B2B payments: a practical guide for businesses paying and getting paid

Why B2B payments are not consumer checkout at a larger amount

A consumer purchase often combines order, authorization, and payment in one session. A business purchase can separate them across days, teams, and systems. One person requests the purchase, another signs or issues a purchase order, someone else confirms delivery, accounts payable validates the invoice, a budget owner approves it, treasury schedules cash, and an authorized user releases the payment. The Federal Acquisition Regulation is a government example, not a rule for private companies, but it illustrates the structure: payment depends on a proper invoice and satisfactory contract performance, with documentation authorizing payment.

The extra steps are controls, not ceremony. GAO guidance identifies matching the goods or services received to the purchase order or contract and preventing duplicate or early payments as essential payment controls. Its disbursement guidance separates purchasing, receiving, accounting, and disbursing duties where practicable. A small company may not have four departments, but it can still separate request, approval, vendor-detail change, and payment release through permissions and review.

The B2B payment lifecycle

Payment terms turn revenue and expense into cash timing

Net terms allow a buyer to pay after an invoice or another agreed starting event, so the seller carries a receivable while the buyer carries a payable. The crucial control is the date basis. As a specific public-sector example, FAR 32.904 generally sets the US government invoice-payment due date as the later of 30 days after the billing office receives a proper invoice or 30 days after acceptance, subject to listed exceptions. A private contract may use different logic. Store the actual trigger instead of assuming every “Net 30” clock starts on the invoice date.

Counterparty data has commercial, tax, and compliance uses

Onboarding requirements depend on jurisdiction, payment type, entity, and the business’s reporting obligations. In the United States, the IRS says Form W-9 provides a correct taxpayer identification number to a person required to file specified information returns, including reporting income paid. Its 2026 information-return instructions direct payers to the appropriate W-9 or W-8 documentation and say tax identity information must be kept confidential and used only for tax-law compliance. That is a reason to collect required data securely, not a reason to demand a W-9 from every global counterparty.

KYB is also context-specific. FinCEN’s Customer Due Diligence rule applies to listed categories of covered US financial institutions, not to every ordinary buyer. It requires those institutions to identify and verify customers and beneficial owners, understand the nature and purpose of customer relationships, and monitor for suspicious transactions. A non-financial business may still validate suppliers for fraud, sanctions, tax, contractual, or procurement reasons, but it should describe its own requirement accurately instead of borrowing a bank rule wholesale.

For sanctions controls, scope should follow applicable law and risk. OFAC’s compliance framework says an effective sanctions program is risk-based and highlights risk assessment, internal controls, testing or auditing, and training. It identifies customers, products, services, supply chain, intermediaries, counterparties, transactions, and geographic locations as factors an organization may assess. The payment workflow should therefore preserve the legal entity and transaction context needed for the business’s actual screening policy.

Approval is not the same as payment release

An invoice approval answers “do we owe this?” Payment release answers “may this person move this amount to this destination now?” Keep both decisions visible. GAO’s separation-of-duties guidance divides purchasing, receiving, accounting, and disbursing where practicable. The FBI tells businesses to verify payment requests and changes to account numbers or procedures in person or by calling the requester, and to find the company’s phone number independently rather than use contact data supplied in a suspicious message.

• Use role-based authority for requester, approver, beneficiary-data administrator, payment creator, and releaser.
• Set approval policy by risk dimensions such as amount, entity, currency, payment type, counterparty status, and data change, not job title alone.
• Escalate a first payment, bank-detail change, unusual urgency, split invoice, or destination mismatch for independent review.
• Preserve who approved what version of the invoice and beneficiary record, when, and with which supporting evidence.
• Design a controlled exception path. An emergency should produce more evidence and narrower authority, not an invisible bypass.

Paying and getting paid are two views of the same record

Accounts payable wants a valid obligation, approval evidence, correct beneficiary, and settled disbursement. Accounts receivable wants a clear invoice, usable receiving instructions, remittance information, and a matched receipt. Both sides benefit when the invoice number, legal entities, currency, gross amount, deductions, tax, and payment reference remain consistent. FAR invoice requirements provide one concrete example: contractor identity, invoice date and number, contract or order reference, line-item description, quantities, prices, payment terms, and receiving information all support payment processing.

A practical operating cadence

Daily: protect deadlines and exceptions

Review due and overdue receivables, approved payments approaching cutoff, rejected or returned transactions, unmatched cash, changed beneficiary records, and balances needed for payroll or other critical disbursements. Assign every exception an owner and next action. A dashboard without ownership merely makes delay visible.

Weekly: align AP, AR, and treasury

Bring expected collections, approved payables, payroll, tax, financing, and currency exposure into one short cash view. Decide which invoices require collection work, which payments can be scheduled, which need a different rail, and which currency positions require a deliberate conversion decision. Keep expected dates distinct from contractual due dates and confirmed settlement.

Monthly: improve the system

Measure cycle time from invoice receipt to validation, approval, release, and reconciliation; count duplicate blocks, beneficiary-change escalations, returned payments, short receipts, unapplied cash, overdue items, and manual corrections. Segment the result by entity, counterparty, currency, rail, and exception reason. The purpose is not a decorative KPI average. It is to find the queue, rule, data field, or provider handoff that repeatedly creates work.