This article is written by Nomentia
Most larger companies process hundreds, if not thousands, of outgoing payments every day. These payments are crucial for the business and must be handled accurately and punctually. Yet, as the number of payments increases, their management can become challenging. Particularly when dealing with tens or even hundreds of bank accounts. Oftentimes, treasury and finance teams have to deal with a layer of complexity when they need to improve payment processes. To protect themselves against payment errors, fraud, or making payments to sanctioned beneficiaries. Which often requires implementing payment security process controls and other security measures.
In this article, we’ll talk about why it’s critical to have secure payment processes in place. What threats could your organization be facing. And how treasury and finance can tackle payment security within their own scope of work. While keeping processes as efficient as possible. As a bonus, we’ll provide a fraud risk management framework that can make dealing with process improvements less overwhelming.
Financial scams are often directed towards treasury and finance teams, making these teams important stakeholders in payment security projects. In collaboration with IT and security professionals, they play a crucial role in ensuring payment security. Trustpair, SAP, and Accenture, payment did a survey that showed payment security is a top priority for finance and treasury professionals. With the increase in incidents of fraud and cyberattacks, companies can no longer ignore payment security. As a result, most teams are now actively reviewing their organizational processes to enhance safety. The survey also revealed that 56% of US-based companies fell prey to payment fraud in 2022.
IN 2022, 56% OF US COMPANIES HAD STILL FALLEN PREY TO PAYMENT FRAUD.
TREASURY & RISK SURVEY COMMISSIONED BY TRUSTPAIR & GIACT
The research study revealed that treasurers expect banks and system providers to take active role fighting against fraud attempts. To meet this growing demand, many advanced payment and TMS vendors have developed solutions to enhance payment security.
Even though some solutions provide the full suite of technical features for tackling payment errors, sanctions, and fraud. It is still important to differentiate between the security threats treasury and finance face because they require different approaches. Let’s consider some of the most common threats that can occur:
The question remains: what is really included in payment security from a treasury and finance perspective? And which threats can actually be fought by them? This can vary greatly, depending on the organization. The experience of teams, and the policies treasurers have established regarding security, among other factors. Different treasury professionals may have different opinions on what payment security entails. However, we have noticed some common themes that treasurers at our clients focus on from a technological standpoint:
Manual processes are susceptible to errors, particularly when they are performed repeatedly, leading to handler fatigue. This commonly results in erroneous payments through typos, outdated vendor master data, or mixing up beneficiaries, for example. These errors can be compounded over time. Resulting in time-consuming efforts to correct them, such as liaising with all involved stakeholders or seeking assistance from banks.
“MASTER DATA IS CRITICAL FOR PROCESS CONTINUITY. DATA ARE ASSETS, AND IF WE TALK ABOUT MASTER DATA, THAT IS REALLY A KEY ASSET, AND YOU NEED TO MANAGE MASTER DATA LIKE YOU MANAGE OTHER KEY ASSETS.”
MARK ROELANDS, RISK & COMPLIANCE CONSULTANT, GRC CONSULTING
An automated payment system, connected between your ERP and banks, can keep your master data automatically updated. And also, avoid outdated information. You can also avoid errors by setting up rule-based process controls. Or automated matching processes for reconciling financial records with bank statements. For larger single payment sums, double verification by a second person can be helpful in preventing errors.
To comply with regulations and ensure security, most companies must check their payments against unwanted beneficiary lists. This can be achieved by verifying payments against public lists like OFAC’s, EU’s, and other institutions. As well as private blocklists or allow lists. As world politics continue to shift, these lists keep evolving, and hence, they need to be updated regularly.
Manual sanctions screening, i.e., uploading and downloading spreadsheets against sanction databases,. Or manually searching lists each time a payment batch is processed, can take a lot of time. Therefore, our customers have found that sanctions screening is most suitable as an automated step of a payment process flow in a payments hub every time payments are executed.
Fraud is a recurring topic for many companies and is challenging to spot when hundreds of daily payments go out to various stakeholders. However, preventing fraud is critical, as the losses can affect cash flow and liquidity planning. Organizations must tackle multiple types of fraud, each requiring a slightly different approach.
