Bacs payment controls are the policies, system checks, approval steps, and monitoring activities that help UK accounts payable teams send the right payment to the right supplier account at the right time.
The UK does not use ACH as its domestic payment network. Instead, UK finance teams typically use Bacs Direct Credit, Bacs Direct Debit, Faster Payments, and CHAPS, depending on the payment type, urgency, value, and supplier requirements.
Bacs remains one of the UK’s most widely used payment systems. In 2025, it processed 6.86 billion payments worth £6.05 trillion, including 5 billion Direct Debits.
A strong UK payment control framework combines sort code and account number validation, supplier ownership checks, segregation of duties, approval thresholds, payment holds, exception queues, and post-settlement reconciliation. Teams looking to automate these checks can explore Trustpair’s automated bank account validation solution for the UK.
Key Takeaways
• Bacs Direct Credit is commonly used for payroll and planned supplier payments, while Bacs Direct Debit is used to collect authorised payments.
• Faster Payments support near-instant transfers, while CHAPS is designed for same-day, high-value or time-critical sterling payments.
• A valid sort code and account number do not prove that the account belongs to the intended supplier.
• Payment preparation, approval, bank submission, and reconciliation should be separate stages.
• UK payment controls should reflect FCA expectations, PSR requirements, the Direct Debit Guarantee, and UK GDPR security obligations.
Why Do UK Businesses Need Bacs Payment Controls?
Bacs payment controls help finance teams balance fraud prevention, cash flow, supplier relationships, payment timing, and operational efficiency.
A typical procure-to-pay process includes supplier onboarding, invoice capture, invoice approval, payment preparation, payment execution, bank submission, settlement, and reconciliation. Each stage can create risk if it depends on manual processes or incomplete supplier data.
Supplier payment fraud can occur when criminals impersonate a genuine supplier, compromise a supplier’s email account, create a fictitious supplier, or alter bank details in an accounting system.
An approved invoice does not prove that the payment will reach the correct supplier. The invoice may be genuine while the bank details have been changed.
Payment automation can reduce manual payment tasks, duplicate data entry, and payment processing costs. It can also help AP teams schedule payments accurately and capture early payment discounts without bypassing approval controls.
The goal is not to release every payment automatically. The goal is to automate repetitive work while escalating supplier bank detail changes, unusual transactions, duplicate invoices, and other exceptions for independent review.
Which UK Payment Methods Should AP Teams Control?
UK payment controls should reflect the characteristics of each payment rail.
| Payment method | Typical use | Main advantage | Main control concern |
|---|---|---|---|
| Bacs Direct Credit | Payroll, supplier payment runs, planned transfers | Suitable for high-volume scheduled payments | Incorrect account details and batch errors |
| Bacs Direct Debit | Authorised recurring collections | Predictable collections | Unauthorised or unexpected debits |
| Faster Payments | Everyday and urgent UK transfers | Usually received within seconds, 24/7 | Faster release leaves less time for intervention |
| CHAPS | High-value or time-critical sterling payments | Same-day settlement | Higher risk if details are incorrect or fraudulent |
| International payment | Overseas suppliers | Global reach | Exchange rates, fees, sanctions, and local requirements |
How Do Bacs Direct Credits Work?
Bacs Direct Credit is a push payment used to send money from one UK account to another. It is commonly used for payroll, pensions, benefits, expense reimbursements, and supplier payment runs.
The payer prepares and authorises the payment file, which is submitted through its bank or payment service provider. The receiving bank then credits the supplier’s account.
Bacs is well suited to planned payment cycles, but AP teams must account for file submission deadlines and the payment’s scheduled processing date. A last-minute request may require a different payment method, such as Faster Payments or CHAPS.
How Do Bacs Direct Debits Work?
Bacs Direct Debit is a pull payment. A supplier or service provider collects funds from the payer’s account after receiving authorisation.
Direct Debits are commonly used for utilities, insurance, software subscriptions, leases, memberships, and other recurring obligations.
