21-09-2021| treasuryXL | TIS |

This article evaluates how the success of long-term M&A activity on the part of large enterprises is dependent upon their ability to integrate and connect the pre-existing technology stacks of newly acquired subsidiaries with their broader infrastructure. Chiefly, we evaluate how enterprises that regularly establish new subsidiaries and entities across the globe can ensure that the various finance, treasury, and banking solutions leveraged by these companies before the acquisition can be integrated and connected in a cost-effective and optimized fashion.

M&A Activity Remains a Top Priority for Global Enterprises

Although merger and acquisition (M&A) activity is fairly common in today’s business environment, it is typically large, global enterprises that leverage the strategy most frequently.

For organizations with billions in revenue and a steady stream of new investment, taking advantage of new market opportunities is often best achieved by acquiring companies that have already proven themselves successful in the field. In the case of the world’s largest enterprises like Microsoft, Apple, and Facebook, M&A activity comprises a significant portion of overall growth. In fact, Microsoft alone has acquired more than 216 companies since their founding, and Apple acquires a new company at an average rate of once every four weeks. Across other industries like staffing and HR, Fortune 500 firm ManpowerGroup has acquired four new companies in the past five years and 15 total companies over the past few decades.

But while an M&A-intensive business strategy might be advantageous for eliminating competition, increasing revenue, and maintaining growth, there are a variety of challenges that must be confronted in order for the model to prove successful in the long-term.

Of course, any M&A project undertaken by a company will face obstacles, most of which revolve around how to best integrate the employees, products, systems, culture, and customers of the acquired company into the acquiring enterprise. These challenges are typically what executives and business leaders focus on most during M&A projects, and for good reason. If employees and customers are dissatisfied with how the acquisition is managed or if the acquired company’s product line stagnates, it can quickly turn the entire project on its head and substantially hinder future profits and revenue.

However, in today’s digitally-oriented business landscape, the above factors are not the only concern for M&A-intensive enterprises. Instead, one of the core challenges confronting modern acquisition projects lies along the technology front.

This is particularly true when it comes dealing with finance, treasury, and banking technology.

Why is Financial Technology Complexity so Common for M&A-Intensive Companies?

When evaluating the operations of enterprises that regularly undertake new acquisitions, it’s easy to see how technology complexity can manifest itself.

Let’s quickly walk through a sample scenario.

Looking specifically at finance and treasury technology, suppose that a U.S.-based manufacturing firm decides to acquire an emerging competitor in Asia. Also suppose that this Asian competitor has been operating independently for several decades and has its own spread of regional entities, as well as a pre-existing set of back-office platforms and IT solutions. As such, the company is already using an ERP, TMS, and AP system, as well as a globally distributed network of banks and bank accounts.

Going a step further, now consider the diverse range of currencies, payment formats, and financial networks that the Asian enterprise uses compared to the acquiring U.S. company. Also, because the compliance arena in Asia is managed through a diverse and multifaceted set of jurisdictions, conducting financial operations in the region will require a unique approach to managing regulatory and sanctions processes, as well as data and payment security.

For the acquiring U.S. company, connecting the various systems and networks used by the Asian subsidiary with their broader technology stack will be no easy feat. To start, some of the systems in place at the Asian subsidiary may be hosted locally or even running on older, unsupported versions. If modern cloud solutions have not been adopted, then integration via open APIs becomes highly unfeasible and it will likely require extensive IT support to establish the connections. The same is true for integrating the various bank channels and payment formats in use by the Asian subsidiary into the enterprise’s global financial architecture. Accommodating the various risk, regulatory, and compliance measures in place across Asia will require even more support, as well as collaboration with multiple legal and banking teams.

The end result being?

Although a single acquisition of this scale may be manageable for a global enterprise with significant resources, those that consistently undergo new acquisitions will likely experience much more difficulty. This is because internal IT teams rarely have enough bandwidth (or budget) to successfully establish all of the required connections for every system. Instead, what often happens is after a few months or years, IT is forced to divert their attention from one acquisition to another, thereby letting a portion of outstanding system connections fall to the wayside.

Ultimately, this creates an environment where much of the data and information captured at the local or “entity” level will sit idle and siloed from the rest of the enterprise. Instead of real-time data access across their individual units and subsidiaries, finance and treasury teams at HQ will have to rely on manual submissions from field personnel to ascertain data. In some cases, it may take weeks for this information to be received, by which time it is often outdated.

In the long run, the impact of these technology limitations has far-reaching consequences for the broader enterprise, especially if such issues are present across each new subsidiary or locality that they acquire.

