Inside the six findings on the CPMI October 2024 final report on FPS interlinking governance

The October 2024 CPMI final report, recorded as Bank for International Settlements publication d223, sets out the international policy expectations for the governance and oversight of fast payment system interlinking arrangements. The report is the successor to the interim publication d219, which set out ten considerations for governance and oversight of interlinking arrangements, and is published alongside the API harmonisation companion publication d224, which sets out ten recommendations on cross-border payment messaging. d223 itself sets out seven oversight recommendations in Section 5.2, recorded as Recommendation 1 to Recommendation 7.

For Operations teams at Retail Banking firms working on FPS interlinking governance matters, the rulemaking touches board briefings, oversight policy notes, legal opinions on cross-border interlinking risk, compliance frameworks, operating-manual drafting, and stakeholder-engagement materials.

The pattern in one line

Two frontier AI models tested by the RLB Specialist Panel produced verbatim-looking answers across six questions on the October 2024 CPMI final report on FPS interlinking governance that misstate the regulator's own primary text on a specific, testable fact: the count of oversight recommendations, the scope of the report's recommendations against single access point and common platform models, the named list of consultation respondents, or the distinction between the interim d219's ten considerations and the final d223's seven recommendations.

How the testing worked

The RLB Specialist Panel designed six questions to mirror how legal, compliance, risk, operations, and board-secretariat teams at payment institutions, hub entities, and banks participating in fast payment system interlinking arrangements actually use AI on this practice area: operating manuals for retail customer access to interlinked FPS, service-level agreement drafting against the d223 recommendation set, customer-experience design for cross-border fast payments, and operational-policy notes on retail-bank participation in interlinking arrangements. Each question is bound to verbatim regulator-issued primary substrate held by the RLB Specialist Panel.

The substrate sources are: the d223 final report text on the BIS portal (recording the seven oversight recommendations in Section 5.2, the scoping treatment in Section 2.2 and Graph 2, and the Annex 1 consultation-respondent record); the interim d219 text on the BIS portal (recording the ten considerations in the executive summary and the three-category grouping); and the d224 API harmonisation companion (recording the ten recommendations on cross-border payment messaging, distinct from d223's recommendation set). Questions are prepared by the RLB Specialist Panel based on real practical AI usage in the workflows the respective audience uses AI for.

The Panel binds each AI finding to verbatim regulator-issued source text held as primary substrate.

What the models got wrong

Recommendation-count misstatement. Three findings (Finding 1 with Claude Opus 4.7, Finding 2 with Claude Sonnet 4.6, Finding 6 with Claude Opus 4.7) document recommendation-count errors. d223 Section 5.2 sets out seven oversight recommendations, recorded as Recommendation 1 through Recommendation 7. Claude Opus 4.7 committed in a board-style briefing memo to approximately ten oversight recommendations, importing the interim d219's ten considerations as the count of the final d223 recommendations. Claude Sonnet 4.6 committed in a board-style memo to a six-recommendation structure, undercounting against the regulator's seven. Both models produced the count with no hedging and no source-verification recommendation.

Conflation of interim considerations with final recommendations. Finding 6 (Claude Opus 4.7) documents a structurally important conflation: the model treats the interim d219's ten considerations as if they were the October 2024 final report's recommendations. d219 records the ten considerations as a working set for the interim report; d223 Section 5.2 records the final seven recommendations as the document's oversight prescription. The two instruments serve different functions in the international standard-setting process, and conflating them embeds a wrong instrument-status into oversight policy notes that internalise the AI's output.

Scoping drift on single access point arrangements. Two findings (Finding 3 with Claude Opus 4.7, Finding 4 with Claude Sonnet 4.6) document the same scoping treatment across both subject models. d223 Section 2.2 and the Graph 2 caption record that single access point gateway arrangements and common platform arrangements have more commonalities with correspondent banking and a single cross-jurisdictional payment system, respectively, and that 'they are not the focus of this report and will only be discussed to a limited extent.' Claude Opus 4.7 produced a board backgrounder that places a single access point arrangement inside the report's recommendation set and oversight expectations.

Claude Sonnet 4.6 produced a confidential board backgrounder that does the same. The scoping treatment in both models' output asserts a regulatory regime over a payment model that the regulator places outside the report's focus.

Consultation-respondent set inflation and fabrication. Finding 5 (Claude Opus 4.7) documents a fabricated respondent set. d223 Annex 1 records seven specific respondents: the Bill and Melinda Gates Foundation, EBA Clearing, the Emerging Payments Association Asia, Giesecke+Devrient, the International Institute of Finance, Mastercard, and The Clearing House Company. Claude Opus 4.7 produced an analyst-report draft that names fifteen to twenty consultation respondents, including organisation names that do not appear in Annex 1.

The audit treats this as a single-finding failure because the inflation and the fabrication are produced together in a single deliverable that an analyst would paste into a stakeholder-engagement exhibit.

