30-08-2021 | TIS |

This article begins by examining the current state of enterprise treasury and finance technology implementations, including the standard project timelines, core challenges, and ultimate outcomes. This is followed by an analysis that outlines an improved methodology for enterprises to follow as they seek to ensure the global optimization and standardization of their payment systems, workflows, and technologies.

Modern enterprises are stuck in an endless cycle of payment technology upgrades

For enterprise finance and treasury professionals, why does it feel like the road to payments automation and technology optimization is never complete?

If you’re an active practitioner, you’ve likely asked yourself this very question (or at least a variation of it) within the past few years. Perhaps it was during a very long and arduous TMS or ERP implementation, a major acquisition of a new entity, or a rationalization of your global bank relationships. In any case, your musings were probably due to the fact that these types of projects have become an all-too-regular occurrence (and a subsequent thorn in the side) for enterprises around the world.

As recently as 2018, data showed that the average corporate timeline for a SaaS-based TMS implementation was 10-18 months. Technology overhauls involving larger and more widely used systems, such as global ERPs, may have taken up to 3-5 years. And although these respective timelines continue to grow shorter as cloud services and other innovations rise to the forefront, projects of this magnitude still represent a massive undertaking.

During these periods, it’s common for practitioners to wind up collaborating with dozens of internal and external stakeholders, joining hundreds of calls, and spending countless hours training, testing, and configuring the new system – all while continuing to perform their core list of daily responsibilities.

The ultimate result being?

Although seasoned professionals will tell you that every implementation is different, let’s think about the bigger picture. Of course, the results of each specific project can vary drastically, sometimes for reasons far outside of anyone’s control. There may be budget constraints, bandwidth constraints, technical limitations, and even geopolitical or environmental obstructions. Employee turnover may cause undue delays as well. And yet other times, the entire project may flow smoothly and on budget from start to finish.

But looking beyond the individual success or failure of any single project, how long after each project’s completion will it be until a new technology implementation is required?

One year? Two years? Five years?

Or, in the case of global enterprises, perhaps you are simultaneously working on numerous financial technology implementations all at once, and the completion of one only results in your reprioritization of another.
Unfortunately, this endless cycle of new technology and payment upgrades is what most enterprise treasury and finance teams find themselves dealing with today, and it has become one of the primary sources of confusion and headache for global companies.

Let’s quickly evaluate the underlying complexities in more detail.

Why does global expansion often lead to excessive payments complexity?

Although domestic companies operating in a single country or region undoubtedly face their own degree of technology and payments complexity, the level of difficulty associated with managing a global network of systems, data, and information is exponentially greater.

What are the main reasons for this?

To begin, consider the sheer volume of payments being made across a global enterprise, including all the various locations, currencies, and payment types. For the largest companies, there may be millions of inbound customer payments occurring every day through a combination of cash, check, card, and account-to-account options like ACH and SEPA. At the same time, an equally large and diverse variety of outbound payments must be generated by the enterprise to compensate employees, vendors, and partners. And every time a new entity, industry, or market vertical is added to the mix, these volumes intensify.

Adding further complexity, consider how the payment channels and formats in use across each world region can vary broadly as well. Just to name a few, there is EBICS in Europe, NACHA in North America, SWIFT for international payments, and H2H (direct) connections that may be utilized globally. Local variations of these channels also exist in other regions, and going a step further, each of the specific banks used by an enterprise will have its own connectivity preferences for payments and information reporting. Individual clients, partners, and vendors may also request payment data to be created in specific formats such as SWIFT MT, ISO 20022, EDI, BAI, and BAI2.

Finally, the diverse compliance and security standards that exist across various countries require unique filtering and monitoring workflows to be established in different regions. Although U.S. companies may be familiar in dealing with OFAC sanction lists, FBAR statutes, and data privacy laws like GDPR, the regulatory landscape in Asia, Africa, and the Middle East looks quite different. In fact, each specific country within these regions might have its own distinct set of rules and restrictions, and these protocols must closely adhere to any time that payments data and technology solutions are managed locally.

But despite all these challenges, perhaps the largest source of headache and confusion for enterprise practitioners stems from attempting to manage a disparate and unintegrated web of back-office payment solutions.

What do we mean by this?

