How to keep your money safe and secure

This article is from our partner, Ebury

We want our clients to stay on top of current Fraud & Security trends to help keep your money safe; that’s why we’d like to share some tips to avoid scams, guide you through the detection, prevention and recovery stages and on how to comply with the Data Protection Regulation.

Cryptocurrency Scams

Investment scams have always been on our radar, from property investment scams to pyramid schemes, but the new scam of choice for 2021 seems to be cryptocurrency schemes. With cryptocurrency being one of the newer concepts when it comes to investment, fraudsters are provided with an opportunity to exploit this knowledge gap in consumers. These cryptocurrency schemes are convincing, with some even using fake celebrity endorsements. The schemes prompt potential investors to fill in a contact form, which is followed up with a telephone call from the scammer encouraging the investor to set up a cryptocurrency wallet. During this process, the scammer installs remote access software onto the investor’s device. Over time, the victim is encouraged to invest increasingly large amounts until the scammer finally empties the wallet and flees. With these particular scams, the warning signs include the unrealistic promise of big profits or ‘get rich quick’ advertising and the corporate names that these scammers masquerade under will not be registered with the FCA. It is also important to note that a legitimate investment in cryptocurrency would always involve a digital wallet that only the account holder can access – if someone else can directly control it, alarm bells should be raised.

Be Aware: Electronic Goods Scam

We have recently become aware of a successful scam doing the rounds internationally. A scam company called ‘Infinity Electronic’, ‘Infinity Element’ or ‘Ocean Components’ claims to sell electronic goods. It takes payments from international customers to bank accounts in a variety of names, located in Hong Kong. The goods promised are never sent, and by the time the victims realise, the company’s website is down and can no longer be contacted. Should you fall victim to a scam of this kind, we recommend reporting it to local law enforcement or your local fraud reporting agency. If the payment has been processed via Ebury, let us know at fraud@ebury.com.

How to spot APP Fraud

To avoid falling victim to scams, or any form of APP fraud, follow these tips:

New Suppliers

  • Check the web presence of new suppliers – if they have a website, how old is it and is it well maintained?
  • Do a quick Google search of the new supplier’s name to check if there is any nefarious information reported online
  • Search for legitimate online reviews of new suppliers before you commit to a purchase
  • Ask yourself – is the deal this new supplier is offering too good to be true?
  • Are the bank details of the new supplier located in the same country as the supplier?

Existing Suppliers

  • When you receive an email from an existing supplier, make sure it is coming from the same email address you
  • usually communicate with
  • Check incoming emails for signs of email spoofing – fraudsters may set up email addresses that mimic your supplier’s email address
  • If an existing supplier expresses undue urgency for payment or changes their bank details last minute – confirm the request on a trusted telephone number
  • If a supplier’s bank details change to a bank account located in a different country – check if this change is genuine on a trusted telephone number
  • Check payment invoices for signs of alteration or discrepancies in spelling or format

Compromised Email Accounts – Detection, Prevention and Recovery

Securing communication via email has become essential for every organization. Here at Ebury, we take email security very seriously and aim to protect our employees from social engineering techniques such as phishing. Attackers are now favouring simpler phishing attacks harvesting user credentials, as opposed to more sophisticated attacks involving malware. User credentials can allow an attacker access to an email account and, consequently, to sensitive information that the attacker can use to dupe their victims. Be suspicious if you receive emails asking you to verify your account or enter login details. These emails may redirect you to spoofed websites that can capture your credentials. Do not get scared by urgent requests – instead, go directly to the correspondent website and access it from there to verify your account status. We are aware that detection can be challenging. Bigger organisations such as Ebury rely on machine learning engines to detect compromised accounts and quickly activate an incident response plan. For smaller businesses, it is critical to read your emails with care, check the sender, analyse the language used and look out for unusual requests such as a change of bank details for a supplier. To make sure your own account has not been compromised, regularly check for any forwarding rules or email filters in your email settings. Detection is important, but we would also like you to become familiar with some prevention measures that will help to keep your account safe. Always use complex, unique passwords and avoid using the same credentials across different systems, as this will leave you vulnerable to attackers. Always configure multi-factor authentication where available and, if possible, utilise security mechanisms to detect phishing attacks or potentially compromised accounts. If you think your email account has been compromised, please follow these email recovery steps:

