PAYMENTS BRIEF | Tuesday, September 15, 2026

You're receiving this newsletter because you subscribed at pmtclaw.com. To unsubscribe click the link at the bottom of this email.

TODAY'S TOP STORIES

1. MA CFO Interview

Mastercard CFO Outlines Growth Strategy Driven by Stablecoins and Value-Added Services |. Mastercard's growth strategy centers on expanding its value-added services, which now account for roughly 40% of its net revenue through data insights, advisory, and fraud prevention. The card network is driving further high-value B2B settlement, cross-border remittance, and cyber defense growth by embedding newly acquired stablecoin and threat intelligence capabilities directly into its payments stack. Additionally, the company is positioning itself to capture shifting commerce streams by licensing its network credential technology to power sovereign domestic payment switches worldwide. PYMNTS.com

So What? Despite Mastercard's strategic focus on B2B settlement, the network continues to face deep structural hurdles gaining true traction in high-value corporate flows. Major commercial banking partners and top issuers frequently box Mastercard out of expansion in this arena, preferring to guard their own lucrative client relationships and proprietary banking channels from network disintermediation. These financial institutions are highly protective of their corporate deposit bases and lending ecosystems, leaving card networks with limited leverage to force their way deeper into the payment flow.

2. AI-POWERED B2B FRAUD IS FORCING COMPANIES TO RETHINK TRUST

Great JPM Piece, My father in law's biz got hit for $20k last week. Vendor impersonation attacks now bypass traditional payment controls by using AI-generated communications to compromise supplier identities before requests reach approval workflows. This upstream shift means fraudsters exploit established vendor relationships and credentials to authorize payments, requiring treasury teams to fundamentally rethink verification at every stage of the instruction lifecycle.

So what? B2B fraud acceleration forces payment approvers to assume compromise throughout the instruction lifecycle — real-time voice and video impersonation at scale changes the risk model for treasury controls and vendor onboarding. → Source: Jpmorgan

3. SENATE CLARITY ACT VOTE TEES UP CRYPTO COLLISION WITH TRADITIONAL FINANCE

The Senate is scheduled to hold a crucial preliminary vote today to determine whether the long-stalled Clarity Act has the necessary support to escape a filibuster. While Republican leaders updated the legislation to include strict ethics compromises and stablecoin circuit breakers to win over at least seven required Democratic votes, the bill's advancement remains highly uncertain due to fierce ongoing lobbying from banks and the crypto industry. Lawmakers warn that if this critical procedural vote fails, there will likely not be enough time left in the current legislative calendar to amend the package and successfully clear both the Senate and the House → Source: PYMNTS Also covered by: CNBC, Dailyhodl

4. ENHANCED SPC TARGETING THE EU DIGITAL IDENTITY WALLET · ISSUE #346 · W3C/SECURE-PAYMENT-CONFIRMATION

The W3C has advanced a technical specification that integrates EU Digital Identity Wallet capabilities into Secure Payment Confirmation, enabling FIDO passkey authentication across both online and point-of-sale environments through a unified cryptographic framework.

So what? Very early days. FIDO itself is flawed, My top 3 issues: #1 — Bilateral by design: FIDO can't handle multilateral payment trust. FIDO was built for a two-party exchange — a user authenticating to a single Relying Party (e.g., logging into Facebook). Payments involve many parties: the consumer, merchant, issuer, network, acquirer. Banks may issue credentials but networks must verify them. As you wrote in the AP2 Donation post: "This isn't handled well in today's FIDO." W3C Verifiable Credentials are needed to extend FIDO into multilateral trust delegation — which is why Google donated AP2 to the FIDO Alliance to force that evolution. #2 — Cloud sync defeats hardware isolation (the passkey problem) FIDO's core security promise is hardware-bound credentials. But Google and Apple both cloud-sync passkeys across devices to reduce friction — which, as you put it, "effectively defeated the fundamental process of FIDO — hardware isolation — by creating a software-based copy of the credential." This is why Google has been pivoting hard back to device-bound credentials (Titan M2, Android Ready SE Alliance), aligning with Apple's Secure Enclave approach. #3 — No governance/commercial construct for credential issuance in paymentsFIDO has no framework for who issues credentials, who verifies them, and who bears the liability. In payments, that governance layer is everything → Source: Github Also covered by: Github

5. EUDI WALLET RELYING PARTY WITH KEYCLOAK: WHERE OPENID4VP SUPPORT ACTUALLY STANDS

Keycloak's stable releases lack production support for wallet credential verification, with OpenID4VP presentation capabilities confined to an experimental flag on the development branch. This leaves financial institutions without a mature open-source foundation for EUDI Wallet integration ahead of regulatory deadlines.

So what? EUDI Wallet identity provider infrastructure gap persists — critical open-source relying party layer (Keycloak) lacks production-ready wallet verification, creating bottleneck for financial institutions requiring identity presentation by December 2026. → Source: Skycloak