Invoice Booking Errors AP Controls

Controls & Risk

When Invoice Booking Errors Increase: A Practical AP Control Plan

More duplicate payments and posting mistakes do not always mean an AP team needs more approvals. The first step is finding where the errors begin, then placing the right control at that point.

A recent discussion in the Accounts Payable Professionals Group raised a common concern: What should an AP department do when invoice booking mistakes suddenly increase?

The most effective answer is a combination of root cause analysis, preventive controls, automated checks, and focused human review. Adding another approval to every invoice may slow the process without fixing the real problem.

Key principle: Put the strongest control as close as possible to the point where the error begins. Use later reviews as a safety net, not as the primary defense.

1. Classify the errors before changing the process

Review a useful sample of recent errors and place each one into a clear category. Examples include duplicate invoice entry, incorrect vendor, wrong amount, tax error, incorrect purchase order, duplicate freight, missed credit memo, prepayment not applied, and invoice paid after a partial payment.

Record the cause, employee or processing queue, invoice source, vendor, business unit, entry method, and dollar impact. A Pareto chart can then rank the causes by frequency or financial impact. The familiar 80/20 rule is a guide, not a promise. The purpose is to identify the few causes creating most of the risk.

Also ask what changed before the error rate increased. Look for new employees, reduced staffing, rushed training, a system update, a changed interface mapping, a new invoice channel, OCR extraction problems, or a larger number of manual uploads. A technical error may begin with system configuration, process design, or unclear instructions rather than the person posting the invoice.

2. Strengthen duplicate detection

A duplicate check based only on the invoice number is too weak. Suppliers may add spaces, dashes, leading zeros, or different date formats. Configure the ERP or AP automation platform to compare several fields, such as supplier, invoice type, amount, currency, date, and invoice number.

Establish a consistent invoice-number entry rule and include it in training and desktop procedures. When the system permits, test normalization rules for nonmeaningful spaces, punctuation, and capitalization. Keep the multi-field comparison in place because consistent data entry alone cannot catch every duplicate.

This is consistent with current ERP functionality. Oracle documents a duplicate check using supplier, invoice type, amount, currency, and date. SAP also compares multiple invoice fields, including vendor, company code, currency, amount, reference number, and document date.

3. Match invoices before posting or payment

Use three-way matching for PO invoices whenever practical. The invoice should agree with the purchase order and the goods or services receipt. Set reasonable tolerance limits for price and quantity differences. Route exceptions to the right owner instead of allowing AP staff to force a match or repeatedly override warnings.

Non-PO invoices still need a clear business purpose, correct coding, proper approval, and supporting documentation. High-risk invoices, including large amounts, unusual vendors, manual payments, and invoices entered close to a payment run, may need additional review.

4. Separate entry, approval, and payment duties

One person should not control invoice entry, approval, vendor changes, and payment release. A maker-checker workflow is useful when the checker reviews meaningful evidence instead of simply clicking approve. The GAO Green Book emphasizes preventive controls and segregation of incompatible duties as important parts of an effective control system.

Smaller teams may not be able to separate every duty. In that case, use compensating controls, such as an independent payment-run review, bank-account reconciliation, audit-log review, or management review of high-risk transactions.

Review system access and configuration changes as part of the same control framework. Restrict who can change duplicate-check settings, approval rules, tolerance limits, interface mappings, and user roles. Test key controls after an ERP update or workflow change, and document the results before relying on the revised process.

5. Give prepayments and partial payments their own workflow

Prepayments and partial payments create special duplicate-payment risk. Track them in a dedicated prepayment account or ERP process, require supporting approval, and apply the balance to the final invoice before payment. Avoid informal workarounds, such as posting a negative pro forma invoice, unless accounting policy, system design, and the controller have specifically approved the method.

Vendor statements can help identify unapplied credits, missing invoices, and payments the supplier has not allocated correctly. Reconcile statements for high-value and high-volume suppliers before major payment runs, while recognizing that a supplier statement is a detective control and may not show a duplicate that exists only inside the buyer's system.

