PaymentWorks Review
PaymentWorks is a US vendor identity platform that onboards payees and checks their tax ID, sanctions status and bank account ownership before the data reaches the ERP, then indemnifies qualifying domestic ACH payments up to $2 million, for universities, governments and large enterprises.
Independently scored, one dimension at a time. Every dimension is sourced, and we say whether a claim is published, reported, or estimated.
PaymentWorks matches every TIN against IRS records, validates addresses against USPS, screens payees against OFAC, SAM.gov and up to 1,400 configurable lists with continuous monitoring, and re-authenticates any bank change before it applies (ERP front door and vendor compliance pages, checked 27 September 2026). It generates IRS W-9s with digital signatures, logs every check for audit, and lists SOC 1, SOC 2, TX-RAMP and a Nacha audit on its Why Trust Us page. Points come off because it has no PO matching, bill approvals, 1099 filing or e-invoicing; it governs the vendor record and leaves the invoice to other tools.
PaymentWorks reports 300+ enterprise customers and 1.5 million credentialed payees (press release, 5 August 2026), and its case studies cover the University of North Texas (18,600 suppliers, $400 million of annual AP spend) and the University of Tennessee System (19,000 suppliers across five campuses). What breaks first is geography: foreign bank ownership is checked by name only in supported countries, and the warranty stops at domestic ACH (help center, checked 27 September 2026).
The PaymentWorks help center puts the first go-live at about 2 months, and its E&I cooperative listing says 8 weeks (both checked 27 September 2026). IT must set up SAML SSO, which is mandatory, plus SFTP and a baseline supplier file; the ERP integration comes later and is built by the customer or a certified partner such as Gideon Taylor or NProdigy. Routing payments adds a 7-phase project with the customer's bank that ends with a low-dollar first production file.
Support is a web ticket form staffed 8am to 8pm Eastern on weekdays with a one business day response goal, and email replies to the support address are not monitored (help center, checked 27 September 2026). Payment projects get a dedicated Payments Project Manager and two weeks of hypercare, and higher-ed customers have a user group. Review evidence is thin: Capterra shows one review at 1.0 of 5, and G2 and TrustRadius returned 403.
PaymentWorks calls itself ERP agnostic and names Banner, PeopleSoft, Munis, Workday, SAP and Oracle, but the integration is the ERP pulling approved registrations and updates over API or SFTP, built by the customer (developer portal, checked 27 September 2026). The only packaged connector named is Ellucian's for Banner, and Workday gets a field-mapping guide. It never touches GL coding, dimensions or accruals, and at go-live PaymentWorks staff move approved updates to Processed by ticket.
PaymentWorks runs no payables ledger, and your ACH payments still leave from your own bank account. It relays the domestic ACH files your ERP builds, in NACHA or ISO 20022 format, to your bank through integrations with 50+ US banks, checking each payment against verified accounts and, where tokenization is on, replacing each bank token with the real account details (payments overview, updated 15 April 2025, and tokenization FAQ). Under the EarlyPay terms, PaymentWorks Acquisition Company LLC buys the vendor's approved receivable for a 0 to 3 percent fee and may resell it to Mitsubishi HC Capital America; the payer still pays on the original due date, and the terms let the purchaser have that payment sent to it (checked 27 September 2026). Wires, checks, cards and cross-border payments go straight to your bank, and virtual cards are enrollment only.
In-product intelligence is machine learning that flags risk patterns for human review, per the Why Trust Us page, backed by a Fraud Operations team that calls payees; the December 2025 to July 2026 release notes add no generative AI. A public REST API of 16 operations over registrations, updates, suppliers, invoices, comments and tags works against production with a per-user token. A ReadMe docs MCP at docs.paymentworks.com/mcp refused an unauthenticated initialize on 27 September 2026, and no PaymentWorks server appears in the official MCP registry or its GitHub organization.
paymentworks.com/pricing returns a 404 and buyers are routed to a demo form; Vendr's marketplace page lists PaymentWorks with no price data, and no SpendHound page exists (checked 27 September 2026). What is published: vendors join free, the $2 million indemnification is included, and the EarlyPay fee vendors pay slides from 3.00 percent on day 0 to 0 at day 30. The subscription unit, renewal uplift and Lockton insurance premium are unpublished.
A US vendor-master gatekeeper with a real ACH warranty; pin down the warranty terms, price and ERP build.
Written by the Audit Friendly research team. No vendor edits, no sponsored placement.
