Payment reconciliation is the process of comparing your own financial records against the statements produced by your bank or payment processor, identifying every difference, and resolving each one until both sides agree to the dollar. Done regularly, it catches data-entry mistakes, timing gaps, processor fees, and unauthorized activity while there is still time to act. Done late or not at all, it can cost consumers their federal fraud protections and expose businesses to tax, securities, and payment-card penalties.
What You Need Before You Start
Reconciliation pulls from two sides. Internal records come from accounting software, a manual check register, or a bookkeeping ledger. Each entry should carry the transaction date, the dollar amount, and a reference number such as a check number or invoice ID. Without unique identifiers, matching becomes guesswork.
External records are the bank statement, credit card processor reports, and merchant account summaries, usually available through an online portal or a monthly mailing. The fields that matter are the cleared amount, the date the institution processed the transaction, and any transaction or merchant identification codes. Those codes let you trace a discrepancy back to a specific payment instead of scanning a full month of activity.
If you run in-person sales, add point-of-sale batch reports. These show each day’s card transactions grouped into settlement batches, with terminal numbers identifying the register. The difference between gross sales and the net deposit into your merchant account is typically processing fees, chargebacks, and holds. Without batch-level detail, those deductions look like missing money.
Working Through the Comparison
The core of the work is a line-by-line check. Every transaction on the bank statement is matched against a corresponding entry in your records. When the amount, date, and reference number line up, the item is marked as cleared.
Unmatched items fall into predictable categories. Deposits in transit have been recorded internally but haven’t reached the bank yet. Outstanding checks were issued but haven’t cleared. Bank fees, interest credits, and automatic debits often show up on the statement without a matching ledger entry because no one recorded them at the time. Each item gets added to either the adjusted bank balance or the adjusted book balance.
The target is a zero difference between the two adjusted totals. If the numbers still don’t match, something is wrong. Common causes are transposed digits, duplicate entries, payments recorded in the wrong amount, and occasionally unauthorized transactions. You aren’t finished until every dollar is accounted for and both sides agree exactly.
Checks that stay outstanding for months need a closer look. Every state has unclaimed property laws requiring businesses to turn over stale-dated checks and other dormant financial obligations to the state after a waiting period, typically three to five years depending on the jurisdiction. Before that transfer, the business generally must send a written notice to the payee’s last known address giving them a chance to claim the funds.1U.S. Department of Labor. Introduction to Unclaimed Property Reconciliation is often where these aging items first surface.
Reporting Errors You Find
Reconciliation is where consumers first notice unauthorized charges, double billing, and deposits that never posted. Federal law gives you real rights when that happens, but the clock starts running the day your statement is issued. The rules split by account type.
Debit Cards and Bank Accounts
The Electronic Fund Transfer Act and its implementing Regulation E cover debit card transactions, ATM withdrawals, direct deposits, and other electronic transfers from bank accounts. If you spot an error or an unauthorized charge, you have 60 days from the date the bank sent the statement to notify the institution in writing or electronically.2eCFR. Procedures for Resolving Errors 12 CFR 205.11
Your financial exposure tracks how fast you report. Notify the bank within two business days of learning that someone has your card or credentials, and your liability caps at $50. Wait longer than two business days and your exposure rises to $500. Miss the 60-day window after the statement is sent, and you can be held responsible for the full amount of any unauthorized transfers that occur after that deadline.3Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability for Unauthorized Transfers That last scenario is where reconciliation failures cost people the most. Someone skimming $200 a month from an account nobody reviews can drain thousands before the account holder ever notices.
Once the bank receives your dispute, it has 10 business days to investigate. If it needs more time, it can extend the review to 45 calendar days, but it must provisionally credit your account within those first 10 days so you aren’t out the money while the investigation continues. The bank must report its findings within three business days of finishing and correct any confirmed error within one business day.4Consumer Financial Protection Bureau. Procedures for Resolving Errors 12 CFR 1005.11
Credit Cards
Credit card billing disputes fall under the Fair Credit Billing Act, which works on a similar 60-day timeline. Send a written dispute to the card issuer’s billing inquiry address within 60 days of the first statement showing the error. The issuer must acknowledge the dispute in writing within 30 days and resolve it within 90 days.5Federal Trade Commission. Using Credit Cards and Disputing Charges While the dispute is pending, the issuer cannot report the amount as delinquent or try to collect on it. Credit card protections are generally stronger than debit card protections, because you’re disputing charges on the issuer’s money rather than trying to recover your own.