  • Change the password on your email account and any account that shares this password
  • Check your email filters and forwarding rules to ensure that no suspicious rules have been created that could be diverting your emails
  • Make sure you verify your sent items. Attackers may have sent fraudulent emails to your contacts
  • Change the Security Questions in the email recovery section of your email account
  • If not already active, enable 2 Factor Authentication on your email account
  • If not already active, enable 2 Factor Authentication on your EBO account
  • Clean up your browser cookies and cache
  • Ensure that your device’s operating system is up to date – any outstanding updates will install the latest security fixes
  • Run anti-virus software on your device. Ideally, there should always be anti-virus software installed and up to date on your device
  • Communicate this incident to your contacts

Tips to help sole traders, small and medium-sized businesses in understanding and assist in complying with their data protection obligations

Ebury is committed to ensuring the security and protection of the personal information we collect and process to provide a consistent and compliant approach to data protection. The key principles we adhere to are;

  • Transparency in the use of personal data;
  • The lawful, fair and necessary processing of personal data ;
  • Ensuring the accuracy of personal data and removing it when no longer necessary;
  • Keeping data safe and secure and protecting the integrity and confidentiality

With this in mind, it is important to acknowledge that cybersecurity and, in turn, implementing good data protection and security practices is everyone’s responsibility. Cyberattacks don’t only happen to large corporations. Small businesses, groups and individuals have to protect their IT systems, too. Being your own boss is great, and there are many rewards; however, there are also many responsibilities in ensuring you protect the information that is important to you. Following these tips is a good starting point in protecting the information you work with;

Tip one: Know what data you have

Even if you don’t think you use or keep a lot of data, you still need to know what personal data you have, so make a quick list of it if you haven’t already.

More Info

Also take into consideration the data you have saved on smartphones, tablets or computers. This could be people’s names and contact details, email addresses or notes that you have made.

Tip two: Keeping personal data? Tell people what you do with it

If you are processing and storing personal information, you need to let people know what you’re doing with their data. The easiest way to do this is to have a privacy notice available, either in a hard copy or on your website (see Ebury’s Privacy Policy (UK))

More Info

People have a right to know what you’re doing with their personal data. Many small business owners use third-party suppliers to provide them with a ready-made privacy notice. If you choose this route over making your own, be aware that you still need to know what it says. Your privacy notice sets out your commitment to the individuals (e.g. customers/clients) who are trusting you with their personal data.

Tip three: Keep it safe

Where you are processing and storing personal data, you have to protect people’s data from getting lost or falling into the wrong hands. Data Security doesn’t have to cost the earth, but any business that wants to be trusted has to get it right. If you are using, storing or processing lots of data, and in particular personal/sensitive data, then you need to take some extra steps to keep it safe.

Practical Steps to keep your IT systems safe and secure:

  1. Backup your data. Create a backup copy of your data, and do this regularly. Store it somewhere other than your main workspace, if possible; Consider the use of a cloud service for electronic data. That way, if there is a break-in, fire or flood, you don’t lose anything.
  2. Use strong passwords. Make sure you, your staff, volunteers, and anyone else involved in your operations use strong passwords – including smartphones, laptops, tablets, email accounts and computers.
  3. Take care when working remotely. If you, or people you work with, do their work remotely, make sure the devices you use are as secure as the equipment you use in the office.
  4. Be wary of suspicious emails. Educate yourself and those working for you on how to spot suspicious emails. Checking for obvious signs such as bad grammar, requests for you to act urgently, and payment requests will help you avoid being caught out. If it looks suspicious, don’t trust it – and warn your staff not to either.
  5. Install anti-virus and malware protection. And keep it up to date
  6. Don’t leave paperwork or laptops unattended. Data breaches can occur when staff and volunteers leave paperwork or laptops unattended. This could be in the boot of a car, on a train, or at home. Make sure you take steps to protect the personal data you hold by being vigilant and storing it securely away when not in use.
  7. Making sure your Wi-Fi is secure. Using public Wi-Fi or an insecure connection could put your valuable information at risk, so you should make sure you always use a secure connection when connecting to the internet.
  8. Lock your screen when you’re away from your desk. And make sure those working with you do the same. Taking steps to lock your screen when you leave your desk is a simple thing to do, but it will prevent someone else from accessing your computer.
  9. Keep on top of who has access to what. You should consider and apply restrictions on who has access to your IT systems and buildings. Think about the principle of ‘need-to-know ’; the fewer people with access, the better. Make sure you limit IT access to people who work for you, where possible. If someone leaves your company, or if they’re absent for long periods of time, you may want to consider suspending their access to your systems.
  10. Don’t keep data for longer than you need it. Staying on top of what personal data you hold will save you time and resources. It will also help you with your data protection responsibilities. Only keep what you need, for as long as you need it.
  11. Dispose of old IT equipment and records securely. Before you get rid of them, make sure no personal data or anything sensitive and important to your business is left on personal computers, laptops, smartphones or any other devices. You could consider using deletion software, or hire a specialist to wipe the data.