6. Review exceptions and measure whether controls work

Run prepayment exception reports for same-vendor, same-amount invoices, repeated bank accounts, invoices just below approval limits, unusual manual entries, and payments made outside the normal cycle. Review overridden duplicate warnings as a separate population.

Track errors per 1,000 invoices, duplicate warnings overridden, payment errors prevented, dollars recovered, and repeat errors by cause. Report the trend each month. If a control produces many false positives, adjust it carefully. If the same cause keeps returning, the corrective action has not worked.

Use targeted training and quality reviews instead of broad retraining when the data points to one failure. A short review of invoices from the affected queue can confirm whether the new procedure is being followed. Periodic audits can then test whether the control continues to operate as designed.

A practical 30-day response

1. Build an error log and review the last 60 to 90 days.
2. Use a Pareto chart to identify the leading causes.
3. Confirm duplicate-check settings and review all overrides.
4. Test PO matching, approval thresholds, and segregation of duties.
5. Create a controlled workflow for prepayments and partial payments.
6. Review system changes, access rights, training, and invoice-number procedures.
7. Measure the results and repeat the analysis after 30 days.

The bottom line

Strong AP controls combine people, process, and technology. Automation should stop likely errors and surface exceptions. AP professionals should investigate those exceptions, document decisions, and correct the process behind repeat failures. The goal is focused control that prevents the right mistakes before money leaves the organization without adding friction to every invoice.

Explore more from APPG: Controls & Risk  |  Internal Controls  |  AP Automation

Editorial Note: This article was developed with the assistance of artificial intelligence and reviewed and approved by Robert Ruhno, Executive Director of the Accounts Payable Professionals Group, and Mariann Ruhno, Chief Education Officer of the Accounts Payable Professionals Group.

APPG Leadership

Robert Ruhno

Executive Director

Robert leads APPG’s mission, editorial direction, member community, and efforts to advance the Accounts Payable profession.

Mariann Ruhno

Chief Education Officer

Mariann leads APPG’s education strategy, professional-development resources, and initiatives designed to help AP professionals strengthen their skills and careers.

Practical education, reporting, and community resources for Accounts Payable professionals.

LinkedIn X Facebook Instagram

Back to top ↑

Strong AP Controls Around the World

Controls & Risk

Strong AP Controls Look Surprisingly Similar Around the World

Regulations may differ from country to country, but the everyday controls that protect Accounts Payable remain remarkably consistent.

In the United States, SOX made control testing and documentation standard practice. The UK is moving toward the Provision 29 framework. Canada, India, China, South Africa, and many other countries have their own regulatory and governance frameworks that encourage similar behavior.

The AP Reality

The regulation may have a different name, but the controls AP teams perform every day often look very much the same.

The Daily Work Is Surprisingly Consistent

For Accounts Payable teams, many of the fundamental controls cross national borders.

• Invoices must be properly approved.
• Vendor master changes need controls.
• Payments require segregation of duties.
• Reconciliations need documented review.
• Exceptions must be investigated and resolved.

Whether you call it a SOX control or something else, the practice is largely the same, and it matters.

Automation Changes the Work, Not the Accountability

The tools are changing quickly. Automation and artificial intelligence can route approvals, flag unusual transactions, capture timestamps, maintain audit trails, and help identify exceptions before payments are released.

But technology does not remove accountability.

Good governance still depends on people making informed judgments, reviewing exceptions, questioning unusual activity, and understanding why controls exist in the first place.

That may be one of the most important lessons for AP teams as automation expands. Technology can perform more of the work, but responsibility for the integrity of the process still belongs to the organization and the people overseeing it.

Key Takeaway

No matter where you work, strong controls build trust. And trust is the foundation of every finance team.

