Legacy infrastructure: the real barrier to AI in payments

At some point in the last two years, almost every bank started an AI project. Fraud detection, credit decisioning, transaction monitoring, customer servicing; the use cases are real, the budgets got approved, and the vendors showed up with convincing demos. So why aren't approval rates improving? Why do fraud losses persist? Why does personalisation keep stalling out?

For most institutions, the answer doesn’t lie with the AI, but with what the AI is sitting on.

The architecture problem nobody wants to talk about

Legacy card and payments systems were built for a different era, one with batch processing, overnight settlement, and rules that a compliance team could write on a whiteboard. They were never designed for what a modern fraud model needs: live transaction context, device signals, behavioural patterns, and the ability to act on all of it simultaneously before authorisation completes.

That gap doesn't close by adding an AI system on top. It closes by fixing what's underneath.

McKinsey estimates that at a typical bank, legacy infrastructure and technical debt consume around 70% of total technology spending. Global bank technology spend hit USD 650 billion in 2023, yet the US banking sector productivity has been falling on average since 2010. That's not a model problem. That's an architecture problem dressed up as an innovation gap.

A third of bank representatives across Europe and APAC now identify payments modernisation as an immediate operational priority, not a roadmap item, not a future aspiration. Something they need to solve now, and the reason isn't hard to find.

Where it actually breaks down

Failure tends to follow a predictable pattern. A bank deploys a machine-learning fraud model and then discovers it can't get a real-time data feed from the authorisation system. A digital issuer builds a personalised product configuration layer and finds that the underlying card management platform can't support dynamic parameters at the account level. An institution invests heavily in AI-driven customer servicing and then realises there's no API pathway to act on what it learns.

These aren't edge cases or implementation failures. They're the structural mismatch between what AI requires and what most legacy payments stacks can provide.

What modern AI needs from issuing infrastructure isn't complicated to describe, even if it's hard to build. It needs authorisation flows that are event-driven and low-latency, capable of passing rich contextual data to the model when the decision must be made, not hours later in a batch file. It needs token lifecycle management that's native, not bolted on, because the shift to digital wallets, virtual cards, and API-initiated payments has made this a must-have. Visa provisioned 12.6 billion network tokens in 2025. Mastercard has committed to 100% European ecommerce tokenisation by 2030. Issuers without native token management are already being left out of flows they should be participating in.

Modern systems require genuine API-first connectivity. Not incremental endpoints added over decades, but interfaces designed for real-time data exchange. And they need risk controls that work across the full transaction surface: card present, card not present, digital wallets, and real-time payments. Siloed risk frameworks, where each channel runs its own disconnected rules engine, make holistic behavioural modelling impossible or incredibly laggy at best. Which is precisely why false positive rates stay high and fraud catch rates stay lower than they should be.

The case for modernisation has changed

So far, the argument for replacing legacy infrastructure has been built around cost reduction and operational efficiency. Those arguments still hold. But they're no longer the most compelling ones.

The more urgent case is competition. Institutions that have modernised their issuing foundations are getting meaningful returns from their AI investments. Institutions that haven't are spending significantly to find out that their models can't actually run properly. That gap can only compound. The 2024 Celent Technology Trends Previsory found that 57% of banks cite speed and agility as a key driver of their technology strategy, with legacy modernisation consistently among the top priorities. Because the ones that delay aren't just falling behind, they're actively making it harder to catch up.

This doesn't require a rip-and-replace programme. Cloud-native platforms can be introduced progressively, replacing legacy components where the business case is clearest first. What matters is that AI enablement is treated as a design criterion from the start, not an afterthought that gets bolted on later, which is how most of the current problems got created in the first place.

One example is BPC's SmartVista platform. Built around the principle of a cloud-ready issuing and payments stack with real-time authorisation, native tokenisation, and API-first connectivity, it's the kind of infrastructure layer that determines whether AI investments actually deliver or just generate findings that nobody can act on.

Agentic AI is here to stay

Agentic payments, where AI systems autonomously initiate, authorise, and manage transactions on behalf of users or businesses, are no longer a thought experiment. Mastercard's Agent Pay and Visa's Intelligent Commerce are live programmes. The market for agentic AI in fraud detection alone is projected to reach USD 37.76 billion by 2029. Embedded Finance is pushing payment functionality into contexts with no connection to traditional banking channels. Real-time payment networks are expanding the expectation of instant decisioning globally.

Every one of these trends makes the same demand of issuing infrastructure: real-time capability, programmable controls, and an open integration surface. The institutions that lead in AI-enabled payments won't necessarily be the ones with the most sophisticated models. They'll be the ones whose infrastructure can actually run them.

The good news is that the bottleneck is fixable. But only if financial institutions can fix the right thing.

About the author

Vlad is a Senior Editor at The Paypers, working in the Banking & Fintech team. He uses his research, content, and people skills for all activities revolving around Open Banking and Open Finance. Vlad has a degree in Biology and Molecular Genetics and an extensive background in creative writing. You can reach out to him on LinkedIn.