What Is Positive Pay and How It Protects Business Accounts

What Is Positive Pay?

Positive Pay banking: basic idea

So, what is positive pay in practical terms? A matching service. Businesses send banks lists of issued payments; banks check every presented item against that list before funds leave the account. Matching items clear under normal account rules; mismatches wait as exceptions until authorized staff review them.

Guidance from the Office of the Comptroller of the Currency (OCC), Check Fraud: A Guide to Avoiding Losses, describes the arrangement as a joint effort between company and bank to catch checks the company never wrote. Banks compare presented checks with customer issue files and may reject items failing agreed criteria.

Why businesses turn to Positive Pay

Timing is everything. Reconciliation finds fraud after money has gone; Positive Pay aims to catch suspicious items while return remains possible. Benefits are largest for companies with several authorized payers, multiple operating accounts or steady vendor payments.

Current data backs this effort. In its 2026 Risk Officer Report, Federal Reserve Financial Services surveyed more than 400 risk professionals in Q4 2025. Of polled financial institutions, 63% had seen check fraud attempts in the past 12 months; ACH fraud and account takeover were also flagged as ongoing concerns. Corporate figures look similar: the 2026 AFP Payments Fraud and Control Survey reported attempted or actual payments fraud at 76% of US organizations in 2025, with 58% saying checks were targeted.

How Does Positive Pay Work?

How does positive pay work day to day? Three stages make up each cycle: businesses submit payment data, banks match presented items, and businesses decide on exceptions.

Step 1: Sending payment data to your bank

Each cycle begins when a business issues checks or schedules payments. Delivery varies by bank: issue files arrive through online banking, treasury-management portals, file uploads or direct links from accounting or ERP software. For check products, files usually hold check number, amount, issue date and, for payee-matching services, payee name.

Formats and required fields differ between institutions. Some providers offer APIs too, letting companies pull exceptions and send pay-or-return decisions straight from internal systems.

Step 2: Matching and flagging exceptions

Presented items get compared with records already on file. Different amounts, unknown check numbers, unexpected dates or changed payees can each create exceptions.

Compared fields depend on product: standard matching covers number and amount, while Payee Positive Pay adds name checks. Some banks also let clients set dollar thresholds or extra rules.

Step 3: Reviewing exceptions and deciding

Each exception lands in a review queue. Authorized users check details and instruct banks to pay or return items, normally before same-day cut-offs. Internal process matters as much as technology here. Who watches the queue? Who can approve? What happens when that person is on leave?

Account terms contain one detail deserving close reading: default decisions. Some banks return unanswered exceptions automatically; others pay them; some let clients choose defaults at setup. Businesses should know which rule applies before the first exception arrives.

Positive Pay Fraud Prevention: What It Covers and What It Misses

How this control stops altered and counterfeit checks

Positive pay fraud prevention works by placing a verification step between payment issue and payment clearing. Counterfeit checks, washed checks with new amounts and stolen checks with rewritten payees usually carry data differing from company records. Instead of clearing quietly, such items trigger exceptions.

Payee Positive Pay closes one common gap: genuine checks with untouched numbers and amounts but altered payee lines after theft from the mail.

Why deposit agreements make this a legal question

In US commercial banking, the service also affects loss allocation. Under UCC § 4-401(a), as adopted by states, banks may charge customer accounts only for properly payable items. UCC § 4-103(a) lets banks and customers vary those rules by agreement, though banks cannot disclaim duties of good faith and ordinary care. Many business deposit agreements use that freedom, stating that customers declining offered fraud-prevention services accept losses such services would probably have prevented.

Courts have enforced such clauses. In Cincinnati Insurance Co. v. Wachovia Bank, No. 08-CV-2734 (D. Minn. July 14, 2010), a snack food company had not implemented Positive Pay, though its bank offered it. One company check, for $153,856.46, was later stolen and altered. Summary judgment went to the bank: under the deposit agreement, the customer bore the loss. Practical lesson: read fraud-prevention clauses before declining any service, and keep a written record of that decision.

Where protection stops

This service is narrow by design. It will not prevent phishing, stolen online-banking credentials, business email compromise (BEC), social engineering or fraudulent wires approved by employees in good faith. Accounts that never issue checks or receive ACH debits gain little.