The Direct Debit Guarantee provides protections where a payment is taken in error or without the required notice. Organisations should still maintain their own creditor lists, payment limits, authorisation records, and monitoring controls.
When Should AP Use Faster Payments?
Faster Payments are designed for UK account-to-account payments that need to arrive quickly. Pay.UK describes the Faster Payment System as a 24/7 real-time payment service, with eligible payments normally received within seconds.
Faster Payments may be appropriate for urgent supplier payments, one-off transfers, or payments that cannot wait for the Bacs processing cycle.
The faster settlement time also creates more pressure on preventive controls. A payment released to the wrong account may be difficult to recover, even where the business identifies the error quickly.
When Should AP Use CHAPS?
CHAPS is a sterling same-day payment system used for high-value wholesale payments and time-critical transactions, including property purchases.
CHAPS should generally require enhanced approval because payments are often high value, urgent, and difficult to recover once processed.
How Should UK AP Teams Validate Supplier Bank Details?
Supplier bank detail verification should confirm more than whether a sort code and account number are correctly formatted.
What Should Sort Code Validation Include?
A UK sort code is a six-digit code that identifies a bank or building society branch. Validation should confirm that the sort code is valid, active, and compatible with the intended payment method.
AP teams should also check the account number, account type, beneficiary name, bank name, and relevant supplier information. Since a valid sort code only identifies the financial institution—not the account holder—these checks should be combined with independent account ownership verification. Trustpair’s guide to sort code checkers and UK bank account verification explains how these checks support safer supplier payments.
How Should AP Verify Supplier Account Ownership?
Supplier account ownership should be verified before the first payment and after every change to bank details.
Independent confirmation may involve:
• Calling a trusted supplier contact using a number already held in the supplier record
• Using an approved supplier portal
• Checking the account through a trusted account validation service
• Confirming the change with a previously approved contact outside the communication channel used to request it
AP should not rely solely on the email, phone number, or attachment included in a bank detail change request. If a supplier’s email account has been compromised, the fraudster may control all three.
Confirmation of Payee can provide an additional name-matching check where available, but it should not replace independent supplier verification. A close match does not necessarily confirm that the supplier requested the payment or that the account is free from fraud risk.
Each verification should be recorded in the supplier master file, including the date, method, reviewer, details checked, result, evidence, and approval decision. For a practical process, AP teams can follow Trustpair’s guidance on supplier bank detail changes.
What Should Happen When Supplier Details Cannot Be Verified?
When supplier bank details cannot be verified, AP should place the payment on hold and prevent release until the issue is resolved.
A hold is appropriate when:
• The sort code or account number is invalid
• The account holder does not match the supplier
• Bank details changed shortly before payment
• The supplier cannot be reached through a trusted channel
• A required Direct Debit authorisation is missing or expired
• The payment amount or destination is unusual
• The request includes pressure to bypass normal procedures
Acceptable release documentation may include independent callback notes, account validation results, supplier confirmation from a trusted contact, supporting onboarding documents, and written approval from an authorised treasury or finance leader.
An approved invoice is not sufficient evidence that the bank account belongs to the supplier. Because payment requests can originate from a compromised supplier mailbox, AP teams should independently verify every bank detail change and follow a documented process for spotting and stopping supplier email compromise.
How Should the UK Payment Release Workflow Work?
The payment workflow should separate preparation, approval, bank submission, and reconciliation.
The preparer selects approved invoices, confirms supplier and payment data, checks the payment method, reviews system warnings, and submits the payment batch for approval.
The approver reviews the batch independently, checks high-risk transactions, verifies that holds have been resolved, and approves or rejects the payment.
The bank submission stage sends the approved file or payment instruction through the relevant payment service provider. The system should record when the payment was submitted, accepted, rejected, or partially processed.
The reconciliation stage compares bank statements and payment reports with the approved payment population. Any missing, duplicated, returned, or unexpected transaction should remain open until resolved.
High-risk payments should require dual approval. Risk factors may include payment value, a new supplier, changed bank details, an urgent Faster Payment, a CHAPS transaction, an unusual payment amount, or a new Direct Debit instruction.
