Key concepts

AP keeps more things apart than it looks from outside:

Is the supplier real?

The W-9 is where a US supplier certifies its taxpayer identification number (TIN) under penalty of perjury. The IRS's free TIN Matching checks 25 name-and-number pairs instantly, or 100,000 within 24 hours; a missing or wrong TIN triggers 24% backup withholding, tax the buyer must hold back. Canada has no W-9: AP collects the Business Number and checks the GST/HST number in the CRA registry, keeping the result as evidence for tax credits.

Is the bank account really theirs?

The bank account is the field a fraudster most wants to change, and no Nacha rule makes a buyer validate a supplier's account before an ACH credit, though Nacha's December 2025 tips recommend it, plus confirming changes through contacts already on file and two people signing off. The Fed announced a Payee Name Verification service in December 2025, with no launch date I've seen. And UCC 4A-207 (US commercial law on funds transfers) lets the receiving bank rely on the account number when name and number disagree.

Say an AP clerk gets an email from a packaging supplier they've paid for years: new bank, new account number, please update before Friday's run. The email looks right. The safe move is to call the supplier on the phone number already in the vendor master, not the one in the email, and hold the first payment to the new account until someone has confirmed it.

Four lifecycles run side by side, and they disagree by design:

• Requisition and PO: requested, approved, open, partially received, closed.
• Invoice: received, captured, matched or in exception, approved, posted, scheduled, paid, cleared.
• Payment: proposed, approved, released, sent, then settled, returned or cleared.
• Virtual card: issued, then charged by the supplier (or expired uncharged), then settled.

The word that causes the most trouble is "paid":

Discount and late-fee fights live in these gaps. A buyer that "paid" on day 10 by mailing a check and a supplier that got it on day 14 will disagree about the 2% in good faith.

I'd model "released", "settled" and "cleared" as separate states. A check can show as paid in the ERP for weeks before it's cashed, and meanwhile be stolen, altered or go stale. A virtual card can sit uncharged while the buyer thinks the invoice is closed.

Every fact has an owner, and the buyer's ERP owns fewer of them than it seems.

The classic breaks:

• Tool and ERP disagree. The AP tool shows an invoice paid; the ERP still shows it open.
• Received but not invoiced. Goods arrived, the invoice hasn't, and the accrual is a month-end chore.
• Outstanding checks. The ERP says paid; the bank hasn't seen the check.
• Card timing. A virtual card was issued, not yet charged, and nobody can say where the cash sits.

As on the seller's side, the bank wins for cash and the ERP for what's owed; corrections post as journal entries, never edits. For audit the approval trail matters as much as the payment. Auditors test who approved and who released, as well as whether the money moved.

The buyer writes most of the rules, within limits others set.

Segregation of duties is the core buyer rule: vendor master, invoice entry, approval and payment release sit with different people, and auditors test it under SOX 404 at US public companies. Say one clerk can both add a new vendor and release the payment run: they could set up a fake supplier and pay it, and nobody else would see it until the audit.

Law steps in only where governments chose to protect suppliers. A US federal agency pays against "a proper and valid invoice", owes interest if it's late (4.75% for July to December 2026) and may take a discount only inside the window. Canada's federal construction law, in force since December 9, 2023, makes the Crown pay within 28 days of a proper invoice and gives each subcontractor tier 7 days to pay the next. I found no general private-sector prompt-payment law in either country: terms are contractual. So one supplier can be paid in 10 days by one customer and 90 by another, and both are within the rules.

A payment's cost, tax treatment and rights depend on the day it moved. Terms can start their clock at the invoice date, invoice arrival, goods arrival or month end, depending on the contract. Bank details have effective dates too, since many buyers hold payments to newly changed details. And 1099 thresholds follow the payment date rather than the invoice date. A freelance designer paid $1,500 over 2026 is under the new $2,000 threshold, so no 1099-NEC, though the same total paid in 2025 needed one.

So I'd store the terms, tolerance, tax threshold and bank details as they stood when each invoice was approved and each payment released, rather than a pointer to today's version.

AP speaks four families of standards, and the buyer picks which ones its suppliers must use.

• Orders and invoices: X12 850 (purchase order), 856 (ship notice) and 810 (invoice); UBL invoices on Peppol; the DBNAlliance exchange framework; emailed PDFs; supplier portals; and, for US federal suppliers, the Treasury's free Invoice Processing Platform.
• Payment instructions to the bank: Nacha files (CCD, CCD+, CTX); ISO 20022 pain.001, with pain.002 status reports back; check-print files plus Positive Pay issue files; card APIs and Visa straight-through messages; the CPA-005 file for Canadian AFT.
• Remittance: X12 820, CTX addenda, email or portal advices, and the ISO 20022 remittance model the Business Payments Coalition published in 2024.
• Bank reporting: BAI2, camt.053 and camt.054.

