Payment investigation process: seven steps and the rule behind each

The payment investigation process is the sequence a bank follows when someone questions a payment that has already been sent or received: take in the request, identify the payment, trace what happened to it, decide what the facts mean, act on that decision, reply with the right approvals, and close the case so the cause can be fixed. Each step answers to a rule. The funds-transfer rules of UCC Article 4A decide when a payment was accepted and who owes what; the Reserve Banks' operating circulars and Fedwire's message formats decide how banks talk to each other; and supervisory expectations decide who must approve a correction and what records survive. Botminds' Payment Investigations runs the same seven steps: agents read, trace and draft, and the analyst and team lead decide.

What are the steps of a payment investigation?

Seven, though banks name them differently: intake, identification, tracing, determination, action, reply and approval, and closure. The first three are research and can be fast, because the evidence is in the bank's own systems or in messages it can send. The fourth is judgement. The fifth and sixth commit the bank, in money or in words. The seventh is where a desk either learns or repeats itself.

Step 1: intake, and the deadline someone else set

Intake turns a message into a case with an owner and a deadline. Requests arrive as structured ISO 20022 messages from correspondents, as free-format SWIFT messages, as Fedwire return requests, and as emails and calls from clients and branches. Each needs the same few facts extracted: who is asking, about which payment, what they want, and by when. The deadline may be the requester's, written into the request in their own time zone, and it sets the pace of everything after it.

Intake is also a control point. An inquiry about a client's payment from an unfamiliar address may be a fraud attempt rather than a service request, and should not be answered until the sender is verified through the bank's own procedure. How intake should sort requests by what the sender wants, before any research starts, is covered in payment inquiry management.

Step 2: identify the payment, once and correctly

A case about the wrong payment is worse than no case, so identification is its own step. The strongest key is the UETR, the unique end-to-end transaction reference: on Fedwire it is mandatory on every value message in the ISO 20022 format (FRFS Format FAQs), and in cross-border traffic it travels with the payment through every bank. Fedwire's own input and output references, the IMAD and OMAD, identify each leg on that network. Where a request carries none of these, the match falls back to amount, date and parties, and the case should say so.

Identification also merges duplicates. A correspondent may send an investigation request and, minutes later, a cancellation request about the same payment; a client may call while the correspondent writes. Linked by the payment's reference, they become one case with one owner and one consistent answer.

How do banks trace a wire transfer?

Inside the bank first, then along the chain. Inside, the payment leaves a trail: the message in the payments hub, its status in the gateway, the posting in the core and any entry in a suspense account. On Fedwire, a value message in process produces a pacs.002 with status PDNG, followed by close of business with ACSC (accepted, settlement completed) or RJCT (rejected) (FRFS Format FAQs), so "did it settle?" can be answered from the bank's own records.

Outside, the investigator asks the next bank, with a status request (pacs.028) or an investigation request (camt.110), and waits. Operating Circular 6 lists requests for information among the messages that move no money, and expressly imposes no obligation on participants to respond to them (§8.1.3). Whether, and how fast, the other bank answers is a matter of agreements and practice, which is why tracing time is mostly waiting time. Who the investigator waits on, and for what, is the subject of the payment investigation job description.

When is a wire payment accepted?

The trace has to establish one legal fact above all: when each bank accepted the payment order. A receiving bank other than the beneficiary's bank accepts when it executes the order. A beneficiary's bank accepts at the earliest of paying the beneficiary or notifying it of the credit, receiving payment of the entire amount of the sender's order, or the opening of the next funds-transfer business day after the payment date if the order is covered by a withdrawable balance and not rejected within an hour (UCC 4A-209). The whole funds transfer is complete at that moment, when the beneficiary's bank accepts (4A-104(a)); what each sender may claim if it never gets there is set out in why a wire is returned.

Acceptance matters because it changes every later step. Before it, a sender's cancellation can still work if it arrives in time. After it, cancellation needs the receiving bank's agreement. And once the beneficiary's bank has accepted, it owes the beneficiary the money, so a beneficiary's bank that has not paid is a different case from a payment that never arrived. When the beneficiary is treated as paid is governed by 4A-405: for a credit to an account, when the beneficiary is notified of the right to withdraw it, the bank lawfully applies it to a debt, or the funds are otherwise made available.

Step 4: determine what the facts mean

Determination is where the facts meet the rules, and where the process needs a person. The common determinations are a handful. Was the name and account number a misdescription, and did the bank know (4A-207)? Did a bank execute the order wrongly, by sending too much, sending it twice or paying the wrong beneficiary (4A-303)? Was it late because of improper execution, so interest is owed (4A-305)? Was the sender not obliged to pay, so a refund with interest is due (4A-402(d))? Can a cancellation still work (4A-211)? Each answer depends on the facts found in step 3 and on the agreements between the parties.