Explore More From APPG

Controls & Risk  |  Internal Controls  |  AP Automation

Editorial Note: This article was developed with the assistance of artificial intelligence and reviewed and approved by Robert Ruhno, Executive Director of the Accounts Payable Professionals Group, and Mariann Ruhno, Chief Education Officer of the Accounts Payable Professionals Group.

APPG Leadership

Robert Ruhno

Executive Director

Robert leads APPG’s mission, editorial direction, member community, and efforts to advance the Accounts Payable profession.

Mariann Ruhno

Chief Education Officer

Mariann leads APPG’s education strategy, professional-development resources, and initiatives designed to help AP professionals strengthen their skills and careers.

Practical education, reporting, and community resources for Accounts Payable professionals.

LinkedIn X Facebook Instagram

Back to top ↑

5 AP Developments to watch in 2026

APPG • Accounts Payable Intelligence

Five Accounts Payable Developments AP Professionals Need to Watch in 2026

From mandatory e-invoicing and agentic AI to payment fraud and ISO 20022, major changes are reshaping how accounts payable teams process invoices, manage risk and protect company payments.

Updated August 2026 • Accounts Payable Professionals Group

THE AP BRIEF

Accounts payable is becoming more automated, connected and dependent on structured financial data. At the same time, fraud and control risks remain. AP professionals should understand five developments that could affect invoice processing, vendor management, payments, compliance and internal controls.

Accounts payable is changing quickly. Artificial intelligence is moving deeper into AP workflows. Governments are requiring structured electronic invoices. Fraud remains a major threat. Payment networks are changing how transaction data moves between organizations.

For AP professionals, these developments are more than technology news. They affect invoice processing, internal controls, vendor management, payments, compliance and the skills AP teams will need.

Here are five developments AP professionals should be watching.

1 France Is About to Make E-Invoicing a Reality

France will begin a major electronic invoicing reform on September 1, 2026.

By that date, companies covered by the reform must be able to receive electronic invoices. Large and mid-sized companies must also begin issuing electronic invoices. Small and micro-enterprises have until September 1, 2027 to meet the issuing requirement.

This is important because an electronic invoice is not simply a PDF sent by email. Structured invoice data allows systems to process information automatically.

For AP teams, this can change invoice intake, validation, tax handling, matching, exception management and archiving.

Why AP should care: AP departments with operations in France should make sure their ERP, vendors, invoice workflows and approved electronic invoicing platforms are ready. Even organizations outside France should watch this development because structured e-invoicing mandates continue to expand internationally.

2 AI Agents Are Moving Into Accounts Payable

AP automation has been around for years. The next stage is different.

Oracle Fusion Cloud's 26B release includes a Payables Agent focused on invoice ingestion, compliance and control. Oracle also has a Payments Agent connected with payment options, offers and execution.

This points toward a future in which AI does more than extract invoice data.

An AI agent may help complete tasks, identify exceptions, recommend actions and move transactions through a workflow.

How much authority should an AI agent have inside accounts payable?

AP leaders will need clear rules for segregation of duties, approvals, audit trails, vendor master changes, invoice exceptions and payment authorization.

Why AP should care: Automation and authority are not the same thing. Organizations need to determine which AP activities can become autonomous and which decisions still require human review or approval.

3 Business Email Compromise Remains a Serious Payment Threat

Fraud continues to be one of AP's greatest risks.

Business Email Compromise, commonly called BEC, is especially dangerous because criminals may impersonate executives, vendors or other trusted parties.

The goal is often simple: convince someone to send a legitimate payment to the wrong bank account.

Artificial intelligence can make these attacks more convincing by helping criminals create realistic messages and other deceptive communications.

AP departments should pay special attention to vendor banking changes, unusual payment requests, first-time payments, rush payments and changes in normal communication patterns.

Control reminder: Independent verification remains one of the strongest defenses. A request to change banking information should be verified using trusted contact information already on file rather than information supplied in the change request.

4 ISO 20022 Continues to Change Global Payments

ISO 20022 is changing how financial information moves through the global banking system.