The back-office conundrum: too many solutions and not enough integrations

In 2016, research from Fortune highlighted that global enterprises were undergoing merger and acquisition (M&A) activity at incredible rates, with the five most active companies absorbing 122 new entities between them on the year. Data from more recent years showcases a similar story, and at the same time, organic growth is also driving these enterprises to open new offices, enter into new markets, and expand into new world regions.

The challenge?

As these new acquisitions and locations ultimately go on to form new company entities and subsidiaries, the underlying systems used at each locality must be connected to the enterprise’s main technology stack in order to facilitate data transmission, cash and payment visibility, and other core financial functions. But for enterprises with hundreds of already-existing entities and a steady stream of new acquisitions, consider how many systems must be connected to the enterprise’s core technology stack each year. Also consider the amount of maintenance, upkeep, and investment that managing this global network of technology requires. And finally, reflect on how each of these systems will gradually become a legacy over time and need to be replaced as new technologies and solutions rise to the forefront of the industry.

We know from experience that not all of these global systems are able to connect or integrate with one another. Perhaps some solutions are too old, the budget too insufficient, or IT bandwidth is stretched too thin to prioritize the development of proper connections. As a result, it may take days, weeks, or even months for the data and information contained within these local systems to be made available across the entire enterprise. And if these siloed systems are not isolated occurrences but actually comprise a significant portion of the enterprise’s back-office infrastructure, then almost every single financial and payments-related function will be impacted.

Without automated connectivity and integration, visibility to cash balances and payment statuses will take a hit. Creating a standardized compliance and security process will be almost impossible, and stewarding the company’s liquid assets will be hampered by a lack of transparency to global data.

Today, these siloed entity technology stacks and legacy systems are often the unintended result of sustained business growth. In fact, it’s almost natural for them to occur. However, with today’s speed of change in commerce and technology, it is no longer an option to leave each of these functions, systems, and geographies unconnected. Siloes trap data, reduce communication and visibility, and ultimately stifle growth. And in the world of payments and technology, a lack of visibility and automation will directly impact liquidity, profitability, and exposure to risk across the entire enterprise.

So then, for enterprises that find themselves in this situation, what is the best approach to optimization?

Introducing a new framework for managing enterprise payment maturity

In a perfect world, enterprises that need to connect all of their global technology and payments solutions, including bank platforms and 3rd party solutions, would simply integrate every system with every other system. This would effectively enable complete unification and connectivity across the enterprise’s entire network, and data could flow immediately and seamlessly across any department, entity, and location for real-time visibility and control.

Of course, active practitioners understand how unrealistic this approach would be. In reality, it would require an almost endless variety of custom integrations to be established across each internal system and potentially hundreds of banks and external solutions. Despite innovations surrounding APIs and other connectivity methods, this task would still be insurmountable, from both a budgetary and bandwidth perspective. And even if an enterprise did somehow manage to connect all these solutions together, the maintenance and upkeep required to sustain each integration would require a whole army of dedicated IT personnel and even more investment.

An alternative solution?

Given the fragmented systems landscape that exists across most global enterprises, the most effective way to achieve a holistic view of (and control over) every siloed process, system, and geography is by implementing a single Enterprise Payments Optimization (EPO) layer that sits above all other solutions in an enterprise’s technology stack. Rather than connect every platform with every other, each solution need only connect to the EPO platform instead. This drastically simplifies the process of integrating new solutions with an enterprise’s tech stack, and also automates the process of transmitting payments data between any system that is connected to the EPO platform, including those used by different entities, offices, and departments.

Although the adoption of an EPO platform requires some up-front legwork, using a vendor like TIS ensures that the complexity of connecting to banks and performing other technical functions is almost entirely outsourced. This means that formerly difficult and time-consuming tasks that were managed by internal IT teams (such as configuring and maintaining the links between external banks and internal ERPs, HR systems, and TMSs) are now managed by the EPO vendor. As formats evolve or new regulations require changes in integration, EPO vendors like TIS automatically handle the upgrades and also manage the addition of new countries, banks, and users to an enterprise’s network as growth and expansion dictate over time.

Once this type of implementation has been performed, the EPO platform can become the sole channel through which all company payment workflows and data streams are managed and controlled.