What are the Main Problems That This Lack of System Integration & Connectivity Cause?

Thinking through the above M&A scenario, suppose that a similar conundrum impacts each (or most) of the M&A projects that an enterprise undertakes. Eventually, the lack of automated connectivity and control between the enterprise’s HQ and each of their subsidiaries will result in significant financial issues, particularly in the below areas:

1. Liquidity Management: If financial data related to cash positions and balances across a subsidiary and its underlying banks and accounts cannot be effectively transmitted to an enterprise’s HQ, then everything from cash forecasting and cash repatriation to short-term investing and risk mitigation will be impacted. If the enterprise does not know the exact amount of funds available across each entity, then it cannot effectively plan ahead to take advantage of investment or tax savings opportunities. Over time, losing out on these opportunities due to gaps in data quality and reporting can cost an enterprise millions of dollars every year.
2. Payments Management: For enterprises that cannot accommodate the range of payment systems and formats in use by their subsidiaries or that struggle to connect with their bank channels and networks, a variety of pain points will occur. Common issues include a reliance on outdated formats that limit data quality and security, delays in payment processing that impact the timeliness of transactions and also constrain employee bandwidth, and an increase in operational costs for continuing to support legacy processes and channels. Additional security and compliance issues may also manifest themselves, as highlighted below.
3. Security & Fraud Prevention: Without ample visibility into the payment processes and cash positions at each of a company’s subsidiaries or any centralized window for viewing this activity in real-time (or at least same-day), it becomes monumentally more difficult to identify and prevent fraud from occurring. If payments are initiated in disparate platforms at the local level and no overarching control or transparency is provided at the HQ level, then the threat of both internal fraud and external fraud increases exponentially.
4. Compliance & Regulation: Due to the diversity of data management protocols, financial regulations, and sanctions policies that exist across each world region, a lack of payments standardization within an enterprise can result in increased legal and regulatory risk and also jeopardize their reputation and standing. Examples of data and payments compliance protocols for which non-compliance can result in severe penalties include OFAC sanctions in the U.S., GDPR data policies in Europe, and the recently introduced Personal Information Protection Law (PIPL) in China.
5. General Financial Execution: If financial data is not automatically flowing between an enterprise and its subsidiaries, then every department and stakeholder with a need for this data is impacted. Accounting will be unable to track ledgers or financial statements, legal will struggle to manage regulatory and compliance issues, treasury will be hindered in their liquidity and payment processes, and the C-suite will lack the high-level financial data they need to make strategic decisions.

Although the above financial technology challenges present serious hurdles for M&A-intensive enterprises, there are solutions that can be put in place to alleviate the strain. One such solution includes the adoption of a modern Enterprise Payment Optimization (EPO) platform.

How Can the Complexity Caused by Global M&A Activity be Simplified & Managed?  

Because of the diverse systems landscape and limited IT bandwidth that often exists across M&A-intensive enterprises, achieving global visibility and control over finance and treasury operations requires a unique approach to connectivity and integration. In recent years, one strategy that has grown increasingly popular involves the adoption of an enterprise payment optimization (EPO) platform.

Modern EPO platforms are typically cloud-based solutions that sit above the other systems in an enterprise’s financial technology stack and manage connectivity across all their various back-office, banking, and 3rd party systems, including those at their entities and subsidiaries. Rather than connect every platform used within the enterprise to every other system, each solution need only connect to the EPO platform instead. This drastically simplifies the process of integrating new solutions with an enterprise’s tech stack and also automates the process of transmitting payments and financial data between any system that is connected to the EPO platform, including those used by different entities and departments.

Although the adoption of an EPO platform requires some up-front legwork, using a vendor like TIS ensures that the complexity of connecting to banks and various internal systems is almost entirely outsourced. This means that formerly difficult and time-consuming tasks that were a drag on internal IT teams (such as configuring and maintaining the links between new entity systems and HQ ERPs, HR systems, and TMSs) are now managed by the EPO vendor. As payment formats evolve or new regulations require changes in integration, EPO vendors like TIS automatically handle the upgrades and also manage the addition of new countries, banks, and users to an enterprise’s network as growth and expansion dictate over time.

Ultimately, by connecting all of the various banks and systems that comprise your financial technology stack to an EPO platform, you effectively ensure that regardless of where an entity is located or what local systems are being used, the data and information stored on their platforms is never left isolated or unaccounted for. And as older or outdated enterprise payment solutions are eventually replaced by newer and more upgraded systems, connecting them to the EPO platform in a similar fashion will ensure ongoing cohesion and connectivity across your global networks, even as various technology overhauls and system migrations occur at specific entities within the enterprise.

