Payment-change policy (template)

General information, not legal or financial advice. Adapt it to your business and have the owner approve the final wording.

1. Purpose

This policy says how we handle any request to change where a payment is sent. The aim is that money goes to the party we meant to pay.

2. Requests that must be verified

Every one of these must be verified before any payment uses the new details, however the request arrived (email, letter, portal message, phone, text):

• a new or changed bank account, routing number or payment address for an existing vendor;
• a change of the vendor's contact person, phone number or email, when it comes together with a payment change;
• a request to send a payment to a third party instead of the vendor;
• any request that presses for speed, secrecy, or skipping the usual steps.

3. How a request is verified

1. Do not use any phone number, email address or link that appears in the request.
2. Find the vendor's contact details that we recorded before this request, from a source the request's sender does not control (our contract, an earlier invoice, our own records).
3. Call that number. Use the call-back script.
4. Ask the vendor to read out the last four digits of the new account. Compare them with the request.
5. Record the result in the change-request log or in the ledger tool.
6. Only after steps 1 to 5 are complete may the new details be used.

4. Who approves

The person who entered the verification (the “verifier”) must not be the only person who approves the change. A second person named below approves every change of account details:

Verifier:   Second approver:   Backup approver:

5. If the check fails or cannot be completed

Do not pay to the new details. Keep paying the old details only if the vendor confirms them through the recorded channel. Record the attempt in the log. Tell the owner the same day.

6. Before each payment

Check that the account you are about to pay is the one that was last verified. If it differs, stop and go back to section 3.

7. Review

The owner reviews this policy and the log once a year, and after any incident.