Compliance Evidence for Payments: What to Capture and Keep

Compliance evidence for a payment is the set of records that shows a payment was authorized, sent to the right party, and handled under your controls. A bank confirmation alone is not enough. You need to show who asked for the payment, who approved it, what you checked about the payee before money moved, and how the payment ties back to a contract or invoice. This guide lays out what to capture at each stage, how long to keep it, which U.S. rules shape the answer, and where payee verification fits.

TL;DR

• Proof that a payment was made is one record. Compliance evidence is the whole trail: request, approval, payee check, execution and posting.
• Capture evidence at three points: vendor onboarding, payment approval and payment release. Do not rebuild it at audit time.
• Keep records organized, in a safe place, and identifiable by payee, amount, date and purpose, as the IRS expects for business expenses.
• A timestamped payee name-to-account check taken before release is evidence that a bank confirmation cannot give you afterward.
• Missing controls and missing records are what regulators and prosecutors point to when payments go wrong.

Table of Contents

• What compliance evidence means for a payment
• Why auditors and regulators care
• The records an AP team should capture
• Proof of payment versus a reconciliation-ready record
• Where payee verification evidence fits
• Building evidence into the workflow
• Storing and retaining the evidence
• What happens when evidence is missing
• Run the check, keep the record
• FAQ
• Sources

What compliance evidence means for a payment

Two documents get confused all the time. Proof of payment shows that funds left your account: a wire confirmation, an ACH trace, a canceled check. Compliance evidence answers a bigger question: was this the right payment, to the right party, approved by the right people, under a documented process?

Think of it as a chain with five links:

1. The request. The invoice, purchase order, contract or vendor change request that started the payment.
2. The validation. What you checked about the payee and the amount before approving.
3. The authorization. Who approved, when, and under what limit.
4. The execution. The instruction sent to the bank and the confirmation that came back.
5. The posting. How the payment was recorded and matched to the ledger.

Most teams are strong on links one, four and five, because accounting systems produce them automatically. The weak links are usually two and three: the checks nobody wrote down, and the approvals that happened in an email thread or a hallway.

A useful test: could someone who was not in the room reconstruct why this payment was safe to send, using only your files? If the answer depends on someone's memory, the evidence is incomplete.

Why auditors and regulators care

Evidence matters because it turns "we have controls" into something checkable. Several U.S. frameworks lean on that idea, although they apply to different organizations.

The Foreign Corrupt Practices Act requires issuers to keep books, records and accounts that accurately and fairly reflect transactions, and to maintain a system of internal accounting controls, as described in this SEC-hosted FCPA summary. The same document notes the SEC's long-held view that "reasonable detail" means the level that would satisfy prudent officials running their own affairs. That is a useful standard for any finance team: record enough that a careful person could follow what happened.

For banks, the rule is more specific. Under 31 CFR 1020.410, banks must retain records for funds transfers of $3,000 or more, including the originator's name and address, the amount, the execution date, the payment instructions and the beneficiary institution. This binds the bank, not your company, but it shows what regulators consider the minimum anatomy of a payment record. Your own file should be able to show the same facts from the business side.

The FFIEC IT Examination Handbook goes further on process. For wholesale payment systems, it recommends that institutions document original payment instructions, the points where data moves between manual and automated steps, and institution-specific compliance requirements such as OFAC verification procedures. You can read the FFIEC guidance on internal and operational controls. Even if you are not a bank, the logic carries over: know where data changes hands, and leave a record at each handoff.

The records an AP team should capture

Start with the tax baseline, because every U.S. business has it. The IRS tells businesses to keep supporting documents for purchases and expenses, such as invoices, receipts and canceled checks. The documents should identify the payee, the amount paid, proof of payment and the date incurred, and describe what was bought. The details are on the IRS recordkeeping page.

That covers the tax question. For fraud prevention and internal audit, add the layers below.

At vendor onboarding

• Signed vendor form, W-9 or W-8 as applicable, and the contact who submitted it.
• The bank details received, the channel they arrived through, and who received them.
• The result of the payee check: the name you submitted, the account you tested, the outcome and the timestamp.
• Any call-back or secondary confirmation, with the number used and who made the call.
• Sanctions or watchlist screening results where your policy requires them.