Some of the most common frauds are wire transfer scams, phishing, and fake invoicing. On the one hand, most of these derive from human vulnerabilities; hence, you should educate employees to identify such fraud. On the other hand, intelligent payment technologies can recognize some of these irregularities as they stand out from ordinary payments. By scanning vendor master data automatically, for example. And, of course, larger payment sums should always be verified by several people. So that the financial loss is not too significant.
To avoid internal fraud, users should be given limited rights in payment processes. There should always be several people checking payments regularly. And the consequences of fraud should be made clear in Treasury policies to avoid any ambiguity.
Most companies we help have many local payment operations worldwide, where processes and systems can differ per location. This usually leads to a lack of transparency over processes and security, even the cash flow, on a group level.
In some cases, our customers want to centralize payments to a group-wide level. And have global processes enforced. In other cases, local entities still have more responsibilities. In most cases, companies want to use the same payment technology to tackle global payments, and the solution is rolled out country by country until all entities use the same system. A single system provides transparency into all payment-related cash flow, allows processes to be easily enforced, and allows users to be optimally managed. An additional benefit is that you can leverage payment technologies to streamline intercompany payments and payments in various currencies to minimize the associated costs.
One of the most crucial aspects of payment processing is controlling who can access your bank accounts or payment systems, how safe it are, and their rights to execute payments. Basic functionalities like multi-factor authentication (MFA) and single sign-on (SSO) are considered essential by treasury professionals to keep their data safe and prevent unwanted logins. Typically, we see that companies require this for logging into payment technologies, and sometimes verification codes are even used when executing larger payment batches or sums.
One excellent control mechanism for security is user management. Once your treasury and finance teams expand, with multiple entities and bank accounts, it becomes hard to have a bird’s-eye view of which users are managing what processes and what they should be allowed access to. Not to mention all the new joiners and people quitting the organization, which needs to be kept track of. Without central user management, it can quickly become overwhelming and time-consuming.
That’s the reason why most companies look at tools for central user management, even integrated with HR systems, to keep track of newcomers and leavers. A TMS, for example, allows admin users to easily assign roles or user rights to specific teams or individuals without giving them too few or too many permissions. For instance, group treasury can set permissions so that a local entity can access its own cash flows and execute local payments, but cannot access the data or payments of other entities or groups.
“TO ENSURE SAFE PRACTICES, THE PRINCIPLE OF LEAST PRIVILEGE IS A GOOD RULE OF THUMB: NEVER GIVE MORE RIGHTS TO PEOPLE IN THE SYSTEM THAN THE TASKS THEY ARE ACTUALLY PERFORMING ACCORDING TO THEIR ROLE.”
TAPANI OKSALA, HEAD OF PARTNERS, NOMENTIA
On top of that, there’s often a demand by the treasury and finance for audit trails. This means that organizations can see exactly what users do in systems in case something goes wrong (incidentally or on purpose) and review the logs afterward. This helps while planning any follow-up actions.
A simple yet efficient way to ensure that something isn’t wrong with a payment or payment batch is by including 4 or 6 eye principles into a payment process, for example, when a payment is about to be made. This way, a second or even third pair of eyes must verify the details of the payments being made to ensure they are correct. In payment hubs, you can set rules for when these principles should be applied, and the second reviewer will automatically receive a notification once their attention is requested.
Treasury and finance departments have a lot of tasks and processes to manage simultaneously. It can be hard to determine where their attention is needed most urgently. However, when attention is required, it is usually quite urgent. The same goes for payment security – if there is an issue, it is important that the relevant person be notified immediately. Although banks can notify users when there is a problem with a payment, this is only after the payment has been processed. Payment technologies can automatically identify almost any step in the payment process that requires attention and send notifications to the right user based on different sets of rules. This eliminates the need for emails to be sent back and forth between colleagues and other stakeholders. And if a payment somehow slips through, a hub can be integrated with the bank to ensure that the bank’s feedback is shown.
One of the most effective ways to prevent payment errors and fraud is by reconciling transactions with bank statements or invoices to ensure that all payments match payables. This is especially important when dealing with a large number of suppliers and payments. By using a system that can connect to your banks and ERP system, you can make sure that all necessary payment data is accurate and not missed. Such setups will greatly reduce errors related to manually going through each invoice and settling them.