Once this type of EPO platform has been adopted, the ensuing benefits can be felt immediately by all enterprise stakeholders. Company-wide visibility to global cash balances drastically improves, liquidity management protocols become more streamlined, payments compliance and security features are standardized across all departments and entities, and the enterprise’s overall payments execution workflows become more automated and controlled.

Today, these capabilities are exactly what TIS is offering enterprises through our EPO technology suite.

Why is TIS the Ideal Solution for Simplifying M&A-Induced Technology Complexity?

TIS’ Enterprise Payment Optimization platform is a global, multi-channel and multi-bank connectivity ecosystem that streamlines and automates the processing of a company’s payments and subsequent reporting across all their global entities, banks, and financial systems. By sitting above an enterprise’s technology stack and connecting with all their back-office, banking, and 3rd party solutions, TIS effectively breaks down department and geographic silos to allow 360-degree payments and cash visibility and control. To date, the ~200 organizations that have integrated TIS with their global technology stacks have achieved near-100% real-time transparency into their payments and liquidity. This has benefitted a broad variety of internal stakeholders and has also enabled them to access information through their platform of choice, since the data that passes through TIS is always delivered back to the originating systems.

This systematically controlled payments workflow is managed by TIS for both inbound balance and transaction information and outbound payment instructions. Data can be delivered from any back-office system via APIs, direct plug-ins, or agents for transmission through TIS to banks and 3rd party vendors. No matter where you operate, TIS provides global connectivity by creating and maintaining compatibility with your required formats, channels, and standards so that organizations can connect with virtually any bank in the world.

Because of the deep connections that TIS maintains with internal systems such as ERPs or TMSs, external banks, and 3rd party vendors / service providers, the process of managing payments is simplified for every internal stakeholder. C-suite executives, treasury, accounting, AP, legal, HR, and other key personnel can access whatever financial data they need, exactly when they need it. And by automating this flow of information for both inbound and outbound payments, TIS provides the control and flexibility that enterprises need to function at their highest level.

Ultimately, the extensive experience and unparalleled integration capabilities provided by TIS enable enterprises to streamline their methods for managing payments and data across each entity and subsidiary. This has proven vital for a variety of TIS’ globally diverse clients, including Fortune 500 firms like ManpowerGroup and international NGOs like IFAW. And as these organizations add new companies, localities or seek to replace the underlying systems in use across various regions, TIS is there to help them manage the new integrations and connections, thereby ensuring a seamless transition and constant control over global payments and information.

In the digital world of enterprise payments, TIS is here to help you reimagine and simplify. For more information about how TIS can help you transform your global payments and information processes, please refer to the below resources.

About TIS

TIS is reimagining the world of enterprise payments through a cloud-based platform uniquely designed to help global organizations optimize outbound payments. Corporations, banks and business vendors leverage TIS to transform how they connect global accounts, collaborate on payment processes, execute outbound payments, analyze cash flow and compliance data, and improve critical outbound payment functions. The TIS corporate payments technology platform helps businesses improve operational efficiency, lower risk, manage liquidity, gain strategic advantage – and ultimately achieve enterprise payment optimization.

Visit tis.biz to reimagine your approach to payments.

11-08-2021 | TIS |

This article provides a modern review of the tactics used by cyber criminals to target enterprises with fraudulent schemes and also evaluates the primary methods used by companies for defending against digital payments fraud. This is followed by an introduction to TIS’ innovative Payee Community Screening (PCS) solution, which addresses payments fraud on a global scale by curating a community-based network of trusted beneficiaries, vendors, and bank account information that enterprises can use to verify the legitimacy of their outbound payment instructions.

Enterprise Payments Fraud in 2021 is More Elaborate & Subversive than Ever Before

Within the past year alone, thousands of finance and treasury practitioners across the world have learned through bitter experience that digital payments fraud is rarely orchestrated by your average, everyday criminal.

Rather, the vast majority of today’s technology-oriented attacks, particularly those that target large enterprises, are led by sophisticated, well-funded, and innovative fraudsters.

In many cases, these software-savvy perpetrators are working on behalf of state-sponsored actors or underground “black-hat” organizations. And because these groups are well-organized and well-funded, they can provide members with the latest technology and training. Ultimately, this has led to rapid digital innovation within the criminal underworld, and subsequently to a growing frequency of highly-orchestrated payments fraud attacks against the corporate environment.