Some other simple security controls could include:

  • Making sure all potential entry points (doors/windows) have locks and are working;
  • Never leave anything unattended in vehicles;
  • Separating your business email account from your personal email account, rather than using the same one; and
  • Being extra vigilant when sending or receiving emails – to help prevent sophisticated phishing attempts and scams.

Information Commissioner’s Office [Data Protection when it’s just you]

Also Read

Join our Treasury Community

Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.

Check our other blogs

This article is a contribution from our partner, Avollone

Agentic AI in KYC: Costs, ROI and Compliance Risks

Artificial intelligence is transforming how organizations manage Know Your Customer (KYC), Customer Due Diligence (CDD), sanctions screening and financial crime investigations. AI agents can review documents, extract information, prepare questionnaires and support risk assessments. For compliance teams dealing with growing workloads, the opportunity to reduce repetitive manual work is significant.

But as organizations move from experimenting with AI to relying on it for daily operations, another question is emerging: What happens when the cost of AI increases?

As Stacia Garr explores in her Harvard Business Review article, How to Respond to the Coming AI Cost Shock, the economics of enterprise AI are changing. For financial crime compliance teams, understanding those economics is becoming an important part of building sustainable AI-powered operations.

What Is Agentic AI in KYC and Financial Crime Compliance?

Agentic AI refers to artificial intelligence systems that can plan and execute multiple tasks toward a defined objective, using tools, information and predefined permissions. In KYC and financial crime compliance, AI agents can support document collection, information extraction, questionnaire completion, sanctions investigations and due diligence reviews. Unlike traditional automation, which follows fixed instructions, agentic systems can coordinate several steps within a workflow. However, their activities still require appropriate controls, validation and human oversight.

Why Could Agentic AI Become More Expensive?

Most organizations evaluate AI investments based on expected efficiency gains. If an AI system reduces the time required to complete a KYC request from an hour to 15 minutes, the potential productivity benefit is relatively easy to understand. But the cost of delivering that automation can be harder to predict.

Many AI services charge based on tokens, which represent units of information processed by a model. Costs can depend on the model used, the volume of information processed, the number of interactions and the complexity of the workflow. In her HBR article, Garr argues that enterprise AI adoption has benefited from software vendors absorbing substantial infrastructure and processing costs, creating expectations around inexpensive or included AI functionality. She warns:

“The era of artificial pricing is coming to an end.”

As vendors introduce or expand usage-based pricing, organizations may find that AI processing becomes a more significant variable operating expense. This is particularly relevant for financial crime compliance, where workload complexity can vary considerably. An AI agent handling a straightforward corporate KYC questionnaire may require relatively little processing. Another investigating a multinational ownership structure could need to examine hundreds of documents, identify connected entities and perform multiple rounds of analysis. The second workflow may consume substantially more computing resources.

How Do Token Costs Affect KYC Automation?

Token consumption is an important cost driver for many AI-powered compliance workflows. Consider two hypothetical KYC cases: The first involves a domestic company with a straightforward ownership structure, a small number of directors and readily available corporate documents. The second involves an international corporate group with multiple subsidiaries, complex beneficial ownership, documents in several languages and additional due diligence requirements.

Even if both cases are classified as KYC reviews, their AI processing requirements may be very different.

Agentic systems can also perform repeated reasoning steps, retrieve information and reprocess documents as they work toward completing a task.

Risk consultant Pedro Arevalo – who has deep expertise in risk, financial crime and fraud, including the application of AI, advanced analytics and technology to strengthen controls, improve decision-making and transform customer and operational processes – highlights this concern in his LinkedIn commentary on the potential AI cost shock for financial crime compliance operations, observing that documents, connected parties, ownership layers and transactions can materially increase token consumption. This creates a potential mismatch between the number of KYC cases completed and the computing resources required. For organizations planning AI adoption, measuring the average cost per completed case is therefore more useful than looking only at the price per million tokens.