How Should Payment Automation Support These Controls?
Accounts payable automation can connect invoice capture, accounting software, approval workflows, supplier records, payment execution, and reconciliation.
Optical character recognition can extract information from invoices received as PDFs, scans, email attachments, or paper documents. The extracted data can then support purchase order matching, duplicate invoice detection, approval routing, and payment scheduling.
Automation should not assume that extracted data is accurate or that an invoice is legitimate. Supplier identity and bank account ownership still require separate checks.
A controlled payment platform should also support:
• Multi-factor authentication
• Encrypted data
• Role-based access
• Segregation of duties
• Approval thresholds
• Duplicate invoice detection
• Supplier bank detail change workflows
• Exception queues
• Audit logs
• Payment reconciliation
What UK Compliance Requirements Should AP Consider?
UK payment controls should reflect the payment method, the organisation’s bank agreements, relevant contractual obligations, and applicable regulation.
What Is the Role of the FCA and PSR?
The Financial Conduct Authority supervises relevant financial services firms, while the Payment Systems Regulator oversees payment system rules and participant obligations.
The FCA states that reimbursement rules for authorised push payment fraud through Faster Payments and CHAPS came into force on 7 October 2024.
These rules do not replace preventive controls. Organisations should still validate supplier accounts, maintain clear approval procedures, and retain evidence of payment decisions.
What Does UK GDPR Require?
UK GDPR requires organisations to process personal data securely using appropriate technical and organisational measures. The ICO identifies integrity, confidentiality, access controls, and protection against unauthorised processing as key security principles.
Payment systems should therefore limit access to supplier and bank data, use appropriate encryption, protect authentication credentials, and maintain audit logs.
How Should Direct Debit Authorisations Be Retained?
Organisations should retain evidence of Direct Debit authorisations, amendments, cancellations, notices, and payment disputes in a reproducible format.
The retention period should reflect the Direct Debit rules, the organisation’s legal retention schedule, bank requirements, contractual obligations, and audit policy.
How Should AP Manage Exceptions, Returns, and Reconciliation?
Exception queues should have a named owner, resolution deadline, escalation path, and documented outcome.
Common queues include invalid sort codes or account numbers, duplicate payments, rejected Bacs files, unexpected Direct Debits, unusual Faster Payments, incorrect beneficiary details, and payment instructions that do not match the approved supplier record.
Returned or rejected payments should not be silently resubmitted. The reviewer should identify the cause, correct the underlying data, confirm that the original payment did not settle, and approve any resubmission.
Reconciliation should compare the bank report with the approved payment population using the supplier name, account number, sort code, amount, payment date, reference, payment method, and settlement status.
Supplier payment controls should also be tested using realistic scenarios, including a new supplier, a bank detail change requested by email, a duplicate invoice, a high-value CHAPS payment, an urgent Faster Payment, a rejected Bacs file, an unexpected Direct Debit, and a payment prepared by an unauthorised user. These tests should also confirm that supplier records remain accurate, as explained in Trustpair’s UK vendor master data controls guide.
How Can UK Businesses Measure Payment Controls?
Useful metrics include:
• Percentage of active suppliers with verified bank details
• Payment exception volume and resolution time
• Unauthorised Direct Debit attempts
• Duplicate payment incidents
• Rejected Bacs files
• High-risk payments released with dual approval
• Reconciliation completion rate
• Supplier bank detail changes independently verified
• Payment processing cost per transaction
• Payment delays caused by unresolved exceptions
These measures help finance teams evaluate both fraud prevention and operational efficiency.
UK Payment Control Checklist
Before releasing a supplier payment, AP should confirm that:
- The supplier has verified bank details.
- The sort code and account number are valid.
- Account ownership was confirmed before the first payment.
- Changed bank details were independently verified.
- The invoice is approved and not duplicated.
- The payment method matches the supplier agreement.
- The preparer and approver are different people.
- High-risk payments received dual approval.
- Any payment hold has a named owner.
- Rejected, returned, and unexpected transactions were reconciled.