Consisting primarily of software hacks or malware attacks, many of the most prevalent forms of fraud in existence today involve numerous layers of subterfuge and deception, which is necessary for bypassing the various security controls that organizations have in place. Common examples include the use of cleverly disguised Business Email Compromise (BEC) schemes, “Man-in-the-Middle” tactics, invoicing fraud, and the use of ransomware or other forms of “system takeover” fraud.

But of course, enterprises are not entirely helpless in defending themselves.

What Payment Security Tools Does a Modern-Day Treasury Group Utilize?

If you’re operating in a role with direct access or authority over an enterprise’s outbound transactions, you could probably name a broad number of tools at your company’s disposal for detecting and preventing payments fraud.

Some quick examples?

When initially establishing internal payment protocols, most companies will require clear segregation of duties between each stakeholder in the payment process. This includes dual or multi-user approval controls for executing, reviewing, and approving payments. Other standard security components, such as the use of encrypted Wi-Fi networks or VPNs, help restrict access to the enterprise’s digital software to only trusted sources. IP safe-listing tools provide even greater control over who can access these internal systems. As users log in, configuring multifactor authentication (MFA) tokens to be used in conjunction with standard usernames and passwords is another effective technique that prevents unauthorized users or personnel from accessing payment systems via stolen credentials. Biometric versions of these MFA tokens, such as fingerprint or retinal scanners, may be leveraged for even greater security. And finally, user auditing software is often adopted by companies to help monitor the activity of various personnel within their payment systems in order to detect suspicious activity, such as a login attempt from an unknown IP address, at an odd time of day, or from an obscure world region.

When all combined together with regular employee testing and training, these various security techniques have proven very effective for combating most forms of digital treasury and payments fraud in existence today. And in the years ahead, these tactics are expected to remain as core features of most enterprise’s fraud prevention strategies.

However, suppose that the criminals targeting your organization are not launching direct attacks against your internal payment systems or architecture, but instead decide to infiltrate the operations of your suppliers and partners.

Their reasoning?

Although your enterprise might have the appropriate defenses in place for preventing direct hacks and internal breaches, are your controls just as effective at identifying anomalous activity that is perpetrated through the guise of a trusted vendor?

For a surprising number of enterprises today, the simple answer is no.

Successful Fraudsters Learn How to Operate Outside the Purview of Enterprise Visibility

Although many of the fraud attacks that garner widespread media attention are those that result in millions or billions of losses in a single swoop, these are not the only types of attacks that organizations should be worried about.

In reality, many of the attempts perpetrated by criminals are not targeting billions of dollars. Instead, they focus on extracting smaller amounts of funds over time, often by disguising their activity through the lens of normal business operations.

Take, as an example, fake invoices submitted by criminals that are designed to mimic one of the thousands of vendor or supplier payments that a global enterprise makes every month.

Usually, vendors are submitting invoices to enterprises via email, an online e-commerce platform, or via an ERP system. Subsequent payments are then delivered from the enterprise to the various recipients whose invoices have been approved, usually as an account-to-account transaction that goes directly to the bank account listed in the invoice.

However, suppose that a criminal is able to infiltrate the email account, e-commerce platform, or payment system used by one of your vendors. And over time, the criminal monitors the activity and communication that occurs between this vendor and your enterprise and learns how to mimic the workflow, presentation, and delivery of new invoices for payment.

In this scenario, the criminal knows that your company is receiving hundreds, if not thousands, of new invoices from a variety of vendors every day. They also know the average dollar amount of each invoice delivered by particular vendors, as well as the frequency and timing of their submissions. And if an email account or e-commerce platform has been hacked, they have also probably been studying the language and messaging that the vendor uses to correspond with you.

After taking time to evaluate these invoicing and communication processes, the criminal will create a falsified invoice using the same email address or payment platform that you’re familiar with. The invoice will probably be for the same amount and to the same beneficiary that you’re used to paying, but with a slight variation to the underlying bank account details.

The typical result being?

Unless you are actively tracking and inspecting the vendor records, bank account numbers, and beneficiary details for EVERY payment initiated by your enterprise to your global network of partners and vendors, then catching these attempts will be incredibly difficult.

But if your company cannot catch this errant invoice the first time, then what is going to stop the criminal from submitting numerous invoices over and over, or even going on to target other vendors within your network and duplicating the process on a broader scale?

