Rules and risks

How the rules work

For AP, the gap between written and enforced rules is mostly tax and fraud.

• 1099 thresholds jumped. A July 2025 federal law raised the 1099-NEC and most 1099-MISC thresholds from $600 to $2,000 for payments after December 31, 2025, indexed from 2027, with backup withholding on the same floor. Card payments go on Form 1099-K, filed by whoever settles them, and its threshold is back to more than $20,000 and 200 transactions. So paying a supplier by card moves its tax reporting out of AP.
• Canada's T4A rule is written, and mostly not enforced. Fees for services over $500 a year belong in box 048, but the CRA hasn't charged box-048 penalties since a 2011 moratorium, except on trucking payments from the 2025 tax year.
• Canadian input tax credits are enforced on the invoice. From $100 the buyer needs the tax charged and the supplier's GST/HST number; from $500, also its own name, a description and terms. In Canada, invoice validation is a tax control.
• Nacha now reaches into AP. Since June 22, 2026, every business that originates ACH credits must run risk-based processes "reasonably intended to identify" payments that are unauthorized or "authorized under False Pretenses", which covers BEC and fake suppliers. Beyond the account checks in primitive 1, Nacha suggests a daily review of existing payees moving to new accounts. The buyer's bank enforces it, and UCC 4A doesn't change. It's the first ACH rule to put a monitoring duty on AP itself.
• UCC 4A is enforced by courts, after the fact. The security procedure in the bank agreement decides most cases.
• Supplier finance is visible now. FASB's ASU 2022-04 makes buyers disclose program terms, the confirmed amount outstanding, where it sits on the balance sheet and, for fiscal years starting after December 15, 2023, a rollforward. It changes disclosure only; the accounting stays the same. IFRS reporters, Canadian public companies included, have had similar IAS 7 and IFRS 7 rules since January 1, 2024.
• E-invoicing is voluntary. The US has no business-to-business mandate, and DBNAlliance publishes no adoption volumes. The CRA's 2025-26 plan committed to evaluating e-invoicing for GST/HST compliance; the 2026-27 plan doesn't mention it.

What mistakes cost

AP mistakes cost five ways: cash, double payment, tax, supplier goodwill and audit findings.

• Cash. The FBI's internet crime center (IC3) logged about $3B in reported BEC losses in 2025, and three in four organizations in AFP's 2026 survey saw BEC attempts. In one AFP case a vendor bank change took three payments totaling $150,000, and $915 came back.
• Double payment. After a BEC loss the real supplier is still owed.
• Tax. A missing TIN means a 24% withholding duty and IRS notices; a bad GST/HST number puts the credit at risk.
• Supplier goodwill. Late payments bring dunning, late fees and credit holds. Missed discounts cost about 37% a year and never show up as a line item.
• Audit. A vendor-master change without segregation of duties, or a manual payment that skipped approval, becomes a control deficiency.

The cheapest defense works: in AFP's 2026 survey, nearly every organization calls suppliers back on a number already on record, and about two-thirds rate it "very effective".