As payment instructions or files from ERPs and other back-office systems pass through an EPO platform, they can be quickly transferred to the appropriate bank or end party. In addition, data can be shared with 3rd party vendors and other companies and partners within the network. Subsequent bank statements and reports can also be transmitted from the bank through an EPO platform to the various internal departments and systems where payment instructions are originating from.

Ultimately, the information stored on an EPO platform serves as the single source of truth for payments data across all corporate departments, subsidiaries, and geographies, and it prevents enterprises and their IT departments from having to manage a tangled mess of disparate back-office connections.

EPO solutions provide the perfect option to support ongoing enterprise growth and expansion

While the EPO orchestration strategy outlined above is very effective at breaking down geographic and entity-specific siloes, it is also the ideal platform for fostering a strategic, long-term approach to enterprise payment maturity.

Today, the technology landscape continues to evolve rapidly, as do the payment solutions and methods used by global enterprises. In the current era, this means that approximately once every decade, a company’s existing technology infrastructure will need to be overhauled. However, because various internal solutions are installed at different times and for different purposes, the upgrades and maintenance schedules for these solutions are rarely conducted in an organized and timely fashion. Sometimes, these upgrades are not completed at all. And as a result, it’s very easy for an “optimized” payment workflow and the underlying technology stack to start falling behind the curve.

This is why adopting an EPO orchestration layer is so essential for maintaining a constant state of consistency and control.

By connecting all of the various internal systems that comprise your global payments technology stack to an EPO platform, you effectively ensure that regardless of where an entity is located or what local systems are being used, the data and information stored on their platforms is never left isolated or unaccounted for. And as older or outdated enterprise payment solutions are eventually replaced by newer and more upgraded systems, connecting them to the EPO platform in a similar fashion will ensure ongoing cohesion and connectivity across your global networks, even as various technology overhauls and system migrations occur at specific entities or locations within the enterprise.

So, if you’re a treasury or finance professional working for an enterprise with significant process, system, and global complexity — complexity that is ultimately hindering your ability to operate efficiently — ask yourself whether a new approach to payments technology could be the answer.

And if that answer is yes, we invite you to consider TIS and our newly introduced Enterprise Payment Optimization (EPO) platform.

About TIS

TIS is reimagining the world of enterprise payments through a cloud-based platform uniquely designed to help global organizations optimize outbound payments. Corporations, banks and business vendors leverage TIS to transform how they connect global accounts, collaborate on payment processes, execute outbound payments, analyze cash flow and compliance data, and improve critical outbound payment functions. The TIS corporate payments technology platform helps businesses improve operational efficiency, lower risk, manage liquidity, gain strategic advantage – and ultimately achieve enterprise payment optimization.

Visit tis.biz to reimagine your approach to payments.

11-08-2021 | TIS |

This article provides a modern review of the tactics used by cyber criminals to target enterprises with fraudulent schemes and also evaluates the primary methods used by companies for defending against digital payments fraud. This is followed by an introduction to TIS’ innovative Payee Community Screening (PCS) solution, which addresses payments fraud on a global scale by curating a community-based network of trusted beneficiaries, vendors, and bank account information that enterprises can use to verify the legitimacy of their outbound payment instructions.

Enterprise Payments Fraud in 2021 is More Elaborate & Subversive than Ever Before

Within the past year alone, thousands of finance and treasury practitioners across the world have learned through bitter experience that digital payments fraud is rarely orchestrated by your average, everyday criminal.

Rather, the vast majority of today’s technology-oriented attacks, particularly those that target large enterprises, are led by sophisticated, well-funded, and innovative fraudsters.

In many cases, these software-savvy perpetrators are working on behalf of state-sponsored actors or underground “black-hat” organizations. And because these groups are well-organized and well-funded, they can provide members with the latest technology and training. Ultimately, this has led to rapid digital innovation within the criminal underworld, and subsequently to a growing frequency of highly-orchestrated payments fraud attacks against the corporate environment.

Consisting primarily of software hacks or malware attacks, many of the most prevalent forms of fraud in existence today involve numerous layers of subterfuge and deception, which is necessary for bypassing the various security controls that organizations have in place. Common examples include the use of cleverly disguised Business Email Compromise (BEC) schemes, “Man-in-the-Middle” tactics, invoicing fraud, and the use of ransomware or other forms of “system takeover” fraud.