It might sound like an Ocean’s 11 heist on paper, but in reality, these types of attacks occur all the time. In fact, a single instance of invoice fraud cost Amazon nearly $20 million in 2020. Other forms of fraud, such as BEC schemes, cost a combined $12.5 billion for organizations in the same timeframe, and these numbers are not decreasing over time.

Instead, they are continuing to rise.

Introducing a New Way to Quickly Identify Suspicious or Fraudulent Payment Details

Although subversive types of fraud attacks like the invoice example above are difficult for large companies to identify, suppose there were a way to quickly scan all vendor and supplier payments in real-time against a global library of beneficiary and bank account data?

Going a step further, what if you could also scan outbound transactions being delivered to first-time vendors against a community ledger of payments data in order to verify that the underlying account details and remittance info have never been flagged as suspicious or fraudulent by other enterprises?

With this functionality, the threat of fraud being perpetrated through more obscure and subversive channels become much easier to identify, and they go a long way in protecting your enterprise against attacks that spawn through exposures related to your partners, vendors, and suppliers.

This suite of tools is exactly what TIS is now providing enterprise clients with our innovative Payee Community Screening (PCS) solution.

Developed in direct response to a noted increase in invoice and BEC fraud, TIS’ PCS network works by aggregating payments data across our trusted community of global enterprises and bank partners. As new payments are submitted by various enterprises through TIS, this module compares the underlying beneficiary and bank account information against a comprehensive record of all other transactions executed through the system, including those made by other enterprises in the network.

In practice, this validation process effectively protects against four fundamental threats:

1. If you are making payments to a new beneficiary or bank account for the first time, an alert will be generated by the system warning you that an additional review of the information is recommended.
2. If you are making payments to a beneficiary which is completely unknown to other members of the PCS network, then the payment is flagged and a review workflow is initiated.
3. For new vendors that you are paying for the first time, if the invoice and payment details do not match what other enterprises in the network have used to pay the vendor (i.e. a different bank account number was provided to your enterprise than what was provided to other enterprises in the network), then the payment is flagged and a review workflow is initiated.
4. If the beneficiary or bank account details provided in an invoice ever match with a known criminal, sanctioned, or otherwise fraudulent party, the payment is automatically flagged and a review workflow is initiated.

In this way, by inspecting every outbound payment initiated by your enterprise in real-time against a global library of payments information, enterprises can strengthen their security controls by accessing a much broader pool of data and information than what is available in-house. To date, TIS’ network has managed over 11 billion payments globally across 11,000+ banks and 15 million+ distinct beneficiaries, which makes our library of payments information virtually unparalleled in the market. And now with the addition of PCS to our solution suite, we can better protect our enterprise clients from fraud by confirming the validity of every outbound transaction they are attempting to make.

In an environment where subterfuge and deception are a criminal’s main assets, these community screening techniques are essential for ensuring that fraudsters cannot bypass your controls simply by infiltrating those of a different company within your network. They also ensure that as soon as fraudulent or suspicious payment info is identified by one enterprise, the data can be quickly shared across all other enterprises in the network for purposes of quickly halting subsequent payments to that account or beneficiary.

For TIS’ enterprise clients, these tools are already becoming a pivotal component of their core security structure, and we are excited to continue deploying the solution across more global enterprises in the months and years ahead.

Learn More About How PCS Can Bolster Your Treasury & Payments Security

Although no single tool should ever be relied upon to defend against all forms of fraud, it is strongly recommended that enterprises making hundreds or thousands of vendor payments every day undergo a thorough evaluation of their payment controls. More specifically, treasury and AP teams should take time to analyze whether the threat of invoice or BEC fraud leaves them exposed, especially if a vendor or supplier within their network is compromised.

For enterprises that identify gaps, we invite you to learn more about how TIS can help.

For more information about TIS’ PCS tool, the associated benefits, and the technical aspects associated with its architecture, download our latest factsheet. You can also request a meeting with one of our payment experts or learn more about the other security-related components of our solution suite.

Stay vigilant, stay safe, and as always, thank you for reading.

About TIS

TIS is reimagining the world of enterprise payments through a cloud-based platform uniquely designed to help global organizations optimize outbound payments. Corporations, banks and business vendors leverage TIS to transform how they connect global accounts, collaborate on payment processes, execute outbound payments, analyze cash flow and compliance data, and improve critical outbound payment functions. The TIS corporate payments technology platform helps businesses improve operational efficiency, lower risk, manage liquidity, gain strategic advantage – and ultimately achieve enterprise payment optimization.

Visit tis.biz to reimagine your approach to payments.