EDI (electronic data interchange) is still how large North American trading partners swap invoices. Ardent says the average organization can take electronic invoices from just over half its suppliers, but that counts a PDF by email that someone scans.

Where payment details get lost

1. Split channels. AP sends the money through the bank and the remittance by email, often to a generic inbox.
2. The bank portal truncates it to a short text field, even when the rail carries thousands of characters.
3. Empty fields. The ERP doesn't fill them: CTX can carry a full 820, if AP's system builds one.
4. One payment, many invoices. Batching makes remittance long, and long remittance gets dropped first.

Picture a distributor paying 40 invoices from one supplier in a single ACH credit, with "March invoices" typed into the bank portal's short text field. The supplier sees one lump sum and has to call, or guess, to match it to 40 invoices.

So on the buyer's side remittance is a choice. The rails can carry it, and AP decides whether to fill the fields, which is where the seller's cash-application problem starts.

Two kinds of network compete to own the connection to the supplier.

• Buyer-side networks: supplier portals, issuers' card enrollment programs, AP payment networks. Each portal is a walled garden: in the Fed's words, accounting systems are "closed-loop and not interoperable", so suppliers juggle many portals.
• Open exchange networks: DBNAlliance (a US e-invoice network launched in 2023 by Business Payments Coalition pilot participants), Peppol and EDI value-added networks. DBNAlliance uses Peppol's four-corner model, where a business joins through a service provider. Neither country has a national Peppol authority; OpenPeppol fills that role.

Virtual card acceptance is the network that surprises people. One corporate-payments company's annual filing says each issuer negotiates acceptance with each supplier, so issuers' virtual cards aren't interchangeable. Visa's Supplier Matching Service checks a buyer's vendor file against Visa's merchant data monthly to flag suppliers that take commercial cards, and issuers use it to size a program.

If your bank's card team has enrolled 400 of your suppliers to take its virtual card and you move the program to another issuer, that enrollment stays behind, and the new issuer starts its own campaign from zero.

AP sits under more layers than it looks, because it's a tax function, an internal-control function and a payments function at once.

The buyer rarely needs a license; the fintech in the middle often does. Taking a buyer's money and paying suppliers with it is money transmission under US state law unless a bank structure or exemption applies; one AP network's filing cites state rules requiring liquid assets of at least 100% of customer liabilities. FINTRAC, Canada's anti-money-laundering agency, has treated invoice payment services as money services businesses since April 27, 2022, exempting only an entity that receives payments for a payee without passing them on. The Bank of Canada has supervised payment service providers under the Retail Payment Activities Act (RPAA) since September 8, 2025. As I read it (and I'm no lawyer), an AP platform that holds buyer funds and pays Canadian suppliers is in scope for both, and the payee exemption doesn't help a payer's agent.

Most of an AP team's week is exceptions, and once money is released, every rail runs its own clock.

A PO for 1,000 cartons at $4.00 each comes back invoiced at $4.06. With a 2% price tolerance it passes on its own. At $4.20 it lands in the exception queue and waits for the requester, while the 10-day discount window keeps running.

Positive Pay defaults and stale-check periods vary by bank agreement and state law.

APQC's 2020 data put duplicate or erroneous payments at under 1% of disbursements for top performers and 2% for the bottom, usually from duplicate vendor records, a PDF re-sent after the paper copy, a renumbered invoice, or paying from a supplier statement.

With push payments the buyer has no right to take money back. After release every reversal is a request, and for fraud the window is hours.

In US business payments the sender usually carries the loss on a bad push, and almost everything AP sends is one.

Positive Pay loss-shifting comes from bank agreements rather than statute. Courts back the rest up: in Studco v. 1st Advantage (4th Cir., 2025) the receiving bank wasn't liable for a name and account mismatch that no employee actually knew about. Nacha's 2026 rules leave UCC 4A unchanged, and the US has no push-fraud reimbursement scheme like the UK's. Recovery is thin: in AFP's 2025 survey, a fifth of victims got nothing back. What a hub's payment "guarantee" covers is a contract question.

Since the buyer pays for a bad push, the cheap protection sits before release: verify the change, hold payments to new details, and have two people sign off.