The settlement clock is also a risk model

A payment does not create one risk and then wait for a clock to report how long it took. The clock creates the shape of the risk. From the moment an obligation becomes hard to cancel until the receiving side has final funds, someone is extending credit, reserving liquidity, or relying on a counterparty to perform. Move a cutoff by ten minutes and the exposure may move by a day. Put a holiday between two legs and it may move by three.

That makes settlement timing a measurable treasury and counterparty model, not an operational footnote. A ledger that records only amount, currency and a friendly status such as paid cannot show the exposure. It also needs to know which event occurred, under whose rules, at what time, in which time zone, against which business calendar, and whether the event was reversible. The answer determines whether the money is cash, a receivable, restricted balance, intraday borrowing or unsecured exposure.

One payment has several clocks

“Payment time” is ambiguous because payment systems separate events that a user interface often compresses into one moment. Card networks distinguish authentication, authorization, clearing and settlement. Visa describes authorization as the issuer’s real-time approval or decline, clearing as the later exchange of transaction details, and settlement as the transfer of funds between issuer and acquirer.1 Mastercard likewise describes separate authorization, clearing and settlement systems.2

An approval therefore says something important, but narrow: a request passed the authorization process. It does not, by itself, prove that the transaction was submitted for clearing, that the cleared amount matches the authorized amount, that interbank settlement completed, or that the merchant can use the proceeds. The elapsed time between those events is economically active.

The distinction is even more precise in the international standard for financial-market infrastructure. CPMI-IOSCO defines final settlement as the irrevocable and unconditional transfer of an asset, or discharge of an obligation, under the applicable rules. It treats finality as a legally defined moment and says system rules should identify both that point and the point after which an instruction cannot be revoked.3 Those two moments need not be identical.

A useful ledger consequently carries at least five timestamps: initiation, acceptance, irrevocability, interbank finality and beneficiary availability. Some rails collapse several of them. FedNow is an interbank, 24x7x365 real-time gross settlement service that settles through entries to Federal Reserve master accounts and is designed to give end customers immediate access to funds.4 The Clearing House’s RTP rules similarly provide final and irrevocable settlement and funds availability in real time, around the clock.5 A card payment or bank debit can stretch the events across days.

Even instant rails do not make every upstream and downstream clock disappear. A platform may accept an instruction before sending it. A participant may fund a dedicated settlement account. A beneficiary may receive final funds while a separate commercial arrangement determines when a seller is credited. “Instant” describes a defined segment of a chain. Risk analysis has to identify that segment rather than apply the label to the whole journey.

Cutoffs turn minutes into discontinuities

Settlement time is not a smooth duration. It is a step function built from submission windows. Two otherwise identical instructions can be separated by seconds at input and by many hours at settlement.

The FedACH schedule makes the mechanism visible. Its same-day forward-item windows have transmission deadlines at 10:30 a.m., 2:45 p.m. and 4:45 p.m. Eastern Time, followed by settlement at 1:00 p.m., 5:00 p.m. and 6:00 p.m. respectively. A file must be completely received—not merely begin transmission—by the deadline. Items that are not eligible for same-day processing settle at 8:30 a.m. on the applicable future business day.6

That final-packet rule matters. Suppose a treasury system releases a file at 4:44 p.m. and records “submitted.” If transmission completes at 4:46, a model based on job start time places the cash in the wrong window. The apparent two-minute miss is not a two-minute liquidity variance. It can change the value date, leave a payable open overnight and require another source of cash.

The correct object to forecast is therefore not an average processing duration. It is the distribution of completion times relative to each hard boundary. A process with a ten-minute median but a fifteen-minute tail is safe when it starts an hour before cutoff and dangerous when it starts twelve minutes before. Queueing delay, file size, retry policy and acknowledgement semantics belong in treasury forecasting because they determine which settlement bucket receives the principal.

Cutoffs also create concentration. If transactions accumulate before a small number of windows, exposure is released in cliffs. The balance may look comfortable at noon and breach a prefunding or credit limit when a batch posts at 1:00 p.m. The Federal Reserve’s intraday-credit policy explicitly posts FedNow and Fedwire transfers as processed while other transactions, including ACH, post on defined schedules; it measures daylight overdrafts from those timed account positions.7 Timing is part of the balance calculation itself.

