Preventing Payment Fraud with SAP Advanced Payment Management and Business Integrity Screening

Compliance requirements, audit needs, and external factors such as embargoes and government-imposed sanctions are additional imperatives for corporates and financial institutions (FIs) looking to secure their end-to-end payment lifecycle. Protection must be in place from the moment a payment is triggered, or even before, until the payment reaches the intended recipient.

In a digitized world with increasing cybersecurity threats, it is becoming even more important for the payment process to be robust and supported by a strong technology infrastructure that provides security, speed, and efficiency.

What payment fraud challenges do corporates face?

The reality for many corporates is that they have multiple enterprise resource planning (ERP) systems, SAP or from other vendors, implemented over time, or multiple systems resulting from past M&A activity. As a result, these corporates often have numerous multi-banking relationships, different processes across the organization, and various systems or banking portals for making payments. In an ideal world, moving to a single system with focused banking relationships, centralized treasury management, and harmonized global processes is the end state every company wants to achieve. However, the journey to get there can be long.

How does SAP S/4HANA support payment centralization?

Companies using, or moving to, SAP as their primary ERP often aim for a single instance of the S/4 HANA landscape to create a single source of truth, though they may approach this in different ways. The journey is often long and complex. However, payment risk needs to be mitigated sooner rather than later.

Companies can adopt different strategies, such as 'Central Finance', 'Treasury First', or payment centralization through a Payment Factory (PF) solution, to enable quicker wins and improve security for the treasury and finance organization.

Advanced Payment Management Functionality

SAP introduced APM in 2019 to support payment centralization, visibility, and oversight for organizations using its systems. APM, together with In-House Bank, forms SAP's payment factory solution. SAP has continuously enhanced APM since its introduction, and the solution now includes relevant functionality, including anti-fraud measures, for users.

APM enables the centralization of payments and bank communication originating from any system, whether SAP or non-SAP, and facilitates:

• Data enrichment

• Data validations

• Conversion to bank-specific file formats where needed

• Batching, together with an approval mechanism through integration with SAP's Bank Communication Management option

• Secure single-channel communication with all banks, for example through SAP's Multi-Bank Connectivity, and

• Conversion or forwarding of bank statements to other systems, with connectivity to cash management

These measures enable treasury teams to gain central, near-real-time visibility of all outgoing payments, allowing corporate treasurers to put controls and checks in place through a robust payment approval mechanism.

A strong and auditable payment approval process governed by a unified system can help reduce payment fraud. However, payment approval alone is a relatively reactive mechanism and relies on human intervention, which can be time-consuming, labor-intensive, and prone to errors. At scale, this can increase the risk of some transactions being missed. A more advanced way to manage payment risk efficiently is through an exception-based process, where only the payments that require attention are routed for human review, while low-risk transactions are filtered through an automated rules engine that enables targeted focus on high-risk payments.

SAP offers different solutions that can be easily integrated with Advanced Payment Management to manage risks more effectively. Business Integrity Screening and Watch List Screening are examples of these solutions.

Why do corporates need SAP Business Integrity Screening (BIS)?

SAP Business Integrity Screening (BIS) is a solution that complements the payment engine of S/4 HANA, including the Advanced Payment Management (APM) function. BIS can be enabled on S/4 HANA. At a high level, it is a rules-based engine designed to detect anomalies and third-party risk. It uses data to predict and help prevent future occurrences of fraud risk.

By virtue of being on S/4 HANA, BIS can handle large volumes of payments and process them through real-time simulations. SAP BIS also integrates with different process areas, such as master data management, invoice processing, payment execution or payment runs, and APM for payments originating from other systems. This supports fraud prevention at a much earlier stage.