How Long to Keep the Records
The IRS requires every taxpayer to keep records sufficient to support the income, deductions, and credits reported on a return. The burden of proof falls on the taxpayer to substantiate those entries.6Internal Revenue Service. Recordkeeping Reconciliation records and bank statements are the backbone of that documentation.
The general retention rule is three years from the date the return was filed.7Office of the Law Revision Counsel. 26 USC 6501 – Limitations on Assessment and Collection Returns filed before the due date are treated as filed on the due date, so the clock doesn’t start early just because you file in February. The window stretches to six years if you omit more than 25% of the gross income shown on the return, or if the omitted income comes from foreign financial assets exceeding $5,000.8Internal Revenue Service. Topic No 305 Recordkeeping For fraudulent returns, or if no return was filed at all, there is no statute of limitations and records should be kept indefinitely.9Internal Revenue Service. How Long Should I Keep Records
Employers face a longer clock for payroll. The IRS requires all employment tax records to be kept for at least four years after filing the fourth-quarter return for the year. Those records must include wage amounts and dates, employee Social Security numbers, copies of W-4 withholding certificates, tax deposit dates and amounts, and documentation supporting any claimed credits.10Internal Revenue Service. Employment Tax Recordkeeping The four-year payroll rule outruns the three-year income tax rule, and missing that distinction is a common compliance failure in small businesses.
Many businesses adopt a blanket seven-year retention policy to cover every contingency. That practice provides a margin beyond the six-year period and aligns with the outer limits some federal agencies use for audits and investigations. Records can be stored physically or digitally as long as they remain accessible and legible. Encrypted digital storage meets both security and accessibility needs when the files can be produced promptly on request.
Once the retention period expires, dispose properly. Shred physical documents and permanently delete digital files rather than moving them to a trash folder. Financial records sitting in unsecured discard piles create identity theft and data breach risks long after they’ve served any compliance purpose.
Extra Rules That Apply to Specific Businesses
Some reconciliation obligations only attach if your business fits a particular profile. Silence would let a reader assume otherwise, so the boundaries are worth stating.
Public Companies and Sarbanes-Oxley
The Sarbanes-Oxley Act of 2002, specifically Section 404, requires publicly traded companies to maintain internal controls that ensure the reliability of their financial reporting. Management must evaluate those controls annually and include a report on their effectiveness in the company’s annual SEC filing, and the company’s registered public accounting firm must attest to that evaluation.11U.S. Securities and Exchange Commission. SEC Proposes Additional Disclosures, Prohibitions to Implement Sarbanes-Oxley Act Payment reconciliation is one of the internal controls auditors examine most closely, because a company that doesn’t regularly verify its cash accounts against bank records has no reliable basis for the numbers in its financial statements.
These reporting and attestation requirements apply to public companies that file with the SEC, not to private businesses. Officers of covered companies face personal exposure for false certifications: under 18 U.S.C. ยง 1350, an officer who willfully certifies a financial report knowing it does not comply with the law faces a fine of up to $5,000,000, imprisonment for up to 20 years, or both.12Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports
Banks and the Bank Secrecy Act
Financial institutions carry a separate layer of federal duties. Any cash transaction exceeding $10,000 triggers a mandatory Currency Transaction Report.13Commodity Futures Trading Commission. Currency Transaction Reporting – Anti-Money Laundering Banks must also file a Suspicious Activity Report on potentially criminal transactions at lower dollar amounts: the SAR trigger is $5,000 when the bank can identify a suspect, or $25,000 when it cannot. Suspected money laundering or structuring to evade reporting triggers a SAR at $5,000 regardless of whether a suspect is identified.14eCFR. Suspicious Activity Reports 12 CFR 208.62 Federal examiners expect institutions to document their monitoring criteria, periodically test their thresholds, and staff review of flagged activity.15FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Suspicious Activity Reporting
Merchants Handling Card Data
Businesses that accept credit or debit cards and retain transaction data during reconciliation must comply with the Payment Card Industry Data Security Standard. PCI DSS version 4.0.1 requires audit logs capturing access to cardholder data to be retained for at least 12 months, with the most recent three months available for immediate analysis. Each log entry must record who accessed the data, what type of event occurred, the date and time, whether the action succeeded or failed, and which system or data was affected.16PCI Security Standards Council. Payment Card Industry Data Security Standard v4.0.1
Log access must be restricted to employees who need it, logs must be protected from modification through access controls or network segregation, and file integrity monitoring must generate alerts if anyone tampers with existing records. Merchants that fail these requirements risk losing the ability to process card payments, on top of fines from the card brands. For businesses reconciling transaction-level card data, the standard effectively dictates how the reconciliation environment itself has to be configured.