A business day is a risk parameter

“T+2” is incomplete unless T, + and 2 all have definitions. The transaction date might be local or UTC. The increment might mean calendar days or business days. The relevant calendar might belong to a rail, a settlement bank, a provider, a currency or the recipient’s country.

Stripe’s public payout documentation illustrates the ambiguity. It distinguishes payout cadence from settlement timing, defines the latter as the time until funds become available, and notes that a daily schedule with three-business-day settlement pays out transactions captured three business days earlier. It also states that payouts scheduled for weekends or holidays arrive on the next business day and that day-count conventions vary by account country.8 Those are not formatting details. Each convention changes the maturity of the receivable.

Holiday effects compound. Federal Reserve transactional activity for Fedwire Funds, ACH and several other services occurs only on standard business days and is not processed on listed Federal Reserve holidays.9 Fedwire currently operates Monday through Friday, excluding designated holidays, with its business day opening at 9:00 p.m. Eastern Time on the preceding calendar day and a 6:45 p.m. customer-transfer deadline.10 A Friday obligation before a Monday holiday does not merely acquire “one day” of delay. It crosses a rail closure, two weekend dates and a holiday rule.

Calendar logic must therefore be versioned data, not code that assumes Monday through Friday. It needs named calendars, observed-holiday rules, time zones, daylight-saving treatment and effective dates. A forecast should be reproducible under the calendar version used when the instruction was created. Otherwise a later rules update can silently rewrite the explanation for an old variance.

Provider schedules allocate counterparty exposure

Once a payment provider credits an internal balance but has not sent cash to a bank account, the holder owns a claim on the provider rather than the same asset it will own after bank settlement. A payout schedule decides how long that claim remains and how much accumulates.

Provider documentation makes the layers explicit. Stripe separates the time for a pending balance to become available from the schedule that determines when available funds are paid out; changing the payout schedule does not change the underlying settlement delay.8 Adyen describes business-day cutoffs after which a payout is processed the next day, and notes that higher payout priorities can carry higher fees.11 A weekly payout setting is consequently not just convenience. It is a decision to hold more value for longer at a particular counterparty.

This exposure has three dimensions. The first is principal: the available and pending balances owed. The second is duration: the time until the provider initiates a payout and the banking system makes it available. The third is concentration: how much of the firm’s liquidity depends on the same provider, settlement bank, currency and legal entity.

A simple daily balance snapshot misses all three. It can show the amount today, but not the amount-hours accumulated since capture, the next eligible payout window, or the portion stranded by a holiday. It can also conceal a change in terms. If a provider changes a delay from calendar days to business days, or changes the cutoff’s time zone, the nominal “T+2” label may remain while the weekend exposure changes materially.

Accelerated payout options reveal the economic value of time. Stripe documents an Instant Payout option that can be requested on weekends and holidays, while Adyen documents a tradeoff between payout priority and fees.811 The fee is the visible price of shortening an exposure. The less visible price of waiting is foregone liquidity, contingency funding and reliance on the provider’s continued performance.

Cross-border settlement is an overlap problem

Cross-border payments join clocks that were not designed as one clock. Correspondent banks update separate accounts; domestic systems open and close in different time zones; currencies follow different holiday calendars. The chain can continue moving messages while one required settlement asset is unavailable.

CPMI’s study of 62 real-time gross settlement systems across 82 jurisdictions found that most were closed on weekends and public holidays. It concluded that extending and aligning operating hours could increase cross-border speed while reducing liquidity costs and settlement risk, and introduced a “global settlement window”: the period in which the greatest number of RTGS systems operate simultaneously.12 That window is a useful exposure variable. Outside it, a completed leg may have to wait for another system to open.

The risk becomes clearest in foreign exchange. Without payment-versus-payment, one party can release the currency it sold without receiving the currency it bought. BIS defines that FX settlement exposure as lasting from the point when the sold-currency instruction can no longer be cancelled unilaterally until the purchased currency is received with finality; the amount at risk is the full purchased principal.13 A timing mismatch here is not merely late delivery. It is principal risk.

