and containment is achievable, then move now, in a controlled way. 
• Where exposure is high, but containment is more complex, look to build readiness and define explicit triggers for action. 
• Where exposure is currently low — wait, but with a defined review trigger. Waiting without that trigger is not a strategic position. It is avoidance dressed as patience.

Transitions of this scale reward organisations that learn early and compress the options of those that defer. Legacy rails do not switch off overnight. They gradually lose strategic relevance as risk concentrates, regulatory scrutiny increases, and replacement capabilities become operationally credible. The practical question is not when legacy ends. It is at what point continued dependence on it starts to increase execution risk rather than reduce it.

The next 12 to 24 months represent the last low-pressure window to answer that question from a position of choice. The organisations that emerge strongest will not be those that adopted everything first. They will be those that ensured they were never forced to move fast without having already learned how to move well.