How Should Compliance Teams Measure AI Return on Investment?

The return on investment from AI in KYC should reflect the full cost of completing a compliance process. This includes AI processing costs, software fees, implementation, human review, quality assurance and exception handling.

A practical approach is to compare the total cost of an AI-assisted workflow with the cost of completing the same work manually, while maintaining comparable quality and control standards. For example, an organization could assess how much time AI saves when preparing KYC responses, how often human reviewers need to correct its work and how frequently cases require additional investigation. As Garr explains:

“The key pricing elements are out of your control.”

Her point refers to the uncertainty surrounding interactions per agent, usage per request and unit pricing.

For compliance leaders, this implys that understanding AI return on investment requires monitoring both processing costs and the operational value delivered. The objective isn’t simply to maximize automation. There’s also a need to reduce the cost and effort of completing KYC accurately, with consistency and within acceptable risk parameters.

Why Is Human Oversight Still Essential in AI-Powered KYC?

AI can prepare information, identify inconsistencies and recommend next steps. But organizations still need people who understand the regulatory context and can exercise professional judgment. This becomes particularly important when cases involve complex ownership structures, sanctions exposure, politically exposed persons or enhanced due diligence.

There is also an operational resilience consideration. If an organization becomes heavily dependent on AI and subsequently faces a major price increase, provider outage or service disruption, it needs a practical way to maintain essential compliance operations. Garr highlights the risks of losing institutional knowledge when organizations replace employees with AI-driven processes. And Pedro Arevalo raises the same concern specifically for financial crime compliance, asking:

“If AI becomes too expensive, can humans absorb the work?”

This is a particularly relevant question for compliance teams, where experienced professionals may need years to develop expertise in financial crime risk assessment and investigations. Organizations should therefore retain sufficient internal expertise, document procedures and establish contingency arrangements. The most resilient model would combine AI efficiency with human accountability.

Can Different AI Models Help Control KYC Costs?

Many have pointed out that not every task requires the most advanced or expensive AI model, and this is certainly true for compliance. Extracting information from a standardized document, identifying missing questionnaire fields and preparing a simple summary may require different capabilities from analyzing complex ownership structures or evaluating ambiguous adverse media findings. So, organizations can potentially reduce costs by matching the model to the task. For example, simpler models may handle routine extraction and classification, while more capable models are reserved for complex analysis. Some organizations may also consider open-weight models for suitable tasks, although infrastructure, maintenance, security and validation costs still need to be included. Arevalo makes a similar recommendation, encouraging organizations to balance commercial and open models rather than relying on the most expensive LLM for every compliance task.

Some have considered the usage of lower-cost models. However, it needs to be weighed against their ability to meet the necessary standards for accuracy, reliability and data protection. Models that do not will fail at meeting both the economic and data requirements, causing more work and risk.

How Can Organizations Make Agentic AI Costs More Predictable?

Predictability starts with understanding how AI is actually being used. Compliance teams should establish baseline processing costs for common workflows, including KYC questionnaire completion, document extraction, ownership analysis and screening investigations. They should also monitor how costs change with case complexity and volume.

Vendor arrangements matter as well. Organizations should understand how usage is priced, whether there are consumption limits, how price changes are handled and what happens when demand exceeds forecasts.

Garr recommends incorporating AI consumption into broader organizational planning rather than treating it solely as a technology expense. Arevalo extends this argument to financial crime compliance, recommending that organizations:

“Plan capacity and budgets around headcount AND tokens.”

This recognizes that AI is becoming an operational resource alongside human expertise.

Organizations should also distinguish between purchasing AI infrastructure directly and using software that incorporates AI into its services. Customers may not be billed per token, but underlying AI economics can still influence pricing and service delivery.

What Does Sustainable AI-Powered KYC Look Like?

Sustainable AI adoption requires a balance between automation, cost control, governance and operational resilience. For KYC teams, one effective approach is to apply AI where it can eliminate repetitive administrative work while preserving human review for decisions that require judgment, and this is particularly relevant to information collection and KYC response management.

Fintech / Regtech saas software providers such as Avallone have AI-powered KYC capabilities uniquely designed to support activities such as preparing KYC responses, reusing previously validated information and coordinating tasks across the response process. For example, Avallone’s KYC Responder lets organizations reduce the effort involved in repeatedly answering similar requests from banks and other counterparties, and their KYC Collector supports structured information gathering, document management, screening and risk assessment workflows.