The same logic applies, with different legal consequences, to any chained payout. If leg A is irrevocable at 14:00 but leg B cannot settle until another market opens, the gap is an exposure interval. Adding an intermediary adds another set of acceptance rules, operating hours and reconciliation events. BIS describes current correspondent payments as a sequence of account updates and notes that differences in operating hours and holidays can delay settlement and keep errors undetected longer.14

End-to-end measurements confirm that the slow point is not necessarily the messaging network. A CPMI analysis of SWIFT gpi data found a median processing time below two hours overall, but route medians ranged from below five minutes to more than two days. It associated longer times chiefly with the interval at the beneficiary bank before customer credit, including effects from limited operating hours and batch processing.15 Measuring “network sent” would miss the dominant wait on those routes.

Twenty-four-hour domestic rails reduce a specific gap, not every gap. The Eurosystem’s TIPS provides final and irrevocable settlement in central-bank money 24/7/365.16 That removes weekend closure inside its settlement perimeter. It does not automatically synchronize a foreign currency, a correspondent’s compliance process, or a provider’s merchant payout schedule. The risk model must follow the obligation across perimeters.

Measure exposure as an area, not a status

The core quantity is outstanding principal over time. For each obligation (i), define an exposure start (si), an expected finality time (fi), an amount (a_i), a currency and a counterparty. The basic time-weighted exposure is:

E_i = a_i \times (f_i - s_i)

The unit might be dollar-hours or euro-days. Summing it across obligations shows the area under the unsettled-balance curve. This does not claim that risk rises linearly with time; it creates an auditable base measure that can be weighted for counterparty credit quality, collateral, legal finality, currency volatility or operational confidence.

Choosing (s_i) is a policy decision. For an FX trade, the BIS definition points to the unilateral-cancellation deadline.13 For merchant acquiring, it might be the point at which goods are delivered against an approved payment. For a provider balance, it might be capture or the point at which proceeds become contractually owed. The ledger should store the chosen event and policy version rather than bury the choice in a dashboard query.

Expected finality should be a distribution, not a single timestamp. At minimum, retain the earliest contractual time, the normal expected time and a stressed time. Derive them from the actual cutoff, calendar and route. A payment created before a window but acknowledged after it belongs in the later distribution. A payment that crosses a holiday needs the holiday-adjusted maturity before aggregation.

Two obligations with the same expected finality can still have different risk. One may be irrevocable, fully collateralized and confirmed by the settlement system; the other may be a provider estimate for a reversible balance. The model should therefore attach confidence and legal state to time instead of treating every ETA as a promise. A forecast date answers when cash is likely. A finality rule answers when the obligation is discharged. A collateral record answers how much loss is protected if the counterparty fails. These fields should meet in the exposure view without being collapsed into one score.

The same separation prevents liquidity risk from being confused with credit risk. A sound counterparty can deliver late and create an urgent funding need; an on-time provisional credit can still leave principal exposed. Treasury needs the cash-gap forecast, while risk needs the amount and duration of the claim. Both read the same event history but apply different weights. That is preferable to arguing over whether a transaction is generically “settled.”

Several views then become possible. A maturity ladder groups unsettled principal by the next settlement window. An aging view shows how long obligations have remained in each state. A concentration view groups exposure by provider, bank, rail, currency and legal entity. A liquidity-at-risk view combines scheduled debits, probable credits and available buffers by minute or hour. A counterparty view separates pending, available-at-provider, payout-initiated and bank-final balances.

The model should preserve gross amounts even when operations settle net. Netting reduces the amount of settlement liquidity required, but gross receivables and payables still explain commercial obligations, reversals and concentration. CPMI-IOSCO requires financial-market infrastructures to measure and manage liquidity risk and maintain sufficient resources for same-day and, where appropriate, intraday and multiday obligations under stress.3 A firm applying the same discipline needs both the net cash call and the gross obligations behind it.

Time-weighted measures should supplement, not replace, peak exposure. A low average can coexist with a short, severe funding cliff near a batch window. Report the maximum unsettled principal, the time-weighted total and the longest aging item together. The first sizes capacity, the second shows persistent balance use, and the third exposes stuck obligations that aggregate measures can hide.