PaymentWorks sits in front of the vendor master. Vendors register once; PaymentWorks matches the TIN against IRS records, validates the address, screens OFAC, SAM.gov and other lists, and checks that the bank account belongs to the payee before the record reaches Banner, PeopleSoft, Workday, Oracle or SAP. Every bank change goes through the same checks. If you route domestic ACH payment files through PaymentWorks, qualifying payments carry up to $2 million of indemnification per occurrence at no extra fee. The buyers are US universities, governments and health systems: 300+ enterprise customers and 1.5 million credentialed payees, per the company on 5 August 2026.
The warranty has conditions the marketing copy skips. PaymentWorks' own help center says it covers only US domestic ACH sent through the platform, only to accounts marked Review Complete, and that PaymentWorks weighs payment amount and validation status before indemnifying a payment. Wires, checks, cards and foreign bank accounts are out. The product also stops at the vendor master: no invoice capture, bill approvals or GL coding, and your IT team or a partner builds the ERP integration from API and SFTP docs. Pricing is quote only, and support is a weekday ticket queue.
Before signing, get the indemnification terms into the order form: the per-occurrence cap, any annual aggregate, the eligibility rules, the risk-tolerance test and the claim process. The public click-through terms (updated 11 August 2023) cap PaymentWorks' liability at $10,000 and say nothing about the warranty. Also confirm the subscription price and renewal uplift, who builds and maintains the ERP integration, and which countries the international bank checks cover.
- A US university, county or city that has lost money to a bank-change scam and wants every vendor bank account authenticated before the next pay run.
- An AP team that pays mostly by domestic ACH and wants fraud losses contractually shifted to a vendor, and can route its payment files through PaymentWorks.
- A decentralized institution with 10,000+ suppliers across campuses or departments on Banner, PeopleSoft, Workday or Munis.
- A company paying many foreign suppliers by wire: the warranty covers domestic ACH only, and foreign ownership checks are name-only where supported.
- A mid-market team on NetSuite, Sage Intacct or QuickBooks Online that wants a plug-in connector; PaymentWorks publishes none and leaves the integration to you.
- A buyer who wants full AP automation: there is no invoice capture, bill approval, PO matching or GL coding.
The jobs a finance team actually hires PaymentWorks for
Jobs, mapped to how finance teams actually buy.
Lock down vendor bank-change requests
Every bank or remit-to change a vendor submits triggers the same identity and ownership checks as a new registration before it reaches the ERP. Payment instruction files are checked against verified accounts just before release. Nuvance Health and Barton Malow describe scams caught or suffered in 2026 PaymentWorks customer videos.
Onboard thousands of payees without paper forms
Vendors complete one registration covering tax, banking, insurance and conflict-of-interest data, and most are processed automatically within seconds, per PaymentWorks. Registration Routing matches new submissions to existing ERP records by TIN to avoid duplicate vendors. UNT runs it alongside PeopleSoft Financials and Jaggaer.
Keep sanctions and debarment checks current
Screening runs at onboarding and continuously afterward, and a status change triggers an alert and re-authentication. Results show on the payee profile and in sanctions reports. Customers request new watchlists through support.
Earn revenue from early payment
Vendors opt in at registration to be paid when an invoice is approved, paying 0 to 3 percent depending on speed. PaymentWorks funds the early payment and shares part of the fee with the payer, whose own payment date does not change. UNC Asheville kept all of its virtual card spend after launching it, per PaymentWorks.
Move vendors off paper checks at onboarding
Vendors pick ACH, virtual card or EarlyPay during the same registration that verifies them, so enrollment happens without a separate campaign. Dashboards show where check volume remains. The card program itself stays with the payer's bank.
Meet the 2026 Nacha fraud monitoring rule
Nacha's rule requires risk-based processes reasonably intended to identify ACH credits initiated by fraud, and Nacha says it is neutral on method; account validation and change controls on vendor payment instructions are among the controls it suggests. PaymentWorks keeps a timestamped record of each authentication, which it positions as the evidence an ODFI or auditor will ask for. Texas State Technical College discusses using it for Nacha compliance in a July 2026 PaymentWorks video.
Watch the same task in each tool
Forget the 40-row feature grid. Pick a finance workflow and see how this tool and its closest peers actually do it, with our verdict on who wins for whom.
Compare on what matters
What it actually costs
Here's what it really costs: published rates where a vendor lists them, aggregated quote data where they don't, plus a path to your own number.
Annual subscription for vendor onboarding, TIN, sanctions and bank ownership checks, and ERP data delivery. No public price or unit.
