Positive pay: definition and how it works in accounts payable

What it means

Positive pay is a bank service used to control checks and ACH debits at presentment. The company sends the bank a list of issued checks, or a list of approved ACH debits, and the bank compares each presented item against that list. If the check number, amount, payee or another agreed detail does not match, the bank creates an exception for the company to approve or reject. ACH positive pay is the debit side of the same service: the bank flags a debit that is not on the approved list or outside the agreed filters.

It targets altered or counterfeit checks and unauthorized debits. Payee positive pay also compares the payee name, which matters when the check number and amount are correct but the payee has been changed. It does not replace invoice matching or bank reconciliation; it is a bank-side control that depends on the accuracy of what AP sends.

Positive pay does not stop a genuine but duplicate payment that AP itself issued. If the duplicate check is in the issued file, the bank has no reason to flag it. That gap is why payment run review and the vendor record still matter. The service works alongside segregation of duties and careful handling of a stale-dated check, but each has its own control point. Banks set their own cutoff times, exception windows and liability terms, and these differ by country, bank and account agreement; follow your own agreement rather than assuming one rule.

How it works in practice

Before the bank cutoff, AP finalizes the payment run and produces the issued check file from the same run that creates the checks. Voids, reissues and manually created checks need to be reflected before the file goes out. For ACH, AP sends the approved debit list or confirms the filters the bank will use. A clerk should reconcile the issued file to the payment run, checking check numbers, amounts and payees, and confirm the bank has accepted the file. If the file is incomplete, the bank may flag valid items as exceptions or process items the company did not intend, depending on the agreement.

At the bank, each presented check or ACH debit is compared with the file. Typical exceptions include a check number not on the file, an amount that differs, a payee that differs under payee positive pay, a duplicate check number, or an ACH debit that is not approved or falls outside the filter. The bank presents those exceptions to the company through its agreed channel. AP researches each one, approves it only when it matches a valid obligation, and rejects it when it does not. The decision must be made inside the bank's exception window; missing that window can change what the bank does with the item.

The person who prepares the payment run and the issued file should not be the only person who approves positive pay exceptions. Segregation of duties matters here because an exception can be a legitimate vendor change or a fraud attempt. A controller or AP manager should review the evidence for payee name changes, new bank details and ACH debits that were not expected. For an ACH exception, contact the vendor through a known phone number or portal, not through contact details on the debit itself.

After the decision, AP should reconcile the bank's exception report back to the payment run and to the open item. A rejected check should be voided in the records before any reissue, so the original does not later clear as a duplicate. Approved exceptions should be noted with the reason, especially when the payee name or amount differs from the file. Positive pay does not post entries to the ledger; the accounting entries still come from the payment run and the bank reconciliation.

Where it goes wrong

A common failure is a mismatch between the payment run and the file sent to the bank. A check created outside the normal run, a void that was not removed, or a reissued check that was added without voiding the original can leave the bank with a file that does not describe what AP actually released. The bank may flag valid items, and a busy clerk may approve them in a batch without checking. The opposite also happens: an altered check clears because the issued file was never sent or was sent after the cutoff. Reconcile the file to the payment run before release, and review exceptions individually rather than clearing the queue.

Payee name problems are easy to miss. A vendor record may use a different name from the check payee, or a payee positive pay file may carry a punctuation variant. Clerks sometimes approve the mismatch because the amount and check number look right, which defeats the purpose of comparing the payee name. Check the vendor record and the supporting invoice before approving a payee exception. If the payee has genuinely changed, update the vendor record through the normal change process and keep evidence of the request.

ACH filters can be too broad or too narrow. A filter that allows a vendor to debit any amount or any account may let an unauthorized debit through, while a filter that is too tight creates false exceptions that get bulk-approved. Review ACH approvals when a vendor record changes and when a new debit authorization is added. Do not let the same person set the filter, approve the exception and reconcile the bank account without any independent review.

A genuine duplicate payment from AP is not a positive pay exception when it matches the issued file. The bank did its job, but AP issued the duplicate. Catch it in the payment run by reviewing duplicate invoice numbers, duplicate vendor references and repeated amounts before the file is sent. Stale-dated check handling is another pressure point; reissuing a stale-dated check without voiding the original can create a duplicate that positive pay will not stop.

What to check

Before each payment run is released, confirm the issued file is complete and matches the run. Check that voids are excluded, reissues are reflected and manual checks are included. Confirm the bank has accepted the file before the cutoff, and keep the acceptance confirmation with the payment run records. If the bank rejects the file, do not release the payment run until the file is corrected and accepted.

When the bank presents exceptions, check each item against the payment run, the vendor record and the supporting invoice. For a check, compare check number, amount, payee and date. For an ACH debit, confirm the debit authorization and the vendor's identity through a known contact route. Approve only with evidence; reject anything that cannot be tied to a valid obligation. Record who approved or rejected each exception and why, with a review trail that another person can follow.

Review the ACH approved list and filters when a vendor record changes, when bank details change and when a new authorization is added. Keep that review separate from exception approval. On the bank reconciliation, confirm that positive pay exceptions are cleared, rejected or carried forward with an owner. If an item is still unresolved, do not treat the bank balance as final without noting it. Because bank rules differ by country, bank and account agreement, check your own cutoff times, exception windows and liability terms. Company policy may also require a second approval for payee changes or ACH exceptions above a certain level; follow the policy that applies to your account.

Questions