Forecast error is itself a signal. Track the difference between expected and actual acceptance, finality and availability for each route and window. Split misses by cause: late release, transmission overrun, provider rejection, compliance review, rail closure, receiving-bank delay or reconciliation lag. Averages hide cutoff cliffs; report percentiles and the share that rolled into the next window.

The ledger must retain evidence of time

A credible implementation starts with an event model, not a larger set of status strings. Every transition should record the effective time supplied by the external system, the observation time inside the platform, the source, the external reference, the rule or calendar version, and whether the transition is provisional, final or reversible.

Effective time and observation time solve different problems. If a provider reports at 09:15 that settlement occurred at 09:02, treasury exposure ended at 09:02, while operational detection lag lasted thirteen minutes. Replacing one with the other either overstates financial exposure or hides monitoring delay.

State names also need scoped semantics. settled can mean settled on a card network, credited to a provider balance, included in a payout, debited at a correspondent, or final in central-bank money. The record should say settled_where, settlement_asset, finality_basis and funds_available_to. CPMI-IOSCO’s insistence that rules define the final point is a reminder that a technical success message is not a universal legal fact.3

The calendar engine should answer a concrete question: given an instruction, its completion time, route, currency and applicable rules, what is the next eligible settlement window? Store that answer with its inputs. Recalculate future forecasts when a calendar changes, but do not mutate historical decisions.

Reconciliation then becomes a risk control rather than back-office cleanup. It should connect the original obligation, authorization, clearing record, settlement entry, provider balance movement, payout and bank credit. Breaks should carry an amount and an exposure age. A missing match is not merely an exception count; it is value whose location or finality is uncertain.

Failure modes have temporal signatures

Most settlement failures first appear as a disagreement about time. A sender marks a file complete before the operator has completely received it. An internal timeout marks a transfer failed even though the rail accepted it. A provider reports a payout as sent while the receiving bank has not made funds available. A calendar service advances to the next weekday without applying the rail’s observed holiday.

Each failure changes exposure differently. A missed cutoff extends duration but may leave principal unchanged. Premature credit shortens the customer-visible wait by replacing it with the creditor’s counterparty exposure. A duplicate retry can double the cash movement while leaving only one commercial obligation. An unmatched finality event leaves the amount economically settled but operationally classified as outstanding.

The controls should follow those signatures. Submission needs an operator acknowledgement and a latest-safe-start time derived from tail latency, not merely evidence that a job ran. Retries need a stable instruction identity and a lookup before resubmission when the first outcome is unknown. Availability needs a separate event from interbank finality. Calendar evaluation needs a trace showing the source calendar, local timestamp, cutoff and resulting value date.

Around-the-clock rails add a different failure mode: settlement remains available while ordinary treasury staffing and funding routines are closed. FedNow transfers post as they are processed for daylight-overdraft measurement, and its service runs 24x7x365.47 TIPS also operates continuously and settles in central-bank money.16 Continuous technical availability therefore makes continuous liquidity visibility more important. A participant cannot assume that a weekend queue will wait harmlessly for Monday if the rail is settling each instruction now.

There is also a dangerous category of “successful” failure. The payment reaches finality on time, but a downstream ledger never consumes the confirmation. Cash has moved; the accounting state has not. Detection lag then becomes its own operational exposure because treasury may fund the same obligation twice or hold unnecessary liquidity. Recording both effective and observation times makes that lag measurable.

Operate the clock like a limit system

Once time is explicit, treasury can set limits that match the mechanism. Examples include maximum provider balance, maximum amount expected to cross a non-operating day, maximum unconfirmed principal after a cutoff, minimum prefunding before an instant-payment weekend and maximum exposure to one settlement bank during a currency overlap gap.

Alerts should fire before boundaries, not only after failures. The useful question at 4:30 p.m. is not whether the 4:45 ACH deadline has been missed. It is whether the remaining queue, observed throughput and tail latency make complete receipt by 4:45 improbable. The useful question before a three-day weekend is not whether payouts are late. It is how much value will remain at each counterparty until the next bank opening.

