AI Hallucination ResearchFindings by audienceSectorsInternational / MultilateralStatutory Boards & AgenciesRisk › Promoting the Harmonisation of Application Programming Interfaces to Enhance Cross-Border Payments: Recommendations and Toolkit
Statutory Boards & Agencies × Risk — International / Multilateral · Last updated 11 Jun 2026 · methodology v2.3 · Hallucination Register
Share / Print X LinkedIn Email

AI Hallucination on Promoting the Harmonisation of Application Programming Interfaces to Enhance Cross-Border Payments: Recommendations and Toolkit for Risk teams at Statutory Boards & Agencies firms in international jurisdictions

Statutory Boards & Agencies Risk teams: documentation and reporting gaps possible from AI reading of CPMI Cross-Border API Harmonisation 2024

Risk leads at statutory boards and public agencies engaging with the CPMI API harmonisation programme are increasingly using AI to update agency-level CPMI risk dashboards, draft enterprise-risk-assessment annexes on the SARB pre-validation workstream, prepare board-risk-appetite papers on cross-border payments oversight, generate operational-risk metrics using fast payment system operator splits, and verify dated CPMI commitments against primary publications. The RLB Specialist Panel tested how that AI usage performs against the regulator's own primary text on CPMI's October 2024 d224 report and the related CPMI Brief and speech series.

The audit surfaced four substantive failure modes that the AI subjects delivered with regulator-fluent confidence.

Numeric Drift and False-Negative Availability Claim on CPMI API Harmonisation for Cross-Border Payments. Two frontier AI models tested by the RLB Specialist Panel returned confident, citable answers across the panel's CPMI substrate-bound question set on the October 2024 d224 report and the related CPMI Brief and speech series. The panel binds each AI finding to verbatim regulator-issued source text held as primary substrate.

Across the 2 findings in this Risk teams at Statutory Boards & Agencies briefing, the AI subjects returned a global fast payment system count of 57 sourced to the 2025 monitoring survey sample, when the authoritative CPMI figure is 70+; stated that the central-bank versus private operator split of global fast payment systems is not enumerated in public CPMI sources, when the November 2023 CPMI speech gives exact percentages.

A board-risk paper that records a CPMI cutover date the regulator never set is a factual error in a board-approved agency document. A risk dashboard that uses 57 rather than 70+ as the FPS connectivity baseline mis-sizes the agency's oversight scope. An enterprise risk register entry recording 'no SARB pre-validation workstream identified' carries a verifiable error into an official deliverable.

The findings are published with immutable RLB Citation IDs: RLB-H-INT-BIS-CPMI-API-HARMONISATION-CROSS-BORDER-2024-Q010-Opus47, RLB-H-INT-BIS-CPMI-API-HARMONISATION-CROSS-BORDER-2024-Q010-Sonnet46. The full audit is published at the CPMI API Harmonisation for Cross-Border Payments hub on RegLegBrief.com.

Risk and surveillance teams inside statutory boards and payments-oversight agencies (national payments councils, systemic-risk units, FMI supervisors) calibrate the systemic-risk view and the oversight perimeter against a tight set of CPMI numbers: global and regional FPS counts, cross-border-enabled subsets, planning-pipeline figures, and central-bank-versus-private operator mix. Two AI failures on this regulation hit that set from opposite directions. Opus 4.7 compresses the FPS universe to 57 and drops the operator-mix breakdown; Sonnet 4.6 holds the 70-plus headline correctly but denies the operator-mix percentages exist. sp231115 supplies the full set.

A systemic-risk surveillance memo built on either AI answer enters the oversight committee with an inflated domestic share and no operator-mix differentiator.

What the AI got wrong, and why it matters here

Both failures land where statutory-body risk depends on tight denominators and operator-type signal. Neither has a downstream check before the memo reaches the systemic-risk committee.

Finding 1: FPS denominator compressed

Opus 4.7 cited the 2025 monitoring survey at 57 (56 in one graph) operational FPS with no operator-type breakdown. sp231115 gives 70-plus operational, 14 cross-border-enabled, 24 in the five-year planning pipeline, 40% central-bank and 35% private. A statutory-board systemic-risk memo built on the AI denominator inflates the domestic share of cross-border-enabled FPS exposure.

Citation: RLB-H-INT-BIS-CPMI-API-HARMONISATION-CROSS-BORDER-2024-Q010-Opus47.

Finding 2: Operator-mix denied

Sonnet 4.6 cited the 70-plus FPS headline correctly and denied that a precise central-bank-versus-private operator percentage exists in the Brief 10 summary. sp231115 names 40% central-bank and 35% private. Removing the operator-mix line collapses the central-bank-versus-private differentiation the oversight memo depends on.

Citation: RLB-H-INT-BIS-CPMI-API-HARMONISATION-CROSS-BORDER-2024-Q010-Sonnet46.

When this hits the oversight calendar

Statutory-body risk pulls CPMI material on three artefacts: the systemic-risk surveillance memo on FPS exposure, the FMI-designation threshold review, and the periodic oversight-perimeter calibration.

Standing item Where the AI risk surfaces Failure mode
Systemic-risk surveillance memo on FPS exposure FPS denominator and operator mix Findings 1 and 2
FMI-designation threshold review Operator-mix differentiation Findings 1 and 2
Oversight-perimeter calibration Planning-pipeline forward signal Findings 1 and 2

Aggregate impact on the team

The same two failures collapse the operator-mix differentiation and the planning-pipeline forward signal, removing two of the three inputs the oversight perimeter calibration relies on.

Risk ImpactCountAffected findings
0

What this team should do

Tag the FPS count and the operator mix as known-failure outputs. Any AI draft naming those numbers must be sent through a primary-source check against sp231115 before it lands in a systemic-risk memo or an oversight-perimeter calibration.

Detection patterns to add to AI-review

  • FPS counts must trace to sp231115 or to a numbered CPMI brief.
  • Operator-mix denials must be cross-checked against sp231115 directly.

How RLB can help

RLB tracks AI failures on the FPS-landscape numerical anchors and refreshes the catalogue against live AI subjects on rotation. Statutory-board risk teams can wire the catalogue into the oversight-memo review step so these two failure shapes are caught before they reach the systemic-risk committee.

Every finding on this page compares an AI subject's account of the rule against the regulator's verbatim text from the regulator's own portal. Both are linked. Each delta, its root causes, and impact analysis are documented and published with immutable Citation IDs.