UCC 4A commercially reasonable security procedures, in plain words

Under UCC Article 4A, a commercially reasonable security procedure is a method the bank and its business client have agreed on for verifying that a payment order really comes from the client, judged reasonable for that particular client by a court. It matters because of what it buys the bank: a payment order verified under such a procedure binds the client even if the client never authorized it, provided the bank proves it accepted the order in good faith and followed the procedure (UCC §4A-202(b)). Reasonableness is decided on the client's own circumstances, the alternatives the bank offered and what similar banks and customers use, and a client that refuses a better procedure in writing can be held to the one it chose. Botminds' Treasury Management Agreement Search answers the factual half of that test for any disputed payment: what security procedure the client agreed to, from the version in force that day, and whether the payments hub shows it was followed.

The statutory text is quoted from the uniform act as published by Cornell's Legal Information Institute; each state enacts its own version, so check the governing state's text in a real case. The sample screens come from a fictional bank running the solution.

What is a commercially reasonable security procedure under UCC 4A?

It is an agreed verification method that a court finds reasonable for that client. Article 4A defines a security procedure as "a procedure established by agreement of a customer and a receiving bank for the purpose of (i) verifying that a payment order or communication amending or cancelling a payment order is that of the customer, or (ii) detecting error in the transmission or the content of the payment order" (UCC §4A-201). The same section lists what one may use: codes and algorithms, identifying words or numbers, encryption, callbacks and similar devices; how a callback is run on a wire is set out in wire callback procedures.

Two words in that definition do the heavy lifting. "Agreement" means the procedure has to be one the client accepted, which is why the signed schedule and its effective date matter. "Customer" means it is judged for the client in front of the court, not for customers in general. The signatures in a treasury management agreement covers how that acceptance is recorded.

Is a signature check a security procedure?

Not on its own. The statute says so in terms: "Comparison of a signature on a payment order or communication with an authorized specimen signature of the customer is not by itself a security procedure" (UCC §4A-201). A bank that verifies a faxed or emailed wire request only by matching the signature to a card on file has no security procedure to rely on, however carefully the comparison is done.

UCC 4A-202 in plain words

Section 4A-202 has two routes for making the client bear a payment order. The first is ordinary authority: an order is the client's if the client authorized it or is bound by it under the law of agency (§4A-202(a)). If the client's own named user entered and released it, that is usually the end of the question, even if the user was deceived. The second route is for orders the client did not authorize: they bind the client if the procedure was commercially reasonable and the bank proves good faith and compliance with the procedure "and any written agreement or instruction of the customer restricting acceptance of payment orders issued in the name of the customer" (§4A-202(b)).

The bank does not have to follow every message the client sends. It "is not required to follow an instruction that violates a written agreement with the customer or notice of which is not received at a time and in a manner affording the bank a reasonable opportunity to act on it." In Choice Escrow, a client email asking whether foreign wires could be blocked was held to be an inquiry, not an instruction, because the client did not press it after the bank said it could not block foreign wires alone (Choice Escrow, 8th Cir. 2014).

What makes a security procedure commercially reasonable?

Fit to the customer, more than strength in the abstract. Section 4A-202(c) makes reasonableness a question of law for the judge, decided on four things: what the client told the bank it wanted, what the bank knew about the client, including the size, type and frequency of its usual payment orders, the alternatives the bank offered, and what banks and customers in a similar position generally use. The subsection is quoted in full, with how each side's liability follows from it, in bank liability for wire fraud.

The last factor moves with time. The interagency authentication guidance of 2021 replaced the 2005 guidance and its 2011 supplement that earlier cases relied on, and it says that compromise of customer accounts "has shown that single-factor authentication, either alone or in combination with layered security, is inadequate in many situations" (FFIEC, Authentication and Access, 2021). It names the controls available to business customers: positive pay and debit blocks, transaction alerts, supplementary controls for a client's own administrators, and dual control, so that "more than one employee" must "authorize and approve certain transactions." A procedure in general use is evidence; a procedure the bank offered and the client declined is better evidence.

The cases show the factors at work. In Patco, a bank that knew its payroll client's pattern and measured departures from it, but acted on none, failed the test. In Choice Escrow, passwords, device authentication, daily limits and an offer of dual control passed it. The three leading cases, side by side follows each to its result.

The deemed-reasonable route: refusal in writing

Article 4A gives a bank one way to take reasonableness off the table. A procedure counts as commercially reasonable by law if the client picked it after turning down one that was reasonable for it, and agreed in writing to be bound by any order issued in its name and accepted under the procedure it chose, authorized or not (UCC §4A-202(c); the subsection's words, and why every corporate policy should use them on purpose, are in the corporate account takeover policy guide). Three things must be provable: the offer, the refusal and the written agreement to be bound.