Centralizing information and reusing validated data can also reduce unnecessary duplication, although actual AI cost savings depend on system design and usage.

Balancing AI Efficiency with Economic Sustainability

There is no argument that agentic AI has considerable potential to improve KYC and financial crime compliance operations. But automation should not be measured solely by how many tasks an AI agent can complete or how much employee time it saves.

Organizations also need to understand processing costs, changing usage patterns, human oversight requirements and the financial implications of scaling AI across their operations.

The next stage of AI adoption in compliance will require organizations to think about capacity in two dimensions: people and computing resources so that KYC operations that remain efficient, reliable and financially sustainable as AI becomes part of everyday work.


Sources:

Stacia Garr, Harvard Business Review, “How to Respond to the Coming AI Cost Shock,” August 17, 2026. https://hbr.org/2026/08/how-to-respond-to-the-coming-ai-cost-shock

Pedro Arevalo, LinkedIn commentary on the potential AI cost shock for financial crime compliance operations, October 13, 2026. https://lnkd.in/p/etXbM6n2

OpenAI, “What Are Tokens and How to Count Them?” https://help.openai.com/en/articles/4936856-what-are-tokens-and-how-to-count-them

Have more KYC questions?

Avallone is here for you. Connect with one of our KYC professionals who can address your questions, concerns and needs.

Also Read

Join our Treasury Community

Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.

This article is a contribution from our content partner, TreasurySpring

AI agents could gradually change how corporate treasurers manage cash, reducing the inertia that keeps large balances in low-yielding bank accounts and putting pressure on banks’ deposit funding.

Torsten Slok, Apollo’s Chief Economist, put out a short note recently asking whether an agentic bank run is coming. He argues that AI assistants could soon start moving household cash automatically into accounts paying over 3%, rather than leaving it in US checking accounts paying 0.1% on average. If enough people did that, banks would lose a lot of the cheap funding they rely on to lend.

Although he’s talking about households, I think something similar could eventually happen in corporate treasury, although it might take longer. The balances are much bigger, most sit well above any deposit insurance limit, and moving them means treasury policies, approvals, and an audit trail. Nobody wants to explain to their board that an agent moved £20m somewhere it shouldn’t have.

When it does happen, though, I think the impact on banks could be much bigger too. I don’t necessarily mean a bank run in the traditional sense. More likely, it means gradually removing some of the inertia that keeps corporate cash sitting in low-yielding bank accounts today.

How big is the gap?

In July, the average rate on UK companies’ interest-bearing instant-access deposits was 1.97%. In the euro area it was 0.60%.

For context, central bank rates today are 3.75% in the UK and 2.50% in the euro area. They aren’t directly comparable with the rates available on corporate deposits, but they give a sense of the gap. A 178 basis point difference on £10m, for example, is equivalent to £178,000 a year.

For banks, this spread matters a lot. US banks’ net interest margin was 3.32% in the second quarter, according to the FDIC. In the UK, the Bank of England says aggregate net interest margins across the major banks increased year-on-year in the first quarter, with UK-focused banks benefiting from higher structural hedge income. Across European banks, net interest margins are around 1.6%. Cheap deposits aren’t the only thing driving those margins, but they’re clearly valuable to banks. 

None of this is because treasurers aren’t paying attention. Nearly half of the organisations in the AFP’s 2026 benchmarking survey have fewer than five people in treasury. Moving cash somewhere new usually means another onboarding and KYC process, plus internal approvals, and there’s nearly always something more pressing that week.

It’s also worth saying that rate isn’t the only reason companies keep money with their relationship banks. Balances often sit alongside an RCF, better FX pricing, or access to capital markets business, and those relationships have real value. My view is that most teams just don’t have the time to work out how much of their balance the relationship genuinely needs, what could sit somewhere else, and what leaving it there is costing them. That’s the kind of analysis an agent could eventually run every day. In combination with access to secured institutional-grade products, treasurers could have an opportunity to generate enhanced risk-adjusted returns on their cash. 

Why it will take time

AI adoption will take time. Andrej Karpathy describes current models as having jagged intelligence, and anyone who uses them regularly will recognise that. They can do something genuinely impressive and then get something simple wrong.

