Payment approval flows for finance teams

Why finance teams need payment approval flows

Most payment losses aren't sophisticated. They happen because one person could instruct and release a payment on their own, and on that day something went wrong. An approval flow means no single person can move money out of the business unchecked.

Segregation of duties

The person who prepares a payment shouldn't be the only person who releases it. Splitting the two is a basic internal control, and auditors, investors and banks expect to see it. It protects the business, and it protects the people who handle payments, because no one carries a decision alone.

Fraud

• Payment diversion. A supplier's email account is compromised, or a lookalike address is used, and an invoice arrives with “updated” bank details. The payment goes out to the fraudster's account and the real supplier is still owed.
• Impersonation. A message or call that appears to come from a director or senior manager asks for an urgent, confidential transfer. The pressure is the point: it is designed to skip the usual checks.

A second approver who sees the payment before release, and who isn't under the same pressure, is one of the most effective defences against both.

Mistakes

Wrong amount, wrong currency, wrong beneficiary, the same invoice paid twice. Errors like these are far cheaper to catch before release than to recover afterwards, especially on cross-border payments.

What Sentvia provides

• Approval controls on outgoing payments. You define the approval flows and the policies they enforce.
• Real-time review before release. Approvers review the transaction in real time, and funds are released only once the flow is complete.
• More than one approval where you need it. A payment can require several approvals, for example 2 of 2, before it is released.
• Approved beneficiaries. Third-party payments go only to beneficiaries reviewed by our compliance team with supporting documents. After that review, payments to them are routine.
• Access protection. Biometric verification when the account is created, and two-factor authentication on access.
• Monitoring and screening. Real-time monitoring runs on every transaction, and every payment is screened.

These controls apply to outgoing payments made through the Sentvia platform, including payments from a named IBAN account in your company's name.

How a controlled payment moves from instruction to release

1. The beneficiary is approved. Before the first payment to a new third party, our compliance team reviews the beneficiary with supporting documents. This happens once.
2. Someone instructs the payment. They sign in with two-factor authentication and set out the amount, currency and beneficiary.
3. Your approval flow runs. The payment waits for the approvals your policy requires, one or several.
4. Approvers review it in real time. Each sees the payment before the funds move, and it isn't released until the required approvals are in.
5. Screening and monitoring. The payment is screened, and real-time monitoring applies to it as to every transaction.
6. The funds are released and the payment goes out on its rail.
7. The payment is recorded in your transaction history, on the web and in the Sentvia Pay app.

Our payments page covers what happens after release: the rails, timing by currency, and the record each conversion leaves.

Designing an approval policy

The controls are only as good as the rules you set. The points below are general good practice for any business that sends payments, not a description of Sentvia features.

• Separate preparing from approving. Whoever enters a payment shouldn't be its final approver.
• Scale approvals to risk. Routine, low-value payments to long-standing suppliers may need one approval; large or unusual payments should need two or more.
• Treat new beneficiaries and changed bank details as high risk. Confirm any change by calling a number you already hold, never one given in the email that asked for the change.
• Slow down when someone says it is urgent. Urgency and secrecy are the two levers in impersonation fraud. A policy that says “no exceptions for urgency” protects approvers from being pressured.
• Approve what you can see. Check the beneficiary, amount and currency against the invoice or contract, not just the summary.
• Plan for absence. Name enough approvers that holidays and sick days don't push people into bypassing the policy.
• Review the policy. Revisit thresholds and approvers when the business, its payment volumes or its staff change, and at least once a year.

Where approvals fit among other safeguards

Approvals guard what leaves your account. Screening guards what comes in: every incoming stablecoin payment is screened before it is converted, and our guide to stablecoin AML screening explains what that check looks for. For the full set of layers, from access to where funds are held, see how Sentvia protects your account, and for our registrations and day-to-day checks, compliance and regulation.

The guidance on designing an approval policy is general information, not legal or audit advice.