At vendor master changes

Bank detail changes are where most payment fraud enters. Map your vendor create and edit logs, and maker-checker approvals if your system supports them, so you can show who changed what and who signed off. Evidence guidance from Dawgen Global makes the same point about vendor master changes. Our own write-ups on vendor bank change fraud explain why the payment should be held until the new details are verified, and that hold itself is something you should log.

At invoice approval

• The invoice, the purchase order and the receiving document.
• The three-way match result. The Washington State Auditor's Accounts Payable Guide calls it an industry standard and best practice.
• The approver's identity, timestamp and approval limit.
• Any exception: price variance, duplicate flag, missing receipt, and how it was resolved.

At payment release

• The payment instruction as originally submitted, before any edits.
• The payee verification result tied to the account in that instruction.
• The release approver, who should be a different person from the one who entered or changed the vendor.
• The bank confirmation and the ledger posting reference.

Proof of payment versus a reconciliation-ready record

A wire confirmation proves money moved. It does not tell an auditor which contract it settled, whether the invoice was legitimate, or whether the account belonged to your vendor. A reconciliation-ready record links the payment to a specific invoice or contract, so it can be matched without detective work.

The practical fix is a consistent reference. Put the invoice number and vendor ID in the payment reference field, store the bank confirmation with the invoice record, and keep the approval trail attached to the same file. Teams that automate invoice intake often find this easier, since invoice processing automation can attach source documents and approvals to each payable as it moves through the queue.

The same discipline helps with accounting standards that demand clean support. Controllers working through lease accounting, for example, will recognize the pattern in an ASC 842 audit checklist: every recurring payment should trace to a documented obligation.

Where payee verification evidence fits

Most of the evidence above is created after something happens. Payee verification creates evidence before money moves, which is when it is most valuable.

A verification record shows that, at a specific time, you compared the payee name you intended to pay with the account holder name attached to the account, and what the result was. If a payment later goes to a fraudster, that record shows whether you checked, what the check returned and who chose to proceed. If the check came back clean, it supports your position that the payment was made with reasonable care.

The FDIC's revised guidance on payment processor relationships expects institutions to verify the legitimacy of a processor's merchant clients by comparing information against public records, fraud databases and trusted third parties. It is written for banks, as you can see in the FDIC letter, but the principle is general: independent confirmation beats self-reported details.

What should a verification record contain?

Our guides on how to validate vendor bank accounts and payment verification controls walk through seven common fraud scenarios and the check that fits each one. For ACH-heavy U.S. teams, the five steps to prepayment account validation cover the domestic side. If your vendors are paid in euros, our Verification of Payee service covers the SEPA side.

Building evidence into the workflow

The goal is for evidence to be a by-product of doing the work, not a separate task. A workable sequence:

1. Define the minimum file per payment. Write down the five links above and decide which artifact proves each one.
2. Segregate duties. The Washington auditor's guide recommends separating authorization, recording, custody and reconciliation. Keep the person who adds or edits a vendor away from the person who releases payments.
3. Make the check a gate. A payment should not be releasable until a verification result is attached. A check people can skip will be skipped under deadline pressure.
4. Scale checks to risk. New vendors, changed bank details and large amounts deserve stricter steps. Our piece on risk-based verification shows how to tier them.
5. Log exceptions. An overridden mismatch with a written reason is far better evidence than a silent pass.
6. Test quarterly. Pull ten random payments and try to rebuild the full chain from the files alone. Fix whatever you cannot reconstruct.

Storing and retaining the evidence

The IRS advice is simple and worth following literally: keep supporting documents in an orderly fashion in a safe place, for example organized by year and type of expense. For payment evidence, extend that to organize by vendor and payment ID so a single search returns the whole chain.

A few practical rules:

• One home per payment. Keep the invoice, approvals, verification result and bank confirmation linked to the same record, not scattered across inboxes and shared drives.
• Restrict edit access. Evidence loses value if someone can quietly change it. Prefer systems that keep a history of changes.
• Export, don't screenshot. A downloadable result with a timestamp is stronger than an image pasted into an email.
• Set retention by the longest applicable rule. Tax, contractual, banking and industry-specific requirements differ. Confirm your schedule with your tax adviser or counsel rather than defaulting to a single number.
• Mind privacy. Collect only what you need to prove the check. Our note on payment verification privacy explains how payee checks limit the personal data that has to be shared.