$1M to $3M of excess cover over the PaymentWorks indemnification plus up to $250,000 of primary cover for fraud outside the platform.
Vendor-paid, sliding from 3.00 percent on the invoice date to 0 at day 30; the payer earns a share of each fee.
Included for every customer on qualifying domestic ACH payments sent through PaymentWorks to accounts marked Review Complete.
Free for vendors and payees to register, connect to customers and keep their data current.
What it actually takes to go live
Marketing pages say the indemnification has no if conditions and no fine print. The help center article on indemnification (checked 27 September 2026) says coverage applies only to US domestic ACH processed through the platform, to accounts marked Review Complete, and that PaymentWorks weighs payment amount and validation status against its risk tolerance for each payment. Payments can be withheld for review or removed from the file, and a one-digit mismatch in the account number shows as NOT INDEMNIFIED. The 5 August 2026 press release itself says eligible domestic ACH payments.
The click-through Terms of Service on paymentworks.com, updated 11 August 2023, cap PaymentWorks' liability for damages at $10,000 and contain no ACH warranty. Either party can terminate for convenience on 30 days notice, under Massachusetts law. The indemnification buyers are sold on must therefore sit in the order form or master agreement. Get the per-occurrence cap, any aggregate, exclusions and claim steps in writing.
The PaymentWorks help center (checked 27 September 2026) says integrations are developed by the customer's internal team or a third-party partner, with PaymentWorks providing API and SFTP documentation. The only packaged connector named is Ellucian's for Banner; Workday customers get a field-mapping guide compiled from other customers. At go-live, PaymentWorks staff move approved updates to Processed by support ticket. Budget IT or partner time, and ask who maintains the feed through upgrades such as PaymentWorks 2.0, offered as a sandbox opt-in in April 2026.
With tokenization on, the ERP stores a 16-digit token in place of the account number and PaymentWorks swaps in the real details on the way to the bank. The tokenization FAQ (checked 27 September 2026) says previous tokens stay active and keep routing to the vendor's former account, and PaymentWorks raises no alert when an outdated token is used. The ERP must be updated with each new token after a bank change is approved. Test this in sandbox and reconcile with the backfill report.
Support runs through a web form from 8am to 8pm Eastern, Monday to Friday, with a goal of responding within one business day, and email replies to the support address are not monitored (help center, checked 27 September 2026). Urgent cases are flagged by typing Urgent in the subject line. No phone line is published for payers. Ask for named contacts and escalation times in the contract, especially for held payments.
For foreign bank accounts, PaymentWorks verifies ownership by name only, in supported countries, through a third-party provider whose result it displays as returned (help center, checked 27 September 2026). Foreign tax IDs are not universally validated, and the domestic ACH indemnification does not apply. The supported country list is not published. Institutions with many overseas payees should ask for coverage by country before signing.
Scored on what an outside agent can actually reach: the documented API, how it authenticates, and whether the vendor ships an MCP server.
Inside the product, PaymentWorks says machine learning flags risk patterns in vendor data and that people review every red flag, with a Fraud Operations team contacting payees whose bank accounts fail automated ownership checks (Why Trust Us page and help center, checked 27 September 2026). The December 2025 to July 2026 release notes cover profile management, sanctions reporting and global bank validation, with no generative AI features. The $325 million of fraud stopped to date is a vendor claim.
Exists: partly. The ReadMe developer portal at docs.paymentworks.com answers at /mcp, but an unauthenticated initialize on 27 September 2026 returned 401 Authorization required with no OAuth metadata, so its tool list could not be read. PaymentWorks does not mention MCP on its site or in its docs, the official MCP registry returns nothing for PaymentWorks, and its GitHub organization holds 6 repositories of Django utilities. No community server was found.
Scope: the documented REST API has 16 operations. It reads registrations, updates, supplier records and comments, and writes registration and update statuses, comments, tags, and bulk supplier and invoice file uploads. The OpenAPI spec names sandbox.paymentworks.com/api and the production www.paymentworks.com/api, which answers with a Token challenge. Payment instruction files, bank tokens and EarlyPay run through SFTP and the UI, and no webhooks are documented.
Turnkey: no. Each user copies a personal API token from account settings; tokens do not expire, inherit the user's role permissions, and PaymentWorks recommends IP allowlisting. An outside agent needs a custom connector built on that token, with an admin choosing the role it runs under.