Companies therefore pair it with multi-factor authentication, role-based permissions, dual payment approval, ACH debit blocks and filters, call-back checks on changed vendor bank details, staff training and daily reconciliation. Each control addresses different risks; the right mix depends on how a business pays and gets paid.

Types of Positive Pay Services

Check Positive Pay

Check Positive Pay is the original form of this service. Banks compare check numbers, amounts and often issue dates with company issue files. It suits businesses writing checks regularly.

Payee Positive Pay

This version adds payee names to compared fields. It fits companies mailing checks to many vendors, where theft in transit and rewritten payee lines are main risks.

ACH Positive Pay

ACH Positive Pay applies the same logic to electronic debits. Companies list originators authorized to debit accounts and, depending on bank, set amount caps; anything outside those rules is held for review. Value peaks on accounts debited electronically by vendors, lenders or tax authorities. Many banks sell it alongside ACH debit blocks, which reject all debits, and filters, which allow listed ones only.

ACH rules themselves have tightened. Under Nacha fraud monitoring rules, phased in on March 20 and June 19, 2026, non-consumer originators, ODFIs, third-party service providers and RDFIs must run risk-based monitoring, aiming to identify unauthorized entries or entries authorized under false pretenses. ACH Positive Pay covers debits posted to company accounts, not payments originated by them. It therefore complements those duties rather than satisfying them.

Features differ by provider, so businesses should confirm compared fields and exception handling before choosing.

Positive Pay Cost: What Banks Charge

Common pricing models

No standard positive pay cost exists. Each bank sets its own price based on account type, item volume and selected features. Typical structures include monthly service fees, per-item or per-exception charges and separate fees for payee matching or ACH filters. Some business account packages bundle basic fraud tools at no extra charge.

Ask for current fee schedules and full service terms. Eligibility, supported payment types, cut-off times and integration options vary widely between institutions.

Is Positive Pay worth the cost?

Answers depend on exposure. Companies writing a handful of checks yearly face different math from those issuing hundreds monthly across several accounts. Weigh fees against three factors: likely size of a single fraudulent item, staff time needed to clear daily exceptions and loss-allocation terms in the deposit agreement. That last factor often decides the question, because declining the service may leave the whole loss with the business.

How to Set Up Positive Pay for a Business Account

A short checklist covers most implementations:

1. Map payment profile: checks, ACH debits, account count and payment-generating systems.

2. Confirm offered products and fields each compares.

3. Review service terms: matching criteria, daily cut-off, default decisions on unreviewed items and liability clauses.

4. Assign roles: who uploads issue files, who receives alerts and who may approve or return items. Separate duties where staff numbers allow.

5. Name a backup reviewer and document procedures in writing.

6. Connect service to accounting or ERP software, or through an API where supported.

7. Run a pilot period; review exception volumes after month one.

For international technology companies, including SaaS, FinTech and e-commerce businesses, payment controls should also fit wider corporate and banking structures. When a group expands abroad, company incorporation, the choice of bank account, available tax advantages and VAT/VIES registration must all align with actual money flows.

Frequently Asked Questions

Is Positive Pay required by law?

No US statute requires businesses to use it. However, banks may make it a condition of certain accounts; deposit agreements can shift losses to customers who decline it, as the Wachovia decision shows.

What happens if an exception is not reviewed before the cut-off?

Banks apply their default decisions. Depending on provider and chosen options, items are either returned or paid automatically, so service terms should state defaults clearly.

Does Positive Pay cover ACH payments?

ACH Positive Pay reviews debits others post to your account. It does not check outgoing ACH credits or wires, which need separate controls such as dual approval and beneficiary verification.

Can small businesses use Positive Pay?

Many banks offer it on small business accounts, sometimes within a treasury-management bundle. Eligibility and pricing vary, so ask your bank which accounts qualify.

Final Thoughts

Positive Pay banking rests on a simple mechanism: compare, flag, decide. It gives businesses visibility over outgoing payments at the point where fraud can still be stopped, while also shaping loss allocation under deposit agreements. It is not a full security framework, though; it works best alongside access controls, payment verification and regular reconciliation.

For technology-driven companies operating across jurisdictions, banking controls should also match legal and operational group structure. Icon.partners supports international businesses with cross-border legal structuring and compliance, helping coordinate corporate, banking and regulatory requirements.