A proposal with its reasons, waiting for a person to decide

The agents can make determination faster by laying the evidence beside the rule. They should not make it final. A determination that the bank misapplied a payment is an admission; a determination that it did not may turn away a valid claim. Why the first of those in particular belongs to a person is set out in UCC 4A-207.

When does an investigation become a cancellation request?

When the sender wants the money back rather than an answer, and that is possible only up to a point. Before the receiving bank accepts the order, a cancellation works if the cancellation arrives in time for the bank to act. After acceptance, only if the receiving bank agrees or a system rule allows it, and at the beneficiary's bank only where the order was unauthorized or the sender's mistake produced a duplicate, a payment to the wrong beneficiary, or an amount larger than the beneficiary was entitled to (UCC 4A-211). An order that is never accepted is cancelled by operation of law at the close of the fifth funds-transfer business day after its execution or payment date.

On Fedwire, the Reserve Banks forward a cancellation or return request but have no obligation to act on it themselves (Operating Circular 6, §8.1.4). A return request travels as a camt.056; the answer as a camt.029; the money, if returned, as a pacs.004. For an operational cancellation (a duplicate, a wrong amount) the investigation process handles it. For a fraud recall, where hours decide whether money can be recovered, the playbook is different; Botminds' Wire Recall Management is built for that.

Step 5 and 6: act, reply, and who approves a correction or a claim

Acting means changing money or making a commitment, so it pairs with approval. A correction reverses one posting and makes another, which can be value-dated to the original payment date; a return sends funds back; a claim payment pays interest or fees; a reply may admit the bank's error. Each of these should be prepared by one person and approved by another with authority for the amount. The FFIEC's wholesale booklet expects an officer to review and approve corrections, reversals and other adjustments, and supervisors to review the reasons for them.

In Payment Investigations, any draft that admits liability, moves money, pays a claim or sends a customer notice goes to a team lead; the maker cannot approve it, a checker who edited it cannot either, and corrections above the lead's limit ($250,000 in the sample settings) and claims above $10,000 go to the Head of E&I. Approval posts the correction and sends the replies in one signed step, with the reason kept on the case. Routine replies, such as a status answer that admits nothing and moves no money, the analyst sends directly.

How is a payment investigation closed?

With its evidence, its outcome and its cause recorded, so that the case can be produced later and the cause can be fixed. The closing record should say what was asked, what was found, what was decided and why, what was sent and posted, who approved it, and how long the case waited on whom. Under 31 CFR 1010.430(d), the records the BSA rules require are kept for five years (eCFR).

The cause is where the process pays for itself. A correspondent that keeps keying the wrong account number, a client whose remittance data cannot be applied, a cutoff the repair queue keeps missing: each produces cases until someone acts upstream. The CPMI made the same point about data quality: "Correct account information will reduce the number of returns and misapplied payments and will result in fewer exceptions and investigations, potentially leading to reduced costs." (CPMI, harmonised requirements, 2026). In Payment Investigations, the trends agent summarizes repeat issues by correspondent and cause and drafts a note for the relationship manager; it never contacts the correspondent itself, and a change to a control, such as a name-check threshold, is a proposal for the administrator and the Head of E&I.

Payment Investigations' deadline view: risk, reasons and who moves the work

Questions people ask

What is the difference between an investigation and a recall?

An investigation answers a question about a payment and corrects what went wrong: non-receipt, a misapplied credit, an interest claim, an operational cancellation. A recall is the sender's attempt to get money back after it has been paid away, most urgently after fraud. They share messages (camt.056 and camt.029) but not their pace or their playbook.

How long does a payment investigation take?

No regulator publishes an industry figure. The research inside the bank can be quick when its systems can be read; the waits on other banks, which no Fedwire rule obliges to answer a request for information, can set the pace. A bank can measure its own process by recording, on every case, whom it was waiting on and since when.

Who does a payment investigation?

A payment investigations or exceptions and investigations (E&I) team in payment operations, with a team lead who approves corrections and claims. Compliance and Financial Crimes handle cases that touch sanctions or suspicious activity, and relationship managers take up repeat issues with correspondents.

What is a funds transfer business day on Fedwire?

It begins at 9:00 p.m. ET on the preceding calendar day and ends at 7:00 p.m. ET; Saturdays, Sundays and the Reserve Banks' holidays are not business days. Investigation and return request messages have a 7:00 p.m. ET cutoff, and many Article 4A clocks count in funds-transfer business days.

What happens to a wire that the beneficiary's bank cannot apply?

If the beneficiary's bank cannot identify the beneficiary, acceptance cannot occur and the order is not completed; if it does not accept the order, the order is cancelled by operation of law at the close of the fifth funds-transfer business day. In practice the bank can ask the sender for better details, for example with a camt.110 of type Unable To Apply, and return the funds if it cannot apply them.

Can an investigation be closed without a reply?

It should not be. Even a case resolved internally, such as a duplicate request already answered on another case, should record why it was closed and point to where the answer went, so the record shows the request was not ignored.