Reconciling Customer Funds Before You Pick an Audit Platform

Before either tool matters, your team needs a daily process that ties the balance in your settlement or escrow account to what your ledger says customers are owed, with a documented explanation for every variance.

This reconciliation happens far more often than a typical monthly close cadence, and it's the control most examiners and auditors test first, because a break here means customer funds and company funds have gotten mixed up somewhere in the pipeline.

Money transmitter licenses and state-level regulatory filings run on their own calendar and their own definitions of what counts as customer funds, which don't always match GAAP close timing.

Keep these as separate workstreams even though they draw on the same underlying data, because conflating them is how a fintech ends up missing a filing deadline while focused on closing the books, or the other way around.

Access controls over who can move customer funds, change settlement account details, or approve a payout often satisfy both a security requirement and a SOX financial reporting control at the same time.

Map that overlap explicitly instead of maintaining two separate control lists for the same access review, since a GRC platform is built to hold one control with multiple compliance frameworks mapped to it rather than duplicating the work.

Documenting a control and testing it on a schedule are different jobs, and fintechs sometimes stop at documentation because nobody owns the testing calendar.

This is where AuditBoard earns its keep for a payments company specifically: the customer-funds handling controls that examiners and auditors both care about need periodic, evidenced testing, not just a policy document that hasn't been reviewed since it was written.

If your daily float reconciliation is still a manual spreadsheet exercise, fix that with close management software first, since it's the control most likely to generate a finding in the meantime.

If float reconciliation is already solid and your gap is testing and evidencing the access and change controls around customer funds, prioritize a GRC platform ahead of your next license renewal or SOX walkthrough, since regulators and auditors will ask for that evidence on their timeline, not yours.

Picture a payments company whose daily float reconciliation comes up a few cents short on a Tuesday. On its own, a break that small looks trivial, and it's tempting to plug it and move on. The problem is that a small unexplained variance is often the visible edge of a larger issue: a failed transaction that retried and posted twice, a fee calculated on the wrong side of the ledger, or a settlement file that arrived with one record missing.

Treating every variance, regardless of size, as something that needs a documented root cause rather than a plug is the discipline examiners and auditors actually test for. A reconciliation template that requires an explanation field before it can be marked complete forces that habit, and it's exactly the kind of control close management software enforces well: no sign-off without a stated reason for every open item.

Once the root cause is found, the harder question is whether it's a one-time processing error or a pattern. If the same kind of break shows up for several months running, that's no longer a close-process issue, it's a control gap in how transactions post or how a settlement file gets validated on the way in, and it belongs in front of whoever owns testing for access and change controls over the payment pipeline. That's the handoff point between close software, which caught the pattern, and a GRC platform, which documents and tests the fix.

This matters even more for a fintech running multiple settlement rails at once, ACH, card networks, and instant payment rails, each with its own timing quirks and file formats. A break that's routine on one rail can be a genuine incident on another, so keep the investigation playbook rail-specific rather than assuming what worked for one settlement break applies to the next.

In order, the sequence looks like this:

1. Reconcile the settlement or escrow account to the ledger every business day, not only at month end.
2. Keep regulatory reporting separate from the financial close.
3. Map each control once and tie it to both SOX and security frameworks, especially access and change management over systems that touch customer funds.
4. Assign an owner for testing once controls are documented.
5. Time the purchase around your renewal or audit date.