Use one checklist for each requested supplier bank-account or beneficiary change. Accounts payable opens the record and identifies affected payments. Procurement helps confirm the supplier’s contact route. An authorised finance approver decides whether to change the supplier record, and a payment approver separately authorises the specific payment.

If a suspicious payment has already been sent, call your bank immediately using a trusted number and ask what recovery action it can take. Alert your incident lead in parallel. Fill in the incident record after taking those steps. FBI recovery advice

Agree the roles and approval authority under your finance policy before using this checklist. Keep originals in the approved case or finance system. Use evidence references and masked account identifiers in this form. Mark each check Verified, Concern, Unknown, or Not applicable with a reason. A blank check is Unknown. Add the verifier and time to each entry.

Put the affected activity on hold

Identify the payment stage from the finance system and bank or payment provider. Assign someone who can confirm the hold at each relevant stage. If submission is unclear, trace it immediately. Move to the incident steps if there is reason to suspect a diversion and funds may already have gone.

What to record Entry or evidence reference
Case ID, supplier legal entity and internal supplier ID ____________________
Original request reference, channel and receipt time with time zone ____________________
Requested change, effective date and masked old and proposed destinations ____________________
Affected invoices, amounts, currencies and due dates ____________________
Payment stage and evidence for each affected item or batch ____________________
Hold owner, systems or batches covered, and time confirmed ____________________

Verify the instruction and approve the record change

Initiate a callback using a previously verified or independently established number. Check any recent change to that contact record. Establish who can confirm payment instructions for the supplier. Compare complete details in the approved finance system and keep a masked reference here. A bank name check can help identify a discrepancy. Keep the supplier’s independent confirmation as a separate check.

What to record Entry or evidence reference
Trusted contact record, origin and how any recent change was corroborated ____________________
Verifier, supplier contact role and authority, callback time and outcome ____________________
Comparison of beneficiary, full destination, effective date and invoice scope ____________________
Different beneficiary, if any, and evidence of entitlement such as an authorised assignment ____________________
Bank account-name check, any warning and resolution, or reason unavailable and completed alternative checks approved under policy ____________________
Independent record approver, authority, decision, reason, evidence and time ____________________

Approve the record change only after the affected activity is controlled and the applicable verification is complete. Keep it pending if a required check is unresolved. Refer supplier denial, conflicting instructions, an unexplained beneficiary or pressure to bypass checks to the finance owner and incident lead. Where policy permits a control exception, record the rule, approver, expiry and completed evidence that the substitute achieves the same objective. A deadline leaves the evidence requirement in place.

Check the saved record and the payment separately

After implementation, compare the saved destination and effective date with the approval. When the first affected payment is prepared, check its actual destination, including any batch or manual override. If anything differs, hold or cancel the instruction and check the corrected instruction again. If there is no payment due, record the payment check as pending and assign it to the payment approver.

What to record Entry or evidence reference
Saved change reference, comparison result, checker and time ____________________
First affected payment or batch reference, actual destination comparison and evidence ____________________
Payment decision (Held, Cancelled or Authorised for release), authority, reason and time ____________________
Unresolved check, next action, owner and deadline ____________________

If diversion is suspected

Follow your incident procedure. Ask the incident lead to coordinate finance and security, assess related changes and payments, preserve original records, and determine which notifications apply. Track confirmed recovery separately from the recovery request.

What to record Entry or evidence reference
Bank contact time, case reference, action requested and confirmed response ____________________
Incident lead, security notification, containment and related payments checked ____________________
Location of preserved messages, supplier records and payment evidence ____________________
Amount and currency sent, amount confirmed recovered, remaining exposure, owner and next update ____________________

Worked examples

These examples use fictional data.

Verified change and payment

Case PAY-14. Procurement uses established contact V-3. The supplier finance manager confirms the new destination and invoice 108. Finance records a bank name match, completed comparison C-14 and independent approval A-14. AP confirms hold H-14 on invoice 108. AP checks the saved record against A-14. Treasury matches batch P-19 to it and records separate release authorisation.

Supplier denies a submitted change

Case PAY-15. The established contact denies the request. The batch log shows the bank accepted the instruction. Treasury requests recovery under bank reference B-15 and confirms related batches are held. Security opens incident I-15. Recovery is pending and the original instruction stays in the case record.

The bank name check matches, but the contact route is missing

Case PAY-16. The only callback number came with the request. AP records the contact route as Unknown and keeps the supplier record and payment held. Procurement owns the search for an independently verified contact. The match remains supporting evidence and the release field remains Held.

Sources behind the workflow