However, payment security involves more than just technical solutions that are mentioned above. Other important topics that our partners and clients usually address include:
A big challenge for many companies is that fraud, errors, or scams start with an email or message to an employee via different channels. One important way to tackle this is to train employees, not just in treasury but in all teams, to identify scams. Most organizations do so through security awareness training that is usually initiated by IT and Security teams. Suppose something unwanted happens anyway; it’s best to have the proper incident response procedures in place to tackle it immediately.
“SAFE AND SECURE CULTURE IS NOT BEING CREATED BY STORING PDF DOCUMENTS WITH INSTRUCTIONS ON A SHAREPOINT, IT NEEDS FOLLOW-UP AND TRAINING. ALSO, THE COMPANY CULTURE NEEDS TO BE FOSTERED IN SUCH A WAY THAT PEOPLE FEEL COMFORTABLE STEPPING FORWARD AND POINT OUT THINGS THAT AREN’T IN ORDER.”
MARK ROELANDS, RISK & COMPLIANCE CONSULTANT, GRC CONSULTING
One way to influence your payment security is by establishing the right payment-related policies that can be enforced company-wide. If they are easy to understand and can easily be followed without making processes inefficient, they can help ensure more secure practices.
Your invoice and vendor authenticity are important to maintain the integrity of your payables. One way to avoid fraud, especially with invoicing scams posing a threat to organizations, is to ascertain that your invoicing procedures allow you to identify fraud quickly. Irregular payments, such as those outside of approved countries, to new bank accounts, or irregular amounts, should always raise suspicion and be verified. In addition, you should encourage your team to ensure safety by cross-referencing vendor information when irregularities occur.
Incorporating these technical layers into the payment process is critical to efficient security against threats. On top of all technical security implementations, the human risk element should be tackled, which is sometimes an even bigger challenge as cyber threats and other scams continue to evolve and keep getting more challenging to identify for employees. Careful employee guidance and training should be a great first step in tackling that.
While facing the dual demands of optimizing payment processes cost-effectively and keeping security measures to mitigate financial losses from fraud and cybercrime efficient, organizations can find an effective solution in a payment factory. It’s an approach that offers a combination of automation and process security, tackling both challenges simultaneously.
Still, it can be daunting for some to initiate implementing a new system, such as a payment hub, to address payment security concerns. Therefore, we advise to begin by examining your current processes and identifying areas that can be improved. If you discover that your current methods can only scale to a certain extent, it may be worthwhile to investigate the various technologies available on the market.
As your treasury and finance organization continues to work with payment security, it usually keeps identifying additional improvements. When dealing with multiple treasury processes, it can be difficult to determine which ones to focus on first. To simplify matters, you can follow a process framework like the fraud risk management cycle developed by the European Court of Auditors (ECA). It shows the need for establishing the right processes and policies, and running risk assessments, after which the right controls can be developed to improve your current processes. As it is a continuous process, the process repeats itself constantly.
In addition, we always recommend you spar with your payment system to improve processes, be it a bank, ERP, TMS, or payment hub. Most of them have the necessary tools to help you fight payment threats better and more efficiently.
By Alexander von Schirmeister,
CEO at Nomentia
A bank portal still works. The ERP still produces data. A spreadsheet still calculates a forecast. A payment approval workflow still moves from one person to the next. Reports still reach the CFO, even if they arrive later than expected. From the outside, treasury appears to function. Inside the process, finance teams know exactly how much effort is required to keep that appearance of control intact.
Modern treasury cannot rely on disconnected systems because the questions it needs to answer are no longer isolated. Cash visibility depends on bank data, account structures, ERP information, payments in progress, forecast inputs, intercompany flows, financing activities, and exposures. Liquidity planning depends on operational data from the business, but also on treasury assumptions, market conditions, working capital movements, and funding plans. Risk management depends on reliable exposure data, but also on trade execution, hedge documentation, limits, reporting, and accounting. If each part of this picture sits in a different place, the treasury team becomes the integration layer.
That integration work rarely surfaces. It lives in copy-and-paste routines, manual file checks, email reminders, reconciliation notes, spreadsheet tabs, and individual memory. It is also where most treasury management challenges quietly begin.
Disconnected systems create time loss because data has to be gathered before it can be analysed. They create duplicated work because teams maintain local trackers even when central tools exist. They weaken cash visibility because the latest view may depend on which bank file has arrived or which entity has responded. They weaken controls because exceptions are harder to identify when workflows are not connected.