What happens when evidence is missing

The sharpest examples come from enforcement. In its Siemens case, the Department of Justice described off-books accounts and purported business consultants used to make corrupt payments, as laid out in the criminal information. That is an extreme case of bribery, not an everyday AP error, but the control failure underneath it is familiar: payments to parties nobody properly vetted, with records that did not reflect what the money was for.

The ordinary version is less dramatic and more common: a vendor impersonator supplies new bank details, the payment goes out, and the team cannot show what they checked. Our articles on vendor impersonation fraud and mule account detection show how those cases unfold and where a name-to-account check would have interrupted them.

Our perspective

We built Vopify around one belief: the cheapest moment to collect evidence is before the payment is sent. After a bad payment, you are reconstructing. Before it, you are simply recording.

Most AP teams already have good records of what was paid. What they lack is a record of whether the payee was who the invoice said. A name and account number returned in seconds, stored against the payable, fills that gap without adding a contract, a platform fee or an integration project to the process.

That is why our service works from just a name and an account number, handles individuals and businesses, and lets you run one lookup or a whole supplier file by CSV. Our aim is for the verification result to become a routine line in the payment file, as normal as the approval stamp.

David

Run the check, keep the record

If your evidence file has a hole between "vendor sent details" and "payment released," that is the gap we designed Vopify to close. Payee Verification is priced at $0.70 to $1.00 per verification, and for steady volume the monthly plans are Starter at $240 per month, Growth at $750 per month and Scale at $2,000 per month. You can run a single lookup, or upload a supplier list through Bulk IBAN Verification.

Vopify checks IBAN-based accounts across the Eurozone, plus India, Indonesia, South Korea and China (Alipay), and our API integration for programmatic, high-volume checks is planned. If you are not sure whether your vendors are covered, see the supported networks, or start at vopify.io. Teams working with AI assistants can also look at Vopify MCP.

FAQ

What is the difference between proof of payment and compliance evidence?

Proof of payment shows that funds were sent, such as a wire confirmation or canceled check. Compliance evidence shows the payment was legitimate and controlled: the request, the payee check, the approvals, the execution and the ledger posting. Auditors generally want the second, because the first does not show the payment was right.

How long should we keep payment records?

There is no single answer, because tax, contract, banking and industry rules differ. The IRS asks businesses to keep supporting documents organized in a safe place, and your tax adviser can confirm the retention period for your situation. Set your policy to the longest period that applies to you.

Do U.S. banks' record rules apply to my company?

Not directly. Rules like 31 CFR 1020.410 bind banks, which must keep transfer records for transfers of $3,000 or more. Your company is covered by tax recordkeeping, internal control expectations and, if you are an SEC issuer, the FCPA books-and-records provisions. Your bank's rules still show what a complete payment record looks like.

Does payee verification count as evidence?

Yes, when you store the result with the payable. A record with the name submitted, the account tested, the outcome and a timestamp shows you checked before release. It supports your controls, but it works best alongside approvals, a three-way match and segregated duties.

Can Vopify check U.S. bank accounts?

Our coverage is the Eurozone (SEPA), India, Indonesia, South Korea and China (Alipay). For domestic ACH validation, our guide to Nacha account validation sets out the steps. For payments to vendors abroad in those regions, a name and account check gives you a result in under two seconds.

Sources

• FFIEC IT Examination Handbook: internal and operational controls
• IRS: What kind of records should I keep
• FDIC: Payment processor relationships revised guidance
• Washington State Auditor: Accounts Payable Guide
• Dawgen Global: The Evidence Map
• SEC: Foreign Corrupt Practices Act summary
• Federal Reserve: 31 CFR 1020.410
• DOJ: United States v. Siemens Aktiengesellschaft information
• Invoice processing automation
• ASC 842 audit checklist

Recommended

• Export Verification Logs: 4 Metadata Details Auditors Need
• Payment Verification Controls: 7 AP Checks for Common Fraud Scenarios
• Bank Account Ownership Verification: Methods That Actually Work
• Real Time Bank Account Verification for AP Teams