Our own AI in Treasury Report, a survey of 55 treasury professionals, found only about a quarter use AI regularly. Cash flow forecasting is where they most want help, chosen by 73%, yet more than three quarters say accuracy is their biggest concern. Only 4% want AI involved in executing transactions. For now, treasurers want AI that supports decisions rather than one that carries them out, which I think is a reasonable position to hold today.

It is changing quickly though, with many companies looking to address issues with existing AI models. One interesting example is TypeSafe AI, which released Jev in early access this month. It isn’t a chatbot. It’s designed to take in messy information and return structured decisions. TypeSafe says it gives more consistent answers than a large language model and tells you how confident it is in each one.

It’s early, and those claims will need to be proven in practice, but the direction is interesting for treasury. Deciding where surplus cash should sit this week given your policy, existing exposures, and today’s rates is exactly the sort of structured problem that these systems should eventually be able to help with.

The other thing that will set the pace is infrastructure. An agent can only act on cash if the places holding it can be reached programmatically, with the right permissions and controls. Most corporate banking infrastructure wasn’t designed with autonomous agents in mind. My feeling is that platforms built API-first will enable these workflows much sooner, and that’s where treasurers will see the benefit first.

So I don’t expect anything like Silicon Valley Bank, where more than $40bn left in a single day. What seems more likely is a gradual shift. As more of the analysis gets automated, some of the inertia disappears. Banks then come under steady pressure on deposit margins and either pay more for corporate balances or find other ways to hold on to them.

Chasing yield isn’t enough

If you ask an agent to find the highest rate, it will do exactly that, and that’s not a good enough objective for corporate cash.

An unsecured deposit is effectively a loan to the bank. At the end of 2022, around 94% of SVB’s deposits were uninsured. A well-designed agent should be weighing up the same things a good treasurer does. How likely is this counterparty to default? What would we recover if it did? Are we being paid enough for that risk? And does putting more money there leave us too concentrated?

At TreasurySpring, we look at every product on a risk-adjusted basis for this reason, rather than treating the headline yield as the only thing that matters.

This is where I think we are well placed. A single onboarding gives you access to more than 120 counterparties and 1,100+ Fixed-Term Funds (FTFs), so you aren’t limited to the banks you already have accounts with. Many of those FTFs are secured by collateral through repo.

More importantly in the context of agents, that information is increasingly machine-readable. Our MCP server lets AI assistants see available FTFs, current yields and your portfolio, while our API allows other systems to connect directly to the platform. This lets clients either plug that data into their own agent or, over time, use an intelligence layer built natively into the TreasurySpring Portal, with the products, the risk analysis, and their treasury policy all in one place.

For the time being, I’d still want a person signing off on anything material, with the agent doing the analysis and the treasurer making the decision.

But that alone could change quite a lot. If an agent can continuously look at a company’s cash, its treasury policy, its existing bank relationships, counterparty risk, and the alternatives available, it removes a lot of the work that means this analysis doesn’t happen as often as it could today.

I don’t think the corporate version of an agentic bank run will look much like a bank run. It’ll probably be much slower. But if AI gradually makes it easier for treasury teams to work out how much cash genuinely needs to stay with their relationship banks, where the rest could go, and what they’re giving up by leaving it there, the end result could still be significant.

*TreasurySpring’s blogs and commentaries are provided for general information purposes only, and do not constitute legal, investment or other advice.

Also Read

Join our Treasury Community

Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.

This article is a contribution from our content partner, PrimeTrade

I never would have thought, at the start of my emerging career as a trade banker, supply chain financier and potential “Master of the Universe” (per Tom Wolfe), that debit notes would be interesting, and that thirty years later I might be writing a blog about them.

But here we are!

It is quite a long post, but this is a topic that merits a detailed treatment, even if the subject matter is rather dry and somewhat technical.

Myths and realities

This post sets out five myths about invoices and debit notes.

These myths can lead to various confusions, complications and inefficiencies when it comes to supply chain finance.

The post aims to set out clearly how things normally work in the real world of general ledgers and corporate ERPs. It also digs into the implications for SCF and for the design of platforms that help suppliers to access supply chain finance.

There are generally three strategies used to deal with debit notes in supply chain finance – and these are covered in the final section.

With the right design and approach, debit note recovery can be automated and fully-optimised – no more spreadsheets, no more manual tracking, and no need to get suppliers to deduct debit notes from future invoices.