The CFO does not usually see the process friction. The CFO sees the answer. If the answer is late, inconsistent, or hard to explain, confidence falls. Senior leadership needs reliable responses to simple but high-stakes questions: How much liquidity is available? Which cash flows are expected? Where is working capital tied up? Are internal payments efficient? Which exposures are material? Are guarantees, hedges, and commitments under control? These questions cannot be answered well when the data behind them has to be rebuilt every time.
The 2026 Nomentia Treasury and Cash Management report highlights that many treasury teams are in a transitional phase. They have moved beyond purely manual treasury, but still rely on multiple systems and partial automation. The pattern is familiar: the organisation has invested in technology, yet treasury still spends too much time reconciling information and validating reports. The issue is not that systems are missing. The issue is that they are not connected enough to support the pace of decision-making.
Disconnected systems are especially risky in three areas.
The first is visibility. If cash positions, transactions, forecasts, and payment statuses are not consolidated, treasury may see parts of the picture but miss the direction of movement. A balance report can show where cash is today, but it does not explain whether the position is temporary, restricted, exposed, or needed elsewhere in the group. Visibility without context can create false comfort.
The second is control. Treasury policies often look clear on paper, but control depends on how processes actually run. Who can approve a payment? Which entities have followed the forecast process? Which exposures have been validated? Which guarantee is close to expiry? Which hedge relationship needs attention? When workflows are disconnected, control becomes dependent on manual follow-up. That may work when volumes are low, but it becomes unreliable as banks, entities, instruments, and reporting expectations increase.
The third is decision speed. In volatile markets, delayed answers are not neutral. A late forecast can affect funding decisions. A delayed exposure view can affect hedge timing. A slow payment status check can affect supplier confidence. A late view of guarantees or credit line usage can affect working capital decisions. Treasury does not need real-time data for every decision, but it does need enough connected information to avoid making decisions with yesterday’s understanding.
A modern treasury management system should not be judged only by feature breadth. The more important question is how well it reduces the gaps between systems, data, workflow, and reporting. A strong setup connects bank information, ERP data, payment processes, cash forecasting, risk workflows, analytics, and audit trails into a reliable operating model. That does not mean every company needs every module at once. It means the architecture should support growth without forcing the team to rebuild its processes every time complexity increases.
Most people researching a TMS today will start with a web search or ask Copilot, Gemini, or ChatGPT. The answer they get back is usually a feature list. That’s not wrong, but it’s incomplete. A good treasury management system helps finance teams centralise cash, payments, forecasting, risk, controls, and reporting so they can make better liquidity and financial risk decisions with trusted data. Features are how it gets there. That’s the distinction worth keeping in mind when evaluating whether your current setup is still fit for purpose.
The path away from disconnected systems does not always require a large replacement project. In many organisations, the better approach is to identify the most painful manual bridges first. Where does treasury re-enter data? Where does the team wait for local input? Where do reports need manual explanation? Where are approvals outside the system? Where is the same number calculated in different ways? These questions show where fragmentation is creating the most business risk.
Connected systems create reliable answers. They reduce the manual work behind cash visibility, improve the quality of cash flow forecasting, and support stronger controls and compliance. They help the CFO understand not only what the numbers are, but what they mean for liquidity, risk, and action. Disconnected systems may still function. But they make treasury work harder than it should, and confident decisions harder than they need to be.
Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.
This article is written by TreasuryCube
In an increasingly complex financial environment, In-House Banks (IHBs) have emerged as a strategic imperative for corporations seeking enhanced cash visibility, optimized liquidity, and streamlined intercompany transactions. Drawing insights from a recent presentation by experts at Citi and seasoned treasurers, let’s explore what makes an IHB not just an option, but a cornerstone of modern treasury management.
An IHB is a centralized internal financial entity that manages cash, investments, foreign exchange exposures, and intercompany lending on behalf of corporate subsidiaries. Acting as a “virtual bank” for the organization, it reduces the volume of external banking transactions and provides critical advantages in cash management, governance, and compliance.
Importantly, an IHB is not a regional treasury center, shared service center, re-invoicing hub, or physical licensed bank. It’s a bespoke solution that integrates deeply with corporate finance operations.