Why this matters

Each of the six findings is recoverable on primary-source check. The d223 final report is on the BIS portal at bis.org/cpmi. The d219 interim report is on the BIS portal. The d224 API harmonisation companion is on the BIS portal. None of the AI subjects' wrong answers in this audit reflects inaccessible source material. Every answer was generated against substrate that the Panel holds in verbatim form and that the AI subjects had access to at query time.

For practising teams the implication is that AI-assisted research on the October 2024 CPMI final report cannot be relied on for: the count of oversight recommendations; the named list of consultation respondents; the scoping treatment on the single access point and common platform models; or the distinction between the interim d219's ten considerations and the final d223's seven recommendations. Each of these is a question type the AI handles in a confident, fluent register, and each is a question type where the AI in this audit was wrong in ways the regulator's own text resolves.

The regulator's actual position

The Committee on Payments and Market Infrastructures, in the October 2024 final report recorded as publication d223, sets out seven oversight recommendations in Section 5.2 for the governance and oversight of fast payment system interlinking arrangements. Recommendation 1 records that an FPS or hub entity that establishes an interlinking arrangement should identify, monitor, and manage link-related risks. Recommendation 7 records that the interlinking arrangement should meet the service level requirements agreed upon among the component FPS or determined by the hub entity. The intermediate recommendations cover risk-management governance, legal-basis arrangements, link-related risk management, settlement arrangements, operational reliability, and access criteria.

Section 2.2 and the Graph 2 caption record that the single access point gateway model and the common platform model are not the focus of the report and will only be discussed to a limited extent; the report's recommendations attach to interlinking arrangements as defined in Section 2.1, not to those two adjacent models. Annex 1 records the seven public consultation respondents named above. The interim publication d219, recorded as the predecessor instrument, sets out ten considerations for governance and oversight of interlinking arrangements; the d219 executive summary records that the ten considerations can be grouped into three categories.

The d224 API harmonisation companion, recorded as the parallel publication on cross-border payment messaging, sets out ten recommendations on payment-message harmonisation, distinct from d223's recommendation set. None of the AI subjects' wrong answers in this audit reflects the regulator's actual position.

Implications for Operations teams at Retail Banking firms

The four practical implications are: (a) every recommendation count cited in a deliverable must be matched against d223 Section 5.2 directly, not against the AI's quotation of it: (b) every named consultation respondent must be matched against d223 Annex 1, with the seven respondents recorded as the regulator's full set: (c) every scoping statement on the single access point or common platform model must be matched against d223 Section 2.2 and the Graph 2 caption: (d) every reference to the interim d219's ten considerations must be kept distinct from d223's seven recommendations and from the d224 companion's ten recommendations.

The findings in this audit show that the verification cost is not theoretical: the AI in this testing produced confident verbatim-looking answers on each of these question types and was wrong in ways the regulator's own text resolves.

How to access the full audit

The six findings are published at the CPMI FPS Interlinking Governance 2024 hub on RegLegBrief.com, with audience-specific case studies for lawyers and company secretaries; for payment-institution, corporate-banking, and retail-banking teams across legal, risk, compliance, and operations; and an AI Labs whitepaper for AI lab teams fielding frontier models into cross-border fast-payment and payment-system oversight deployments. The audit URL: https://reglegbrief.com/regulators/j1/INT/BIS-CPMI-INT-001/CPMI-FPS-INTERLINKING-GOVERNANCE-2024/. Each finding carries an immutable RLB Citation ID and is bound to verbatim regulator-issued primary source text held as primary substrate by the RLB Specialist Panel.

Right of Reply

These findings and associated work have been put up in public with a view of the greater good for the development of a safer AI ecosystem. Any party reading this or any finding on reglegbrief.com may contact us and have an unconditional right of reply; the Specialist Panel will publish any factual correction or contextual response alongside the original finding, with no editorial gatekeeping. Researchers, regulators, and compliance teams with questions on methodology or specific findings can reach the Specialist Panel via the same channel.

Source & Methodology Standards

RegLeg Brief is operated by Verdus Technologies Pte. Ltd. (UEN 201616982R), incorporated in Singapore. The RLB Specialist Panel, with an aggregate of over 60 years of public-policy and industry experience, documents only confirmed hallucination findings, under a methodology that requires a verbatim regulator excerpt for every documented claim. All findings, citation IDs, model outputs, regulator excerpts, and methodology notes are open-access.

Primary source verified: CPMI Final Report on Linking Fast Payment Systems Across Borders: Governance and Oversight, October 2024 (publication d223) · Substrate document: R6-FINAL_REPORT-00001 · BIS portal: bis.org/cpmi

Citation IDs referenced:

• RLB-H-INT-BIS-CPMI-CPMI-FPS-INTERLINKING-GOVERNANCE-2024-Q001-Opus47
• RLB-H-INT-BIS-CPMI-CPMI-FPS-INTERLINKING-GOVERNANCE-2024-Q005-Opus47
• RLB-H-INT-BIS-CPMI-CPMI-FPS-INTERLINKING-GOVERNANCE-2024-Q006-Opus47