Its structured format allows payment messages to contain richer and more consistent information. That can improve payment processing, reconciliation, investigations and automation.

Swift had previously planned to require its Stop and Recall process for payment cancellations beginning in November 2026. Swift has since moved the mandatory requirement to November 2027.

That revised timeline is important for AP and treasury teams planning their payment roadmaps.

The larger trend has not changed. Payment systems continue moving toward richer structured data and greater standardization.

Why AP should care: AP professionals handling international payments should understand how ISO 20022 can affect payment information, exceptions, recalls, reconciliation and communication with financial institutions.

5 E-Invoicing Is Moving Directly Into ERP Systems

E-invoicing is also becoming part of the ERP environment.

Microsoft Dynamics 365 Business Central introduced functionality supporting France's electronic invoicing requirements. The functionality supports structured formats and connections needed for electronic invoice processing.

This is an important signal.

E-invoicing, AP automation, tax compliance and ERP workflows are beginning to merge.

AP professionals may eventually spend less time entering invoice data and more time monitoring automated workflows, resolving exceptions, maintaining vendor data, reviewing controls and protecting payment integrity.

Why AP should care: The AP department of the future may not be measured mainly by how many invoices employees manually process. It may be measured by how effectively the team manages an automated financial process.

What Should AP Teams Be Watching?

Development	Primary AP Impact	What to Watch
France E-Invoicing	Invoice processing and compliance	September 1, 2026 implementation
Agentic AI	Automation and internal controls	Human versus AI authority
BEC Fraud	Vendor and payment security	Banking changes and payment exceptions
ISO 20022	Global payment processing	Structured payment data and exceptions
ERP E-Invoicing	Invoice workflow automation	ERP integration and data quality

AP Action List

AP leaders do not need to wait for these trends to fully mature. Teams can begin preparing now.

• Review upcoming e-invoicing requirements in countries where your organization operates.
• Ask ERP and AP automation vendors about structured e-invoice capabilities.
• Review segregation of duties before introducing agentic AI into AP workflows.
• Strengthen controls around vendor bank account changes.
• Require independent verification for unusual or high-risk payment instructions.
• Review how ISO 20022 may affect international payments and reconciliation.
• Track AP exceptions and risk prevention alongside traditional productivity metrics.

What AP Professionals Should Take Away

These five developments point in the same direction.

Accounts payable is becoming more automated, more connected and more dependent on structured data.

At the same time, fraud and control risks remain.

The strongest AP departments will therefore need both technology and controls.

Automation can handle more routine transactions. AP professionals can then focus their attention on exceptions, compliance, vendor risk, payment security, data quality and financial controls.

The future of AP is not simply touchless processing. It is intelligent automation backed by strong financial controls.

That is not the disappearance of accounts payable.

It is the evolution of the profession.

Sources & Further Reading

1. French Ministry of Economy and Finance: Electronic invoicing requirements and implementation timetable. Official French electronic invoicing guidance
2. Oracle: Oracle Fusion Cloud Financials 26B readiness information covering AI capabilities including Payables and Payments agents. Oracle Fusion Cloud Financials 26B
3. Federal Bureau of Investigation: Business Email Compromise and cyber-enabled financial fraud information. FBI cybercrime information
4. Swift: ISO 20022 migration and continued payments modernization. Swift ISO 20022 guidance
5. Microsoft: Dynamics 365 Business Central electronic invoicing functionality and French localization documentation. Microsoft Dynamics 365 Business Central

Editorial note: Regulatory requirements and technology release schedules can change. AP professionals should verify requirements that apply to their organization with appropriate tax, legal, banking and technology advisers.

↑ Back to top

How AP Teams Show Value Finance Leadership

AP Leadership & Career Development

How AP teams can make their contribution visible to finance leadership

Your team may prevent duplicate payments, stop fraud, protect supplier relationships, and keep the close moving. Finance leadership may still see only invoices processed. A simple reporting framework can change that.