Process a vendor invoice
Who wins for whom: US payers that want digitally signed W-9s, IRS TIN matching and SAM.gov screening on every vendor record: PaymentWorks. Treasury teams that want each payee's bank ownership checked again against the payment file before release: Trustpair. AP teams that want W-9 and W-8 capture plus 2 and 3-way matching at header and line level: Tipalti.
PaymentWorks
Vendor record checks, no invoice workflow. PaymentWorks matches every TIN against IRS records, screens payees against OFAC, SAM.gov and up to 1,400 lists, re-authenticates any bank change before it applies, generates digitally signed W-9s, and lists SOC 1, SOC 2 and TX-RAMP.
Where it loses: The invoice itself is outside its scope: there is no invoice capture, bill approval, PO matching, GL coding, 1099 filing or e-invoicing, so another AP tool processes the bill.
- Compliance depth: 81/100
- Time to live: About 2 months (vendor)
Source: AF score rationale: Compliance depth 81; PaymentWorks not-for list.
Watch: PaymentWorks Demo 35:41 · Independent walkthrough · UC Davis Supply Chain on YouTube (customer training)
Trustpair
Validates the payee behind the invoice. Trustpair checks bank-account ownership at onboarding, on every bank-detail change and against the payment file before release, adds IRS TIN matching and screening against 80+ sanctions lists, and logs investigations and overrides in an audit trail.
Where it loses: Approvals, PO matching, 1099 filing and e-invoicing sit outside its scope, and the SOC 1 badge reads Type 2 while Trustpair's only SOC 1 announcement, from November 2025, is Type 1.
- Compliance depth: 83/100
- Time to live: 24 hours to 3 months (vendor)
Source: AF score rationale: Compliance depth 83; Trustpair watch-outs.
Watch: Trustpair - Global Bank Account Ownership Verification Platform 1:50 · Official demo · Trustpair on YouTube (official)
Tipalti
Tax forms and screening built in. Tipalti captures W-9 and W-8 forms with TIN matching, prepares 1099 and 1042-S reports, screens payees against OFAC and Do Not Pay before each payment, and matches invoices 2 and 3-way at header and line level.
Where it loses: Per-invoice fees are quote only above the $99 monthly entry price, and the services agreement promises a data download only during the term, while supplier tax forms and audit trails live in Tipalti.
- Compliance depth: 90/100
- Time to live: 2 to 3 months (reported)
Source: AF score rationale: Compliance depth 90; Tipalti pricing tiers and watch-outs.
Watch: Accounts Payable AI: Automate Invoices with Tipalti AI 1:37 · Official short · Tipalti on YouTube (official)
Pay a vendor
Who wins for whom: US payers sending domestic ACH that want each payment checked against verified accounts and up to $2M indemnification: PaymentWorks. SAP or Sage X3 teams that want flagged payees blocked in the F110 proposal or payment file before release: Trustpair. Payers with suppliers in 200+ countries who want 25 currencies held and converted in one place: Tipalti.
PaymentWorks
Relays ACH files, adds a warranty. PaymentWorks relays domestic ACH files an ERP builds to the customer's bank, checking each payment against verified accounts with up to $2M indemnification on qualifying ACH, while EarlyPay pays vendors on approval for a vendor-paid 0 to 3 percent fee.
Where it loses: Wires, checks, cards and cross-border payments go straight to the bank, it runs no payables ledger, and the $2M warranty covers only domestic ACH to accounts marked Review Complete.
- Payments & money movement: 48/100
- Time to live: About 2 months (vendor)
Source: AF score rationale: Payments & money movement 48; PaymentWorks pricing tiers and watch-outs.
Watch: How EarlyPay Works 2:13 · Official demo · PaymentWorks on YouTube (official)
Trustpair
Checks payment files before release. Trustpair executes no supplier payments: it checks ISO 20022 pain.001 or CSV payment files against validated vendors before release, and in SAP the treasury team blocks a flagged F110 proposal while the Sage X3 connector stops the file automatically.
Where it loses: There are no payment rails, cards or reimbursements, payees not audited in the vendor master get no verdict unless the file carries a registration number, and liability cover of up to $1M needs Custom Access.
- Payments & money movement: 31/100
- Time to live: 24 hours to 3 months (vendor)
Source: AF score rationale: Payments & money movement 31; Trustpair watch-outs.
Watch: Trustpair and Kyriba Native Connector Explained 1:26 · Official demo · Trustpair on YouTube (official)
Tipalti
Licensed global payouts, 200+ countries. Tipalti moves money itself by ACH, global ACH, SEPA, wire, check, PayPal and cashback virtual cards to 200+ countries, holding and converting 25 currencies under US and Canadian money transmitter and UK and EU e-money licenses.