But of course, enterprises are not entirely helpless in defending themselves.

What Payment Security Tools Does a Modern-Day Treasury Group Utilize?

If you’re operating in a role with direct access or authority over an enterprise’s outbound transactions, you could probably name a broad number of tools at your company’s disposal for detecting and preventing payments fraud.

Some quick examples?

When initially establishing internal payment protocols, most companies will require clear segregation of duties between each stakeholder in the payment process. This includes dual or multi-user approval controls for executing, reviewing, and approving payments. Other standard security components, such as the use of encrypted Wi-Fi networks or VPNs, help restrict access to the enterprise’s digital software to only trusted sources. IP safe-listing tools provide even greater control over who can access these internal systems. As users log in, configuring multifactor authentication (MFA) tokens to be used in conjunction with standard usernames and passwords is another effective technique that prevents unauthorized users or personnel from accessing payment systems via stolen credentials. Biometric versions of these MFA tokens, such as fingerprint or retinal scanners, may be leveraged for even greater security. And finally, user auditing software is often adopted by companies to help monitor the activity of various personnel within their payment systems in order to detect suspicious activity, such as a login attempt from an unknown IP address, at an odd time of day, or from an obscure world region.

When all combined together with regular employee testing and training, these various security techniques have proven very effective for combating most forms of digital treasury and payments fraud in existence today. And in the years ahead, these tactics are expected to remain as core features of most enterprise’s fraud prevention strategies.

However, suppose that the criminals targeting your organization are not launching direct attacks against your internal payment systems or architecture, but instead decide to infiltrate the operations of your suppliers and partners.

Their reasoning?

Although your enterprise might have the appropriate defenses in place for preventing direct hacks and internal breaches, are your controls just as effective at identifying anomalous activity that is perpetrated through the guise of a trusted vendor?

For a surprising number of enterprises today, the simple answer is no.

Successful Fraudsters Learn How to Operate Outside the Purview of Enterprise Visibility

Although many of the fraud attacks that garner widespread media attention are those that result in millions or billions of losses in a single swoop, these are not the only types of attacks that organizations should be worried about.

In reality, many of the attempts perpetrated by criminals are not targeting billions of dollars. Instead, they focus on extracting smaller amounts of funds over time, often by disguising their activity through the lens of normal business operations.

Take, as an example, fake invoices submitted by criminals that are designed to mimic one of the thousands of vendor or supplier payments that a global enterprise makes every month.

Usually, vendors are submitting invoices to enterprises via email, an online e-commerce platform, or via an ERP system. Subsequent payments are then delivered from the enterprise to the various recipients whose invoices have been approved, usually as an account-to-account transaction that goes directly to the bank account listed in the invoice.

However, suppose that a criminal is able to infiltrate the email account, e-commerce platform, or payment system used by one of your vendors. And over time, the criminal monitors the activity and communication that occurs between this vendor and your enterprise and learns how to mimic the workflow, presentation, and delivery of new invoices for payment.

In this scenario, the criminal knows that your company is receiving hundreds, if not thousands, of new invoices from a variety of vendors every day. They also know the average dollar amount of each invoice delivered by particular vendors, as well as the frequency and timing of their submissions. And if an email account or e-commerce platform has been hacked, they have also probably been studying the language and messaging that the vendor uses to correspond with you.

After taking time to evaluate these invoicing and communication processes, the criminal will create a falsified invoice using the same email address or payment platform that you’re familiar with. The invoice will probably be for the same amount and to the same beneficiary that you’re used to paying, but with a slight variation to the underlying bank account details.

The typical result being?

Unless you are actively tracking and inspecting the vendor records, bank account numbers, and beneficiary details for EVERY payment initiated by your enterprise to your global network of partners and vendors, then catching these attempts will be incredibly difficult.

But if your company cannot catch this errant invoice the first time, then what is going to stop the criminal from submitting numerous invoices over and over, or even going on to target other vendors within your network and duplicating the process on a broader scale?

It might sound like an Ocean’s 11 heist on paper, but in reality, these types of attacks occur all the time. In fact, a single instance of invoice fraud cost Amazon nearly $20 million in 2020. Other forms of fraud, such as BEC schemes, cost a combined $12.5 billion for organizations in the same timeframe, and these numbers are not decreasing over time.