What is a debit note?

A debit note acts as the evidence in the buyer’s books for a reduction in its expenses.

So it is issued by the buyer’s accounts payable team to a supplier when the buyer seeks to pay less than it has been invoiced.

For supplier financing transactions (including SCF), a debit note can be an unwelcome event. If an invoice has been financed and even purchased by a financier, the financier typically relies on the invoice being paid in full.

Myth #1: invoices can be “approved” or not approved

What if I told you that “invoices always get approved”?

A valid invoice is one that is properly addressed, is from a recognised counterparty (ie: a supplier), has the right taxes on it shown in the right way, and which adds up correctly.

Valid invoices always get approved and there is a good reason.

This is a fundamental part of the way financial controls work. A valid invoice has been received representing a claim for payment from a supplier and it will be posted in full to the general ledger.

If this didn’t happen, we would get in a mess very quickly. Accounts payable teams cannot use their discretion and post valid invoices to the general ledger with whatever numbers on them they decide might be right.

Audits would be failed and financial controls would have broken down.

If the invoice from the supplier is for an amount that is too high (for whatever reason), a debit note is raised by the buyer so the supplier gets less money. The question is “what’s the debit note?” not how much of the invoice should be approved.

Some accounts payable teams will, alternatively, ask the supplier to raise a credit note and the invoice remains pending and not posted until the credit note is received. Here, for ease of explanation, we assume the debit note route is the one that the accounts payable team uses.

Myth #2: Payables are the same as invoices

In the ordinary course of business, accounts payable teams in corporate clients approve payments and not invoices.

A few key points:

  1. Valid invoices are posted to a supplier account in the general ledger at the full amount demanded by the supplier (see above). If debit notes are raised, they are also posted.
  2. The amount due to the supplier is the balance on the supplier account in the general ledger – equal to invoices posted less debit notes posted.
  3. When it comes to paying a supplier, it is the outstanding and due balance on the supplier account that is settled. The due balance is calculated by taking all the items posted to the supplier account that are due on or before the current date, summing them up and subtracting payments already made.
  4. The result is a payable amount – a figure that will be settled to the supplier, usually via a payment run. That figure may be made up of many individual transactions (invoices, debit notes and credit notes). The key approval step is at the time of the payment run.

This makes supply chain finance and supplier financing tricky – since bankers and lawyers like to think in terms of transactions rather than balances.

Bankers purchase invoices not balances.

Debit notes do not conveniently fit into this model.

Whilst the corporate client may be settling a balance that is due to a supplier (invoices less debit notes),

bankers want the invoices that they have purchased to be paid in full to them.

This is also one of the two main reasons why many corporate clients operate an all-or-nothing model with suppliers when it comes to supplier financing.

  • Reason 1: if all the supplier invoices are financed by the same bank, there’s no need to try and unpick a balance that has been settled and split it into individual invoices.
  • Reason 2: nothing to do with debit notes, so just mentioned here for completeness: most general ledgers cannot handle more than one account payee record per currency – so this one record gets changed from the supplier banking details to the financier banking details and then all the money due to the supplier simply goes to the financier. Again, this avoids the need to try and split the payment into the individual invoices involved.

These two reasons mean SCF programs can lose a lot of agility. There’s no easy way to move suppliers between financiers, and no easy way to have dynamic management of funding, switching suppliers between financiers whenever needed (even daily) to optimise the use of limits and mix in own treasury funds as a funding source.

Myth #3: debit notes are somehow “outside” SCF

I made a statement earlier about “valid invoices always being approved”.

The key question for the accounts payable team when they are deciding what the supplier might be owed is not how much of the invoice to approve.

The key question is: how big should the debit note be?

Yes, that’s right. The full amount of a valid invoice is always posted to the ledger but if there is a reason to pay less than the full amount, then a debit note needs to be raised.

The questions being answered by the accounts payable team reviewing purchase orders, delivery paperwork and the invoice (ie: the 3-way match) are (a) whether a debit note should be raised and (b) how much it should be for?

For example, the invoice face value is 100, but there is a shortage on the delivery of value 5. So that means the invoice of 100 is posted to the ledger, and a debit note of 5 is created and posted – and 95 is the balance on the supplier account, which is what will be settled in due course.

As stated above, the general ledger is an account-based (ie: balance-based) system.

The supplier account is credited with the full amount of the invoices and debited with debit notes to reach the correct amount that should be paid to the supplier when a payment run is operated.