Accounts Payable teams often create value by preventing bad outcomes. A duplicate invoice never gets paid. A suspicious bank change never becomes a fraud loss. A tax issue is corrected before filing. A supplier escalation is resolved before it disrupts operations.

The problem is that prevented losses are easy to overlook. Leadership sees the payment that went out, but not the payment your team stopped. It sees the month-end close, but not the exceptions resolved to keep it on schedule.

AP leaders should not expect finance executives to discover this contribution on their own. The team needs a consistent way to translate daily AP work into the outcomes finance leadership already cares about: cash, risk, controls, operational continuity, and decisions.

Core principle: Do not report only what AP processed. Report what AP protected, improved, resolved, and needs leadership to address.

Why traditional AP reporting falls short

Many AP reports focus on activity:

• Invoices processed
• Payments issued
• Open invoice count
• Average processing time
• Backlog volume

These numbers are useful, but they mostly show workload. They do not fully explain the team's financial contribution.

A leadership-ready AP report should answer five questions:

1. What money did AP protect or recover?
2. What risks did AP identify and contain?
3. How reliable is the process?
4. Where are business problems slowing AP down?
5. What decision or support is needed from leadership?

The AP contribution report

Use a one-page monthly report organized into five sections. Keep the detailed transaction backup available, but do not place it on the first page.

1. Financial value protected

This section converts exception handling into dollars.

Measure:

• Duplicate invoices prevented before payment
• Duplicate or incorrect payments recovered
• Pricing, quantity, freight, or tax discrepancies corrected
• Invalid late fees or penalties avoided
• Early-payment discounts captured
• Credits identified and applied
• Fraudulent or suspicious payment requests stopped

Report both the number of cases and the dollar value. Keep categories separate so leadership can see whether the result came from routine controls, recovery work, discounts, or fraud prevention.

Avoid claiming every rejected invoice as savings. Count an amount only when the team has reasonable evidence that the organization would otherwise have paid too much, lost cash, or missed a valid financial benefit.

2. Risk and control activity

Finance leadership responds to risk when AP makes it specific.

Measure:

• Vendor bank changes independently verified
• Suspicious requests escalated
• Segregation-of-duties conflicts identified
• Payments held because required approval was missing
• Vendor records blocked because documentation was incomplete
• Tax documentation exceptions
• Policy overrides and emergency payments

The purpose is not to make AP look alarmist. It is to show that the team is actively operating controls and to identify patterns that need management attention.

3. Process reliability

Leadership needs to know whether AP is stable, improving, or under strain.

Measure:

• Invoices received and processed
• Invoices processed within the agreed service level
• First-pass match or touchless-processing rate
• Exception rate
• Invoices awaiting business approval
• Average days waiting for approval
• Invoices past due because of internal delay
• Payment reissues, returns, and voids
• Close-related AP tasks completed on time

Volume should provide context, not dominate the report. A team that processed more invoices may still have had a difficult month if exceptions, approval delays, or payment failures increased.

4. Business friction

AP frequently sees problems that originate elsewhere. Purchase orders are created late. Approvers do not respond. Receiving is incomplete. Contracts do not match invoices. Suppliers send invoices to the wrong place.

Present these as business-process issues, not complaints.

Measure:

• Top causes of invoice exceptions
• Departments with the longest approval delays
• Suppliers creating the highest exception volume
• Non-PO invoices by department or spend category
• Recurring rush-payment requests
• Repeated missing-receipt or missing-approval issues

Focus on two or three trends that materially affect cost, risk, supplier service, or closing speed.

5. Decisions and support needed

This is the section many AP reports omit. It is also the section most likely to turn reporting into action.

End the report with no more than three requests. Each request should state the problem, its impact, and the decision needed.

Illustrative example:

Forty-two invoices totaling $318,000 remained unapproved for more than ten days at month-end. This increased supplier escalations and required manual accrual review. AP recommends a five-business-day approval standard with automatic escalation to department leadership.

Figures shown are for format only and do not represent APPG data or a specific company.

