Talk with Helge Kraas, AI Lead PPI Payments, PPI AG, Hamburg

Where in payments is artificial intelligence productive today and what benefits does it offer?

Artificial intelligence (AI) has become an integral part of everyday banking, especially in fraud detection. Payments generate huge amounts of data – ideal for AI, and especially for instant payments. Banks have to decide within ten seconds whether to accept payments. AI constantly monitors all payment flows in real time, recognizes patterns, determines whether certain actions are plausible or not, and automatically suggests corrections. This applies to both transactional data and complex processes. Such technology is particularly beneficial for corporate clients, who often send complex payment instructions to the bank. Whenever there are repetitive tasks that follow a certain pattern, the bank should consider AI. We’re currently seeing this with address data, which banks will only be allowed to provide in structured form in the future. Without the help of AI, it would be almost impossible for many institutions to convert unstructured data into structured data within the sometimes-tight timeframes. “Machine beats man” is true not only for chess, but also for payments.

How can AI benefit direct debits and digital invoices?

In the case of direct debits, banks are interested in quick results because the procedure will soon be phased out [Editor’s note: from 2028 in Switzerland]. However, AI can help identify unwanted or wrongly rejected direct debits, especially the non-objection variant. Things get more interesting with electronic invoices, which are gaining ground in the EU and Switzerland with eBill. Germany, for example, has been gradually introducing e-invoicing for companies of all sizes since the beginning of the year. I expect that banks will increasingly enter the e-invoicing market in the next few years, because Request to Pay is a format specified by the European Payments Council for requesting payments and – this is the real advantage – transmitting additional data. This makes it possible to deliver an e-invoice directly to the bank account and have it approved by the payer. AI could enable additional, more personalized services such as buy now, pay later. It could evaluate customers’ past payment behavior to decide whether they are eligible for such offers. AI is useful for corporate clients in supply chain finance because it recognizes known patterns in these complex transactions.

To what extent are current AI data management methods suitable for use with real-time, transaction-based data?

That is almost too cautious a question. We see that payment service providers are having to analyze ever larger amounts of data in ever shorter periods of time due to the EU regulation on instant payments. Some startups have already announced their intention to build completely new ecosystems based on instant payments. Only time will tell if and how they will succeed. What is certain, however, is that we’re dealing with a veritable explosion of data. In addition, fraud rates for real-time transactions are four to five times higher than for traditional SEPA payments, which will gradually disappear. Without AI methods, it’ll be almost impossible to get a handle on all this.

I believe it’s particularly useful to work with specialized, domain-specific AI models that have been specifically trained to analyze transaction patterns and real-time data. These focused models are much more efficient for payments than universal systems. They can deliver more accurate results with less processing power and can be more flexibly adapted to the specific needs of the financial sector.

The trend is towards tailor-made AI solutions that are optimized for specific tasks in real-time payments.

Overall, I expect AI to replace the simple rule-based systems that have been used to date. It’s more flexible and can adapt much faster to a world that changes in ever shorter cycles.

What role will AI play in the next decade? 

In the future, AI will be an inherent part of payments – PAIments, if you will. AI is already ubiquitous, not only in the back end, but also in the front end. We’re still a long way from customers using a chatbot for all their financial transactions, but institutions are working hard to create an AI-powered offering that is more tailored to individual needs. 

Under the hood, we can see how AI is primarily helping with unpopular routine tasks. Soon, AI will also be used in technically demanding areas such as cash management. I think we will see the classic hockey stick curve.  

What are the main barriers to greater use of AI?

Payments are about trust, accuracy, reliability, and traceability. AI solutions need to meet these requirements. When AI scales, nothing must go wrong. Concepts such as Explainable AI, or XAI for short, are designed to ensure that AI does not remain a black box, but delivers comprehensible results. A human must always be able to understand why the bank has rejected a payment. Regulations are sometimes so strict that regulators can classify even relatively simple procedures such as logistic regression as high-risk AI systems. For banks, this means that they have to document and prove very precisely that their AI works properly, does not discriminate against anyone, and much more. 