So what is the bank buying when it provides supplier financing?

  • The amount due under the invoice (without set off, counterclaim etc), or
  • the amount payable in respect of the invoice at the time of purchase, which could include amounts that are already planned to be netted from the invoice payment.

Is it an “approved payable” (an invoice that is net of specified debit notes) or is it an “approved invoice” (due at face value without deduction)?

This is a key documentary point and one which might not always be clear in the paperwork used to support supply chain finance. On the one hand, the bank wants to buy invoices free and clear of any debit notes. On the other hand, the corporate client may well want the ability to net pre-existing debit notes (at the time of financing) against those invoices.

Is the IPU for the same amount as the invoice? What exactly is the claim that the bank is buying and relying on here – the invoice or the payable amount (at IPU creation-time) in relation to each invoice? If the supplier financing is documented on the basis that the bank is buying the IPU (and not the invoice) – query the accounting treatment and whether the arrangement might then become financial indebtedness in the books of the corporate obligor?

Myth #4: debit notes specifically relate to invoices

Debit notes “sort of” relate to invoices – but this is an artificial construct and not one that is required in the ordinary course of business.

Companies typically want to collect claims (debit notes) against suppliers immediately. Why wait?

Invoices are posted with a due date (in the future) that reflects when the amount claimed by the supplier should be paid.

Debit notes are often posted with an immedate due date.

That means debit notes are usually collected by set off against the next amount due to be paid to the supplier – ie: as soon as possible. There’s no waiting.

That would be the case even if the debit note might relate to a delivery where the invoice(s) for that delivery are not due to be paid for many days.

And debit notes may also arise that are wholly unconnected with individual deliveries – for example, where there are volume rebates or programme-wide discounts to be recovered.

As mentioned above, settlements clear the due portion of the balance outstanding on the supplier account.

The settlement is calculated by adding up all the transactions that are due and ignoring future-dated transactions. The debit note is always due immediately and is included as soon as possible in any payment that is made to the supplier. The invoice may be due in the future and has to wait.

The idea that this specific debit note goes with that specific invoice is typically a myth when it comes to the practical reality of payables and settlements.

Myth #5: we can ignore debit notes in SCF

Most platforms ignore debit notes. These are “someone else’s problem”.

That’s why many accounts payable teams don’t like supply chain finance and specifically prefer to limit the size and scope of programs to a handful of large suppliers.

And many SCF platforms ignore debit notes completely.

Corporate clients are expected to provide them with a nice and tidy file of “approved payables” which are guaranteed to be paid in full no matter what else may be going on.

This makes life easy for the platform and easy for the bankers and lawyers involved.

But this also makes life complicated for the corporate accounts payable team.

If clean “approved invoice” or “approved payable” files are to be provided to the SCF platform, this typically means that:

  • debit notes cannot be posted to the general ledger in the usual way
  • debit notes have to be tracked “off-system” with recovery of the debit notes handled away from the settlements and payments process.

This can mean that many clients end up failing to collect all the debit notes that they might claim, or end up having to track debit notes manually in excel and away from the general ledger. This all leads to extra work for everyone, compromising financial controls and adding costs and complexity.

Debit notes and SCF – are there solutions?

Yes – it requires a modern approach to the way that the supply chain finance platform is developed and operates.

There are three approaches:

  1. Manual: Corporate accounts payable teams handle the debit notes away from the SCF program with manual tracking and recovery. SCF program is then simple as it is fed with an “approved invoice” file and all invoices are simply settled at their face value. Debit notes are tracked in a spreadsheet and suppliers are required by procurement teams to deduct them manually from future invoices.
  2. Delay debit notes: The corporate accounts payable team runs two processes:
    • Debit notes are allocated to invoices before they are included in the file transmitted into the SCF platform; early payments to suppliers are then net of debit notes that were outstanding at that specific moment; and then
    • Those invoices that are in the SCF program are then ring-fenced from the further application of debit notes against them by the accounts payable team – so the SCF financier is not exposed to any netting and will be paid in full. This requires some careful management of posting processes and dates applied to debit notes in the ERP to ensure debit notes are not deducted from financed invoices. One way to do this is to post debit notes with future due dates to defer processing and delay their recovery, leading to earlier due invoices that are financed always being paid in full; this is a cost to the business though.

Also Read

Join our Treasury Community

Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.