What the one-page report can look like

Illustrative example: The figures below demonstrate the reporting format and are not APPG benchmark data or results from a specific company.

Area	This month	Trend	Leadership takeaway
Cash protected	$84,600	Up from $51,200	Duplicate and pricing controls prevented avoidable payments.
Control activity	27 bank changes verified	Stable	One request was escalated and rejected after verification failed.
Service level	92% on time	Down from 96%	Approval delays, not AP processing time, drove the decline.
Business friction	118 invoices waiting over 5 days	Worsening	Three departments represent 71% of delayed approvals.
Decision needed	Approve a five-day invoice-approval standard and escalation process.

How to present the numbers

A useful executive report is brief, comparative, and decision-oriented.

Show the trend, not an isolated number

“Ninety-two percent processed on time” gives leadership limited context. “Ninety-two percent, down from 96 percent because approval wait time increased” explains what changed and why.

Separate AP performance from upstream delay

Report time in AP separately from time waiting on the business. This keeps the report fair and helps leadership address the correct process owner.

Connect the metric to a finance outcome

Explain why the number matters. Approval delays can affect cash forecasting, accrual accuracy, supplier relationships, discount capture, and employee time. Bank-change verification protects cash and supports the control environment.

Use examples without exposing unnecessary detail

One short example can make the report credible. Describe the control that worked and the financial exposure involved. Keep sensitive vendor, employee, and bank information out of the executive summary.

What finance leadership responds to

Controllers, CFOs, and other finance leaders generally respond to AP reporting when it helps them understand one or more of the following:

• Cash: money protected, recovered, delayed, or forecasted
• Risk: fraud exposure, control failures, policy overrides, and compliance concerns
• Close: issues affecting accruals, cutoff, reconciliations, or reporting deadlines
• Operations: supplier disruption, payment failures, process bottlenecks, and capacity
• Decisions: policies, staffing, systems, or management intervention required

Leadership is less likely to respond to a long list of AP tasks. It is more likely to respond when AP shows how those tasks affect enterprise priorities.

Build the report with the team

AP supervisors and managers do not need to collect every contribution personally. Create a simple exception log the team can update during normal work.

Suggested fields include:

• Date
• Issue category
• Short description
• Amount protected or recovered
• Control or action that identified the issue
• Business area involved
• Final outcome
• Whether leadership follow-up is needed

Review the log monthly. Validate the larger amounts, remove duplicates, and select the most meaningful trends for the executive report.

This process also helps senior specialists document achievements for performance reviews and career advancement. “Processed invoices” describes a duty. “Identified and prevented $145,000 in duplicate and incorrect payments while improving the on-time processing rate” demonstrates contribution.

Illustrative example: The amount above shows how to phrase a contribution statement and is not APPG data or a result from a specific company.

Common mistakes to avoid

• Reporting too many metrics. Use a small set tied to financial and operational outcomes.
• Overstating savings. Use documented, defensible amounts.
• Reporting activity without interpretation. Explain what changed and why it matters.
• Blaming other departments. Present process evidence and recommended action.
• Hiding bad news. A credible report includes deteriorating trends and corrective steps.
• Sending data without a request. State what leadership should decide, reinforce, or investigate.

A simple monthly reporting rhythm

1. During the month: Maintain the exception and contribution log.
2. At month-end: Validate financial amounts and operational metrics.
3. After close: Identify three important trends and one to three requested actions.
4. In the finance meeting: Present the one-page summary in five minutes or less.
5. Next month: Report whether the requested action occurred and what changed.

The takeaway

AP becomes more visible when it reports beyond transaction volume. Measure money protected, controls performed, process reliability, business friction, and decisions needed. Then present those results in the language of cash, risk, close, and operational continuity.

The goal is not to seek credit for every invoice corrected or every problem resolved. The goal is to give finance leadership an accurate view of how AP contributes, where the process is vulnerable, and what support will produce better results.