An IHB addresses several core challenges that treasurers face:
Real-world IHB implementations, like those led by Brook Ballard at Oceaneering, showcase the tangible benefits:
Intercompany netting further reduces payment transactions, bank fees, and FX costs by consolidating cross-border intercompany settlements.
While beneficial for many, IHBs are particularly advantageous for:
At TreasuryCube, we recognize that the modern treasury is not just about managing cash, it’s about unlocking strategic value. An effective IHB is a critical tool to help achieve that vision, especially when supported by integrated technology, skilled people, and proactive governance.
Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.
This article is written by our partner, FIS
The reality of payment fraud has shifted from a question of whether an attack will occur to a growing likelihood of when and how it will occur.
For finance and treasury leaders, the strategies that provided a sense of security a few years ago may be insufficient against a new breed of sophisticated and relentless criminals. A 2024 survey from the Association for Financial Professionals underscored this reality, revealing that a staggering 79% of organizations were victims of payment fraud attacks or attempts.
This is not a distant risk: It’s an active, daily threat that demands a fundamental change in an institution’s defensive posture. The traditional, reactive approach – detecting and responding to fraud after it occurs – is, in many cases, no longer a viable strategy. The time has come to build a proactive defense.
Today’s fraudsters are often not lone actors but organized, well-funded operations that use advanced technology and psychological tactics. They study organizational structures, identify process gaps and exploit the path of least resistance.
Business email compromise remains a dominant method, where criminals impersonate executives or vendors with alarming authenticity to redirect funds. We’re also seeing the rise of AI-powered deep fakes, where a trusted voice on a conference call can be convincingly spoofed to authorize a fraudulent transfer.
These criminals understand that the entire payment lifecycle, from the initial onboarding of a vendor to the final reconciliation, presents a landscape of opportunity. They target the seams in your processes, exploiting the very human desire for efficiency and speed. This “disharmony,” a term coined by a FIS® and Oxford Economics study, captures the friction between the drive for growth and the drag of persistent security threats.
According to the study, 75% of C-suite executives identify fraud as a critical challenge.
How can organizations overcome the evolving threat of fraud? The answer lies in shifting from a fragmented, manual and reactive stance to an integrated, automated and proactive one.
A truly effective defense begins by fortifying the most common entry points. The vendor master file, for instance, is the heart of the payables process and a prime target. A single fraudulent change to a supplier’s bank details can lead to catastrophic losses before anyone realizes an error has occurred.
Overcoming this type of threat typically requires more than just diligence: It often demands a standardized, technology-enforced process. It includes implementing out-of-band verification, such as a phone call to a preverified contact, for any change to payment instructions. It means moving beyond trust and implementing strict, automated validation protocols.
As transaction volumes grow, manual reviews can become an impossible bottleneck, creating the very noise that criminals use to hide their illicit activities. This is where modern solutions like AI-assisted anomaly detection become increasingly indispensable.
Unlike static, rule-based systems that can only catch what they are programmed to look for, AI and machine learning establish a baseline of “normal” payment behavior for each vendor and transaction type. These systems operate in real time, analyzing payments for subtle deviations in amount, frequency or timing that would be difficult for the human eye to detect. When an anomaly is detected, the payment is automatically flagged for investigation before it leaves the organization. This preemptive capability is a game changer.
Organizations can achieve a greater level of control by consolidating their payment flows through a centralized payment hub. Instead of managing disparate security protocols across multiple ERPs and bank portals, a payment hub provides a more unified point of visibility and control.
A payment hub enables the consistent application of security policies, approval workflows and fraud detection analytics across the entire enterprise. It standardizes an institution’s defense, creating a fortress rather than a series of disconnected fences. A payment hub integrated with a third-party account validation service provides another critical layer, confirming that a beneficiary’s name matches their account information before a payment is ever initiated.
Reduce fraud risk and strengthen controls with FIS Payment Hub – Enterprise Edition
The path forward for finance and treasury leaders requires a strategic pivot. It means recognizing that fraud prevention is not merely a compliance checkbox but a strategic enabler of business resilience and growth.
Building a proactive defense involves a holistic approach that integrates advanced technology, standardized processes and a culture of vigilant verification. By embracing AI-driven monitoring, centralizing payment operations and empowering employees with specialized training, you can transform your security posture from reactive to preemptive.
This shift does not just mitigate risk: It builds the confidence and operational integrity necessary to thrive in a complex financial world.
Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.