Despite all the excitement about the possibilities of AI, we should not blindly follow every new hyped development. Sometimes the old way is still the best way. If an established method works well, I don’t need to desperately try to replace it with AI just because it’s trendy.

What are the risks of AI-based personalized financial services and how can we minimize them? 

The EU AI Act sets out the main criteria. When creating personalized financial services, we often work with personal data and characteristics. Where does someone live? What do they earn? How is their income regulated? These are questions that play a role in lending. Banks need to be careful not to discriminate unconsciously, and to ensure that AI always makes decisions that are understandable. Some use cases are out of bounds for AI, such as social scoring, which rewards certain behaviors that are considered socially desirable.

Banks need to ensure that their AI only learns what it really needs to know to make decisions. “Well poisoning” is when the AI suddenly recognizes patterns that a human would not have thought of. This can happen intentionally or unintentionally. For example, the country of birth of a loan applicant may be written on submitted documents. If the AI suddenly starts using this data when it was not intended to, it can lead to unwanted biases.

It’s therefore essential to protect the data pool that an AI works with and keep it clean. 

No bank, no company, and no individual should trust it blindly. Studies show that people who use AI frequently tend to be less critical about whether what the AI delivers is really correct. We’re aware of the obvious errors in an AI-generated image, for instance. But often inaccuracies are more subtle. We must not lose our sense of these subtleties if we are to work safely and effectively with AI.

Where do we stand in the AI arms race against financial criminals?

It’s difficult to give a definitive answer to this question. It’s a classic cat-and-mouse game. Basically, cybercriminals are waiting for the slightest oversight. We know this from zero-day exploits, which are vulnerabilities in operating systems or software that no one has thought of yet, even though they’re easy to fix. AI will be no different. It’s conceivable that cybercriminals will succeed in “poisoning” an AI by feeding corrupt or manipulated information into the training data. Or they could use clever interaction to gain unauthorized access to sensitive data. So cybersecurity will play an important role, but so will methodical security. By that I mean that banks need to know when their AI algorithms are suddenly behaving suspiciously.

Unfortunately, AI also makes it possible to carry out known scams more efficiently – for example, by sending even more convincing phishing emails or creating deepfakes with fake phone calls and an AI that can imitate the language and voice of a human being deceptively with just a few spoken words. Closely related to this is the question of who is liable in the event of damage.

All in all, AI is forcing us to do what we’ve always been advised to do: lifelong learning and vigilance.

How do regulations like the GDPR affect the use of data in AI for financial services?

The EU AI Act is even more relevant than the GDPR, as it creates binding criteria for the use of AI for the first time. Even if Switzerland is not directly affected by this regulation, it’s indirectly affected due to its intensive trade with the EU.

The GDPR primarily regulates the handling of personal data, which must be used sparingly and for a specific purpose – a principle that already severely restricts the widespread use of AI today. In addition, data subjects have the right to an explanation of how (AI) decisions were made and the opportunity to challenge them.

The EU AI Act goes one step further and classifies AI systems into four risk classes: low, limited, high, and unacceptable. The latter are generally prohibited. In the financial sector, many AI applications are automatically classified as high-risk systems – particularly solutions for credit decisions, fraud prevention, and anti-money laundering. Legislation sets out clear requirements, particularly with regard to data quality, documentation, and transparency. Fully autonomous AI systems that make credit decisions without human control are explicitly prohibited.

Generative AI, such as chatbots or recommendation systems, is subject to less stringent requirements. Despite the regulatory hurdles, the EU AI Act also offers benefits: The clear legal framework creates investment certainty. Companies that comply with the requirements can be sure that they are not inadvertently investing in technology that will later be banned. 

However, we in Europe must be careful not to over-regulate. Of course, it’s right to set high standards for privacy, transparency, and fairness. But if the rules become too complex and unmanageable, companies could be deterred from using AI productively at all. This would set us back in global competition – especially compared to the US and China, where the development of AI is often accompanied by fewer regulatory hurdles.