Make AP's value easier to report

APPG is developing a follow-up guide on building a practical monthly AP reporting cadence. Join the APPG newsletter to receive the guide and other resources for AP leaders and working professionals.

Get the next AP leadership guide

Editorial Note: This article was developed with the assistance of artificial intelligence and reviewed and approved by Robert Ruhno, Executive Director of the Accounts Payable Professionals Group and Mariann Ruhno, Chief Education Officer of the Accounts Payable Professionals Group.

APPG Leadership

Robert Ruhno

Executive Director

Robert leads APPG’s mission, editorial direction, member community, and efforts to advance the Accounts Payable profession.

Mariann Ruhno

Chief Education Officer

Mariann leads APPG’s education strategy, professional-development resources, and initiatives designed to help AP professionals strengthen their skills and careers.

Practical education, reporting, and community resources for Accounts Payable professionals.

LinkedIn X Facebook Instagram

Back to top ↑

NACHA Fraud Monitoring Deadline

Back to Home

AP News | Controls & Risk

The NACHA Deadline You Already Missed

A new rule changed how AP teams have to fight ACH payment fraud. It is already in effect. If your team sends or collects ACH payments, it may now apply to you, no matter how small your volume is.

By Robert Ruhno, Executive Director, Accounts Payable Professionals Group (APPG)
Last reviewed: July 9, 2026

Here is the part most accounts payable teams have not caught yet: a major NACHA fraud monitoring rule is now in effect for smaller-volume ACH participants too.

The formal effective date for NACHA's Phase 2 fraud monitoring rule was June 19, 2026. Because June 19 was a federal holiday, NACHA's summary of upcoming rule changes lists the operational date as June 22, 2026.

If your team has not built anything for it yet, you are behind. The good news is that catching up is doable, and this article walks through the issue in plain AP terms.

First, what is NACHA, and why should AP care?

NACHA writes the rules for the ACH Network. ACH stands for Automated Clearing House. It is the system that moves many electronic payments between U.S. bank accounts, including direct deposit, vendor payments, and bill pay.

A few terms you will see below:

• Originator: The party that starts a payment. If your company sends ACH payments, your company may be an originator.
• ODFI: Originating Depository Financial Institution. This is usually your bank, the one that pushes the payment into the ACH Network.
• RDFI: Receiving Depository Financial Institution. This is the receiving bank, such as the vendor's bank.
• Third-Party Sender (TPS) or Third-Party Service Provider (TPSP): A company that handles ACH activity on your behalf, such as a payment processor or AP automation provider.

If your team pays vendors or collects money by ACH, you are part of this risk environment. The new rule makes fraud monitoring harder to ignore.

What actually changed

The change is part of NACHA's larger Risk Management package. It rolled out in two phases.

Phase 1, March 20, 2026: Applied to all ODFIs, plus non-consumer Originators, Third-Party Senders, and Third-Party Service Providers whose 2023 ACH volume exceeded 6 million entries.

Phase 2, June 22, 2026: The volume threshold is gone. Now all other non-consumer Originators, TPSPs, and TPSs must comply with the fraud monitoring rules, regardless of origination or transmission volume.

That second line is the one that catches teams off guard. Many AP departments assumed the rule was only for banks, giant processors, and high-volume ACH users. It is not that narrow anymore.

You can read NACHA's official Phase 2 rule summary here: NACHA Risk Management Topics, Fraud Monitoring Phase 2.

What the rule asks you to do

The rule does not hand AP teams one exact software tool or one exact checklist. Instead, it requires risk-based processes and procedures reasonably intended to identify ACH payments that may have been initiated because of fraud.

Two phrases matter:

• Risk-based means you put more effort where the risk is higher and less where it is lower. You do not have to treat a $50 payment the same way you treat a $500,000 payment.
• Technology-neutral means you choose the method. NACHA references approaches such as velocity checks, anomaly detection, pattern recognition, and behavioral tolerances.

In plain AP terms, you need a written, repeatable way to spot a payment that looks wrong before it goes out the door.