Instead, they are continuing to rise.

Introducing a New Way to Quickly Identify Suspicious or Fraudulent Payment Details

Although subversive types of fraud attacks like the invoice example above are difficult for large companies to identify, suppose there were a way to quickly scan all vendor and supplier payments in real-time against a global library of beneficiary and bank account data?

Going a step further, what if you could also scan outbound transactions being delivered to first-time vendors against a community ledger of payments data in order to verify that the underlying account details and remittance info have never been flagged as suspicious or fraudulent by other enterprises?

With this functionality, the threat of fraud being perpetrated through more obscure and subversive channels become much easier to identify, and they go a long way in protecting your enterprise against attacks that spawn through exposures related to your partners, vendors, and suppliers.

This suite of tools is exactly what TIS is now providing enterprise clients with our innovative Payee Community Screening (PCS) solution.

Developed in direct response to a noted increase in invoice and BEC fraud, TIS’ PCS network works by aggregating payments data across our trusted community of global enterprises and bank partners. As new payments are submitted by various enterprises through TIS, this module compares the underlying beneficiary and bank account information against a comprehensive record of all other transactions executed through the system, including those made by other enterprises in the network.

In practice, this validation process effectively protects against four fundamental threats:

1. If you are making payments to a new beneficiary or bank account for the first time, an alert will be generated by the system warning you that an additional review of the information is recommended.
2. If you are making payments to a beneficiary which is completely unknown to other members of the PCS network, then the payment is flagged and a review workflow is initiated.
3. For new vendors that you are paying for the first time, if the invoice and payment details do not match what other enterprises in the network have used to pay the vendor (i.e. a different bank account number was provided to your enterprise than what was provided to other enterprises in the network), then the payment is flagged and a review workflow is initiated.
4. If the beneficiary or bank account details provided in an invoice ever match with a known criminal, sanctioned, or otherwise fraudulent party, the payment is automatically flagged and a review workflow is initiated.

In this way, by inspecting every outbound payment initiated by your enterprise in real-time against a global library of payments information, enterprises can strengthen their security controls by accessing a much broader pool of data and information than what is available in-house. To date, TIS’ network has managed over 11 billion payments globally across 11,000+ banks and 15 million+ distinct beneficiaries, which makes our library of payments information virtually unparalleled in the market. And now with the addition of PCS to our solution suite, we can better protect our enterprise clients from fraud by confirming the validity of every outbound transaction they are attempting to make.

In an environment where subterfuge and deception are a criminal’s main assets, these community screening techniques are essential for ensuring that fraudsters cannot bypass your controls simply by infiltrating those of a different company within your network. They also ensure that as soon as fraudulent or suspicious payment info is identified by one enterprise, the data can be quickly shared across all other enterprises in the network for purposes of quickly halting subsequent payments to that account or beneficiary.

For TIS’ enterprise clients, these tools are already becoming a pivotal component of their core security structure, and we are excited to continue deploying the solution across more global enterprises in the months and years ahead.

Learn More About How PCS Can Bolster Your Treasury & Payments Security

Although no single tool should ever be relied upon to defend against all forms of fraud, it is strongly recommended that enterprises making hundreds or thousands of vendor payments every day undergo a thorough evaluation of their payment controls. More specifically, treasury and AP teams should take time to analyze whether the threat of invoice or BEC fraud leaves them exposed, especially if a vendor or supplier within their network is compromised.

For enterprises that identify gaps, we invite you to learn more about how TIS can help.

For more information about TIS’ PCS tool, the associated benefits, and the technical aspects associated with its architecture, download our latest factsheet. You can also request a meeting with one of our payment experts or learn more about the other security-related components of our solution suite.

Stay vigilant, stay safe, and as always, thank you for reading.

About TIS

TIS is reimagining the world of enterprise payments through a cloud-based platform uniquely designed to help global organizations optimize outbound payments. Corporations, banks and business vendors leverage TIS to transform how they connect global accounts, collaborate on payment processes, execute outbound payments, analyze cash flow and compliance data, and improve critical outbound payment functions. The TIS corporate payments technology platform helps businesses improve operational efficiency, lower risk, manage liquidity, gain strategic advantage – and ultimately achieve enterprise payment optimization.

Visit tis.biz to reimagine your approach to payments.