Hook
On August 24, 2024, China's Payment and Clearing Association released the "Smart Payment Application Self-Discipline Convention." It landed with the weight of a founding document rather than a routine industry guideline. Reading through its clauses, I kept returning to a single realization: this is not merely a regulatory document about AI and payment; it is a map of how an entire industry will be allowed to breathe over the next decade.
Speed is not efficiency; it is a set of expectations. What this convention reveals is that the tempo of Chinese fintech—the relentless iteration, the rapid deployment—has reached a checkpoint. The question it poses is not whether AI will transform payments. That is a settled matter. The real question, embedded between the lines, is who gets to own the transformation, and who will be left to watch from the sidelines.
Code is law, but liquidity is breath. This convention is a lesson in how those two forces—the rigidity of code and the liquidity of innovation—must be negotiated when a technology as transformative as AI enters a system as critical as national payments.
Context: The Architecture of the Convention
The convention, issued by the China Payment and Clearing Association, is global in scope—the first of its kind specifically addressing AI applications in the payment sector. It establishes a principle that seems straightforward on its surface: core payment processes—account management, transaction processing, and settlement—must be conducted by licensed entities. AI applications in payment are not prohibited; rather, they are disciplined within a framework that anchors them to the existing licensing system.
What matters most is the regulatory philosophy. The convention is a "soft law" instrument, a self-discipline pact rather than a regulatory directive. It was drafted after consultation with member institutions, indicating that industry consensus was built before implementation. This is a distinctive Chinese approach to financial governance: build the framework first, observe the effects, then escalate to more rigid rules if needed.
The strategic positioning here is worth understanding: the convention serves as a bridge between the existing payment licensing regime—built over a decade to enforce "rectification of direct connections" and licensed operations—and the new world of AI-driven payments. It extends the old boundaries to new technology, establishing that AI cannot become a backdoor into core payment processes.
Core: The Quiet Architecture of AI Governance
The most consequential detail in this convention is what it does not explicitly state but implicitly mandates: the decoupling of AI systems from core payment infrastructure. Licensed entities are told they carry primary responsibility for information security, transaction safety, and fund security. This responsibility extends to AI applications—yet the convention deliberately avoids specifying technical standards for AI systems.
The silence is structured. Based on my audit experience across multiple financial institutions, I can say with confidence: this absence of specificity is not oversight but deliberate design. It creates what regulators call "responsibility lock"—the licensed institution bears full responsibility for AI model failures, even when technology is supplied by a third-party vendor. The AI can be an "unknown system" but the liability is entirely known.
This creates a specific architectural trajectory: institutions will move toward "dual-speed IT" structures. Core payment systems remain stable, hardened, and protected. AI applications operate in isolated service layers—AI risk control, intelligent customer service, compliance monitoring—separated from the critical path of settlement. The AI "middle platform" (AI中台) becomes the standard architecture, insulating the main payment rail from the unpredictability of machine learning.
The implications for the competitive landscape are significant. The convention's licensing requirement is effectively a moat. Non-licensed tech companies—even those with superior AI capabilities—cannot participate in core payment processes. They are pushed to the periphery: model training, data annotation, technical consulting. The licensed institutions retain the valuable parts: accounts, transactions, settlement.
But this creates an unexpected consequence: AI shifts from being a competitive differentiator to a compliance prerequisite. When everyone must have AI, AI becomes a baseline requirement. The competition then moves to AI governance—who can demonstrate the most transparent, auditable, and robust AI systems. The institutions with the strongest compliance infrastructure will earn a "trust premium" that becomes a self-reinforcing advantage.
The market concentration dynamics are equally important. Compliance costs—AI audits, model filing, liability traceability mechanisms—weigh disproportionately on smaller licensed institutions. For a small payment company, the cost of maintaining a governance framework is a significant burden. For Alipay or Tencent Pay, it is a rounding error. The prediction: the next 18 months will see a wave of consolidation among smaller payment institutions, either through acquisition or through relegation to regional agents of larger players. The marketplace will become more concentrated, and the convention will be the catalyst.
The regulatory intent here is subtle but sophisticated. This is not a crackdown on innovation. It is a deliberate attempt to manage the pace of AI adoption. The convention does not say "slow down." It says "if you want to go fast, go alone." The speed of AI in payments is now controlled by those who hold the licensed infrastructure.
Contrarian: The Dialectics of Self-Regulation
The convention is called "self-discipline," and this is the most dangerous word in the document.
Self-discipline—when is it a mechanism of genuine accountability, and when is it a protective shield against external regulation? In the Chinese financial context, the answer is both. The convention serves as a preemptive act by the industry: demonstrating the ability to regulate before the government imposes rigid rules. This "soft law" approach is often more effective than formal regulation, because it engages industry participants in the governance process and builds consensus from the ground up. But it also raises a critical question: what happens when self-discipline fails?
The history of Chinese fintech is full of examples of self-regulation followed by self-correction. The 2020 fintech regulatory reset. The 2021 shakeout of the sector. The pattern is clear: self-regulation is a probationary period, and failure leads to hard law.
The real vulnerability is in the AI-specific risks. The convention focuses on licensed operations, but the deepest risks of AI in payments are not about licensing—they are about the opacity of AI decision-making. If an AI risk-control model incorrectly freezes a legitimate transaction, or if an AI credit model discriminates against a specific demographic, the convention's "primary responsibility" clause will hold the licensed institution responsible. But the institution will not be able to explain the AI's reasoning. The burden of responsibility is now formalized, but the tools for meeting that burden are not.
This is the hidden gap in the convention. It establishes responsibility without establishing methodology. It is likely that the next 12 to 18 months will see the publication of supporting guidelines on algorithm filing, model auditing, and AI data governance. But until then, licensed institutions are navigating a landscape where the rules are clear but the map is incomplete.
Takeaway
The Chinese AI payment convention is a bridge—between the regulatory era of the past and the AI-native financial system of the future. The institutions that thrive will be those that treat AI governance not as a compliance cost but as a strategic asset. The "trust premium" will become a new form of capital.
Listening to the silence where value used to flow—the silence of the unlicensed innovators, the quiet of the marginalized models—is where the industry is heading. The next move is not in the code. The next move is in the construction of the governance framework that will determine who gets to shape the AI-driven economy.
As the global community watches, the question is not whether China's AI payment governance will work. The question is what it will inspire—and whether the rest of the world is prepared to learn from its design.