Meet false pretenses, the scam this rule is really about

NACHA added a named fraud type called false pretenses. This is a payment that appears authorized, but only because someone lied about who they were, what authority they had, or which account should receive the money.

For AP teams, the most familiar version is the vendor bank-change scam. A real supplier's payment details get swapped by an imposter. Everything looks normal, so the payment is approved, and the money lands in a criminal's account.

This is a form of credit-push fraud. The payer is tricked into pushing money out voluntarily. Your job now is to have a documented process that helps catch that lie before the payment is released.

The controls examiners will expect to see

You have some freedom in how you comply, but these are the controls your bank, auditors, and internal reviewers are likely to ask about:

1. Dual control. Two people, not one, should release higher-risk payments. A fraudster may fool one person. Fooling two is harder.
2. Account validation. Confirm that a vendor's bank account is real and open before you pay it, and re-check when the details change.
3. Out-of-band verification. When a vendor asks to change bank details, confirm it using contact information you already have on file, through a different channel. Call a known number. Do not use the phone number or email address included in the change request.
4. Multi-factor authentication. Require a second step beyond a password to access payment systems. An authentication app or physical token is usually stronger than a texted code.
5. Written procedures and review. You need documented procedures, not just good habits. Plan to review them at least once a year, and whenever your payment process changes.

The hard truth about who pays

This is the first time fraud monitoring obligations have been expanded this broadly to non-consumer ACH Originators and related third parties. Before this package, fraud detection requirements were more limited, such as certain WEB debits and Micro-Entries.

Here is the part that stings for AP teams: these rules do not automatically shift the loss to your bank when your company is tricked into sending money to a criminal. In many credit-push fraud situations, the payer may still bear the loss.

That is why the controls above are not just compliance work. They are practical loss-prevention work.

One more change to keep on your radar

The Same Day ACH limit is scheduled to increase from $1 million to $10 million per payment on September 17, 2027.

That change is not here yet, but AP teams should pay attention now. Bigger payments moving faster can be useful for cash management, invoice payments, payroll funding, and tax payments. It also raises the stakes because faster money is harder to recover if a fraudulent payment slips through.

NACHA's official Same Day ACH rule update is available here: Increasing the Same Day ACH Dollar Limit to $10 Million.

Your 10-minute gut check

Run through these questions with your AP, Treasury, and Finance teams this week:

• Do we send or collect any ACH payments?
• Do we have a written fraud-monitoring procedure?
• Does every vendor bank-change request get an out-of-band callback?
• Do two people release high-value or higher-risk payments?
• Do we validate new vendor bank accounts before the first payment?
• Do we re-check vendor bank accounts when payment details change?
• When did we last review these steps?

APPG takeaway: If your team cannot point to a real, written, risk-based ACH fraud monitoring process today, that is this week's project. Start with vendor bank-change callbacks. It is one of the cheapest controls to add, and it can stop one of the most expensive fraud losses AP teams face.

Bottom line

The deadline is not coming. It is here.

The rule does not expect perfection. It expects a real, documented, risk-based process. If your team cannot show one today, start with the highest-risk step first: vendor bank-account changes.

Call the vendor using known contact information already on file. Document the verification. Require a second person for higher-risk changes and higher-value releases. Then build the rest of your monitoring process around that foundation.

Official sources

• NACHA: Risk Management Topics, Fraud Monitoring Phase 2
• NACHA: Summary of Upcoming Rule Changes
• NACHA: Increasing the Same Day ACH Dollar Limit to $10 Million

Editorial Note: This article was developed with the assistance of artificial intelligence and edited, reviewed, and approved by Robert Ruhno, Executive Director of the Accounts Payable Professionals Group (APPG).

APPG Contributor

Robert Ruhno

Executive Director, Accounts Payable Professionals Group

Practical AP reporting, controls guidance, automation coverage, and career support for the accounts payable community.

Join the LinkedIn Group · X · Facebook · Instagram

Back to top ↑