The sample client's file holds all three on one page. Section 4.5 of its 2025 amendment records that the bank offered a verification call on every payment order, that the client declined it in writing and that it selected the procedure in section 4.2 instead, signed by its Chief Financial Officer. The weakest version of the same evidence is a note in a relationship manager's file that the client "didn't want call-backs."

The agreed procedure, the refused option and the client's acknowledgment, each with its page

Can an agreement make a security procedure reasonable?

Not by saying so. A master agreement may include a clause like the sample's section 7.3, in which the client agrees that the bank's procedures are commercially reasonable for it. But the statute makes reasonableness "a question of law," and §4A-202(f) says the rights and obligations in §4A-202 and §4A-203 "may not be varied by agreement" except as those sections allow. Read together, an acknowledgment clause is evidence of the client's expressed wishes and of what it was told, not a substitute for the court's finding.

What is a UCC 4A disclosure?

It is not a term Article 4A uses. The Article's sections cover definitions, security procedures, acceptance, execution, payment and variation by agreement; none is titled or framed as a disclosure (UCC Article 4A, table of contents). Consumer transfers governed by the Electronic Fund Transfer Act, which has disclosure rules of its own, are outside Article 4A altogether (§4A-108).

What a bank does need to be able to show is the substance the deemed-reasonable route and §4A-202(b) depend on: that the client was told what the procedure is, what alternatives were available and what it means to be bound by orders verified under it, and that it agreed in writing. Whatever a bank calls the document that does that, its value in a dispute is the signature, the date and the text as it stood when the order was accepted.

The client's escape in 4A-203

Even with a reasonable procedure, followed in good faith, the client can shift the loss back. The bank "is not entitled to enforce or retain payment" if the client proves that the breach behind the order traces neither to a person it entrusted with duties for its payment orders or security procedure, nor to someone who got access to its transmitting facilities or obtained, "from a source controlled by the customer," information that facilitated the breach, "regardless of how the information was obtained or whether the customer was at fault" (UCC §4A-203(a)(2)). Information includes "any access device, computer software, or the like."

In practice the escape is narrow when credentials were stolen from the client's own computers, as in all three leading cases. It is the reason a bank's answer should state what it does not decide: whether the order was induced by fraud, and where the breach happened.

Following the procedure is half the test

The best procedure on paper does not help a bank that cannot show it was applied to the order in dispute. Experi-Metal v. Comerica is the warning: the court found the procedure reasonable and found the bank complied with it, then held the bank liable because it could not prove good faith in how it responded to the attack (Experi-Metal, E.D. Mich. 2011). Compliance has to be shown order by order, from the payments hub's own record.

The procedure the client agreed to, beside what the payments hub recorded

That pairing is what the solution produces for every question, and overnight for every client, so drift between the agreed procedure and the actual one, such as a two-approver schedule with only one entitled releaser, shows up before a dispute does. The product is at Treasury Management Agreement Search; the 90-day and one-year clocks cover what happens after the client objects.

Questions people ask

What does UCC 4A-202 say?

It says when a payment order binds the client: if the client authorized it, or if it was verified under a commercially reasonable security procedure that the bank followed in good faith, respecting the client's written restrictions. Subsection (c) lists the factors for reasonableness and the deemed-reasonable route, and (f) bars varying these rules by agreement except as the sections allow.

Is dual control required by UCC 4A?

No. Article 4A requires no particular procedure; it asks whether the agreed one was reasonable for the client. Dual control matters because the FFIEC's 2021 guidance names it among the controls available to business customers, and because a client that refuses it in writing can be held to the procedure it chose, as in Choice Escrow.

Who decides whether a security procedure is commercially reasonable?

A court, as a question of law under §4A-202(c). A clause in which the client agrees the procedures are reasonable is evidence of its wishes and circumstances, but it does not make the procedure reasonable by itself.

Does the bank have to prove it followed the procedure?

Yes. Under §4A-202(b) the bank must prove it accepted the order in good faith, followed the security procedure and honoured any written restriction from the client. That proof comes from the payment order's own record: entry, release, credentials and the limit checks that ran.

What happens if the procedure was not commercially reasonable?

Then a verified order does not bind the client unless the client actually authorized it, and the bank must refund what it cannot enforce, with interest from the date it received payment (UCC §4A-204(a)). The client loses the interest, not the refund, if it fails to report within a reasonable time, at most 90 days.