The below Figure 1 picture depicts a few of the features of BIS where a set of rules can be defined for different scenarios with certain SAP provided out-of-the-box rules, for example, identified risk factors might include:

• Supplier invoice and payment execution stages, like vendor invoices or bank accounts in high-risk countries

• One-time vendors

• Payments made too early

• Changes to vendor banking details just before a payment cycle

• Duplicate invoices

• Manual payments

BIS has a highly flexible detection and screening strategy for business partners where new rules can be added and it can make composite rule scenarios, resulting in an overall risk score being awarded. For example, a weighted score may be determined based on individual rules such as:

• Payment value banding

• Consecutive payments to the same beneficiary

• Beneficiary address in an 'at-risk' country

Using the power of S/4 HANA, every payment is processed through all the rules and strategies defined to detect anomalies as early as possible, with real-time alert mechanisms providing further security. Implementations can leverage out-of-the-box rules and create new rules based on internal knowledge to refine anti-fraud measures going forward. BIS also has powerful analytics through the SAP Analytics Cloud solution for evaluating the performance of each strategy and rule, enabling refinements to be made.

How does BIS integrate with APM?

For customers operating a single system environment, BIS was previously integrated with Payment Run functionality. With a multi-ERP Payment Factory landscape, BIS now integrates directly with APM. This means payments across the enterprise can be routed through screening for exception-based handling.

BIS combined with APM has two possibilities (as of writing this article):

• online screening for individual items

• or batch screening for larger volumes of payments

Rules can be set based on the size of payments as well, for example, low-value payments can be set for batch screening, while high-value transactions can be set for online screening.

In the current release BIS 1.5 (FPS00), there are pre-defined scenarios specifically for APM. These check recipient bank accounts, for example, in high-risk countries and so on, and business partner (payee) bona fides for sanction screening/embargo checks at the payment order/payment item level. Custom scenarios can be created, and further custom code enhancements built within SAP-provided enhancement points.

While screening online, APM payment orders are validated through BIS detection rules. Payments without any anomalies or risk scores below threshold are automatically approved and processed for further normal processing through APM outbound processing. Payments which are suspicious will be 'parked' in BIS for user intervention to either release the payment, remembering, it could be a false positive scenario, or for blocking.

Any blocked payment in BIS automatically moves the APM payment order to the Exception Handling queue within Advanced Payment Management for further processing, for example, taking corrective actions in source systems, validating internal processes, contacting the vendor, canceling/reversing a payment, and so on.

What is SAP Watch List Screening?

Watch List Screening is SAP's cloud-based subscription solution for restricted party or sanctioned party screening, as mandated by governments or governmental agencies such as the United Nations or the World Bank. The actual list of restricted or sanctioned parties is provided by a third party and is continuously updated and maintained by SAP in its cloud solution as part of the offering. When connected with APM through its native integration, any payment triggered or processed through APM is screened by SAP's Watch List Screening, using the recipient's details to perform compliance checks in real time. Any fallouts or exceptions are automatically captured or blocked. Further processing of blocked payments can be managed either manually or through rules. Watch List Screening can also be used to screen master data, such as business partners, at the time of creation or change.

How do APM, BIS, and Watch List Screening work together to prevent fraud?

There are different solutions available to address the specific needs of corporates across the payment lifecycle. A key first step is to centralize payments, where Advanced Payment Management can help. An important benefit of payment centralization in a corporate landscape is the opportunity to initiate centralized payment screening and fraud prevention using BIS.

The integration between BIS, Watch List Screening, and the APM Payment Factory enables effective payment fraud and sanction screening detection across the entire payment landscape. Adding Bank Communication Management for further approval control on an exception basis helps ensure a robust and automated payment process, with a strong focus on automated payment fraud prevention.

Once the payment process is secured, the next step is having secure connectivity to banks. This is where solutions like the SAP Multi-Bank Connectivity option can help.

Zanders supports corporates and financial institutions in designing and implementing SAP-based fraud prevention frameworks, including APM, BIS, and Watch List Screening. To discuss your current payment risk setup or explore next steps, contact us.