Where it loses: Per-payment and FX conversion fees are quote only, the card cashback rate is not published, and Tipalti can draw its fees from the account that funds payee payments.
- Payments & money movement: 93/100
- Time to live: 2 to 3 months (reported)
Source: AF score rationale: Payments & money movement 93; Tipalti watch-outs.
Watch: Whats New in Tipalti Accounts Payable | December 2025 1:46 · Official demo · Tipalti on YouTube (official)
PaymentWorks, kept current
PaymentWorks launched Payee Profile, a reusable credential for a payee's tax, banking and compliance data across all its customers. The release restates the $2 million guarantee on eligible domestic ACH payments to Payee Profile vendors.
Every non-consumer ACH originator must now run risk-based fraud monitoring on ACH credits, per Nacha, which says the rule is neutral on method. PaymentWorks' post reads the rule as requiring supplier bank account verification and positions its continuous authentication and audit trail as the evidence ODFIs will ask for.
Customers can buy $1 million to $3 million of excess social engineering cover through Lockton on top of the $2 million indemnification, plus up to $250,000 of primary cover for fraud outside the platform.
PaymentWorks announced a live virtual event with Nacha on the ACH credit fraud rule changes taking effect for most non-consumer originators in June 2026.
E&I Cooperative Services awarded PaymentWorks a competitive contract for higher education and K-12 under its accounts payable automation RFP, running to 30 April 2030 with one 5-year renewal remaining.
PaymentWorks FAQ
PaymentWorks does not publish a subscription price. Its /pricing URL returns a 404, the site sends buyers to a demo request, and Vendr's PaymentWorks page lists no contract data (checked 27 September 2026). Expect an annual subscription quoted to your vendor count and scope; the University of North Texas case study confirms an annual fee without naming it.
Some costs are published. Vendors register free, and the $2 million ACH indemnification is included at no extra fee. Lockton's supplemental fraud insurance, adding up to $3 million per event, is sold separately at an unpublished premium.
EarlyPay can offset the bill: vendors who take early payment pay 0 to 3 percent, and PaymentWorks shares part of that with the payer. UNT says its commission is on track to cover its subscription, per a PaymentWorks case study. Higher education and K-12 buyers can also order through E&I contract CR001423, which runs to 30 April 2030.
The public click-through Terms of Service (updated 11 August 2023) let either side terminate for convenience on 30 days notice, cap PaymentWorks' liability at $10,000 and apply Massachusetts law. They contain no ACH warranty, so the $2 million indemnification must be written into your order form or master agreement. Enterprise contracts may differ; ask for the term, renewal notice and uplift cap in writing.
The terms say company data remains the company's property. Payer users can export new vendor requests to CSV, including tax, remittance and banking fields, and the Suppliers API lists supplier records. The tokenization FAQ says a payer who leaves can still retrieve its vendors' domestic ACH banking details; if you use tokens, plan the switch back to real account numbers in the ERP before the last payment file.
The PaymentWorks help center puts the first go-live at about 2 months, and its E&I listing says 8 weeks. That phase covers SAML single sign-on, which PaymentWorks requires, an SFTP account, a baseline supplier file from your ERP and the registration setup, with PaymentWorks' implementation team supplying questionnaires, templates and sample files.
The ERP integration comes after, and it is yours to build: PaymentWorks supplies API and SFTP documentation, field mapping templates and a testing matrix, while your IT team or a certified partner (Gideon Taylor for PeopleSoft and Oracle, NProdigy for PeopleSoft, Ellucian's connector for Banner) does the work. Routing payment files through PaymentWorks is a separate 7-phase project with your bank that ends with a low-dollar first file and two weeks of hypercare.
Only through a custom build. PaymentWorks has no public MCP server: its ReadMe developer portal answers at docs.paymentworks.com/mcp but refused an unauthenticated connection on 27 September 2026, and nothing on the site, in the docs or in the official MCP registry describes one.
The REST API is the path. With a user's API token, an agent can list registrations and vendor updates, read supplier records, change statuses the user's role allows, add comments and tags, and upload supplier and invoice files. Tokens do not expire and carry the user's permissions, so create a dedicated, narrowly scoped user and allowlist its IP. Payment files, bank tokens and EarlyPay have no documented API.
PaymentWorks alternatives
Ask us anything
Answered only from our own published research on this tool, never from general internet noise. If we cannot answer it well, our research agents will dig in and publish a sourced answer.
