Positive pay files in Dynamics 365 Finance

Positive pay is a bank fraud-prevention service: each day, the company sends the bank a list of legitimately issued checks; the bank rejects any check presented that's not on the list. For US companies with check-based AP, positive pay is the standard control. F&O supports positive pay file generation through configurable data exchanges.

The threat being mitigated.

• Check fraud — stolen checks, altered amounts, counterfeit checks presented for payment.
• Without positive pay — bank pays anything that looks like a valid check.
• With positive pay — bank validates against the issuer's daily list.

For companies issuing thousands of checks monthly, positive pay is essential.

Positive pay file contents. Typical fields per record:

• Account number.
• Check number.
• Check amount.
• Issue date.
• Payee name.
• Void status (for cancelled checks).

The bank validates each presented check against the file.

Configuration in F&O.

• Bank account flagged for positive pay.
• Bank file format configured (data exchange definition).
• Positive pay record generated on check issuance.

When a check is printed, a positive pay record is created. End-of-day, the records flow to a file.

Generating the file. Generate positive pay file action:

1. Selects records since last submission.
2. Formats per bank's specification.
3. Outputs file (CSV, fixed-width, XML, etc. depending on bank).
4. Marks records as submitted.

Bank-specific formats. Every bank has its own format:

• Chase — specific layout.
• Bank of America — different.
• Wells Fargo — different again.
• JPMorgan — different.

F&O ships with templates for major banks; customisation needed for others. The configuration is a data exchange definition mapping F&O records to bank's expected fields.

Transmission methods.

• Bank portal upload — manual; operator uploads daily.
• FTP/SFTP — automated transmission to bank's SFTP server.
• Bank API — modern; programmatic.
• EDI — for some banks.

Automation reduces operational burden; without it, daily manual upload is a chore.

Exceptions. When the bank receives a check not on the list:

• Exception alert to the company.
• Hold for review — company decides accept or reject.
• Timeout default — if no response, bank's default (often reject).

The company reviews exceptions daily; legitimate checks (rare misses) get authorised, fraudulent ones rejected.

Stop payments. When a check is voided:

• Stop payment record sent to bank.
• Bank rejects if presented.
• Positive pay file may include void instructions.

Reverse positive pay vs payee positive pay.

• Standard positive pay — match on account, check number, amount.
• Payee positive pay — also match payee name; harder to defeat.

Many banks offer both tiers; payee positive pay is stronger but requires accurate payee name capture.

Daily transmission rhythm. Critical:

• Send positive pay file BEFORE any check could be presented.
• Banks typically require file by 8 AM or so for that day's presentments.
• Late files = checks presented before listing = potential acceptance of fraudulent items.

The cutoff is bank-specific; verify and respect.

Reconciliation against bank. Beyond positive pay:

• Bank statement received daily / monthly.
• Match cleared checks against F&O bank ledger.
• Investigate items not matching.

Positive pay catches fraudulent checks at presentment; bank reconciliation catches issues post-clearing.

ACH positive pay. Beyond checks, ACH transactions can also use positive pay:

• ACH originators authorised.
• Unauthorised ACH debits blocked.

F&O supports ACH positive pay configuration similarly.

Implementation considerations.

• Bank partnership — bank must support positive pay (most do).
• File format provisioned — bank's specification implemented in F&O.
• Transmission method — FTP / API setup.
• Exception handling process — who reviews exceptions, how quickly.

Common pitfalls.

• File late. Daily transmission missed; window of fraud opportunity.
• Format errors. File rejected by bank; checks not validated; revert to manual.
• Stop payment not transmitted. Voided check reaches bank; pays out as positive pay-listed.
• Payee name mismatch. "John Smith" vs "Smith, John"; payee positive pay flags legitimate checks.
• No exception review. Bank rejects valid checks; vendor calls; AP scrambles.
• Manual override drift. Operator approves exceptions routinely without analysis.

Operational rhythm.

• Daily — file transmission, exception review, monitoring.
• Weekly — process audit; missed file investigations.
• Monthly — reconcile bank's records of presented vs our records of issued.

Strategic positioning. Positive pay is a high-leverage fraud control — relatively cheap to set up, dramatically reduces check fraud risk. For any US company issuing checks at scale, it's a standard expectation. F&O supports it natively with appropriate bank format configuration; the operational discipline of timely transmission and exception review is what makes it effective. The decision to NOT use positive pay rarely makes sense for check-issuing companies; the implementation is small, the protection material.