Limits should distinguish an expected rollover from an exception. A payment intentionally scheduled for the next business day consumes forecast liquidity; a same-day payment that unexpectedly rolls consumes forecast error capacity as well. That distinction prevents a normal future-dated batch from drowning out the smaller set of instructions whose timing has actually deteriorated.

Stress scenarios should change clocks as well as amounts. Delay the largest provider’s payout by one business day. Remove the last intraday window. Apply disjoint holidays to the two legs of an FX flow. Assume an acknowledgement arrives but the finality event does not. The Federal Reserve’s own framework controls intraday exposure with caps, collateral, monitoring, and the ability to reject or delay transactions that exceed capacity.7 The broader lesson is that timed exposure needs limits and resources, not just retrospective reporting.

The settlement clock is therefore a compact risk model already hiding in operational data. Cutoffs create discontinuities. Calendars extend maturities. Provider schedules allocate unsecured balances. System overlap determines cross-border gaps. Finality marks when one kind of exposure actually ends. Put those facts into the ledger, and “when will the money arrive?” becomes a set of measurable questions: how much is at risk, to whom, until when, under which rule, and what happens if the next clock tick does not come.

Sources

1. 3D Secure: your guide to safer transactions — Visa — https://corporate.visa.com/en/solutions/visa-protect/insights/3d-secure.html (opens in a new tab)
2. Mastercard Switching explained — Mastercard — https://www.mastercard.com/eea/switching-services/our-technology/transaction.html (opens in a new tab)
3. Principles for Financial Market Infrastructures — CPSS-IOSCO, Bank for International Settlements — https://www.bis.org/cpmi/publ/d101a.pdf (opens in a new tab)
4. FedNow Service Operating Procedures, Version 2.0 — Federal Reserve Financial Services — https://www.frbservices.org/binaries/content/assets/crsocms/resources/rules-regulations/0624-fednow-service-operating-procedures-redline.pdf (opens in a new tab)
5. RTP Operating Rules — The Clearing House — https://www.theclearinghouse.org/-/media/New/TCH/Documents/Payment-Systems/RTP_Operating_Rules_June-16-2025.pdf (opens in a new tab)
6. FedACH Processing Schedule — Federal Reserve Financial Services — https://www.frbservices.org/resources/resource-centers/same-day-ach/fedach-processing-schedule.html (opens in a new tab)
7. Federal Reserve Intraday Credit Policies — Board of Governors of the Federal Reserve System — https://www.federalreserve.gov/frrs/regulations/ii-federal-reserve-intraday-credit-policies.htm (opens in a new tab)
8. Receive payouts — Stripe Documentation — https://docs.stripe.com/payouts (opens in a new tab)
9. Effect of Holiday on Clearings — Board of Governors of the Federal Reserve System — https://www.federalreserve.gov/aboutthefed/chapter-6-reporting-requirements.htm#subsection-60.52 (opens in a new tab)
10. Fedwire Funds Services — Board of Governors of the Federal Reserve System — https://www.federalreserve.gov/paymentsystems/fedfunds_about.htm (opens in a new tab)
11. Getting paid: payout cut-off times — Adyen Docs — https://docs.adyen.com/payouts/payout-service/getting-paid (opens in a new tab)
12. Extending and aligning payment system operating hours for cross-border payments — CPMI, Bank for International Settlements — https://www.bis.org/cpmi/publ/d203.htm (opens in a new tab)
13. Settlement risk in foreign exchange transactions — Committee on Payment and Settlement Systems, Bank for International Settlements — https://www.bis.org/cpmi/publ/d17.pdf (opens in a new tab)
14. The next-generation monetary and financial system — Bank for International Settlements — https://www.bis.org/publ/arpdf/ar2025e3.htm (opens in a new tab)
15. SWIFT gpi data indicate drivers of fast cross-border payments — CPMI, Bank for International Settlements — https://www.bis.org/cpmi/publ/swift_gpi.htm (opens in a new tab)
16. What is TIPS? — European Central Bank — https://www.ecb.europa.eu/paym/target/tips/html/index.en.html (opens in a new tab)