Which steps of a payment run can be automated?
The preparation can be automated and the release should stay with people. The workflow selects bills that are approved, due before the next run and not on hold, groups them by supplier and totals them against the bank account they will be paid from. It then builds the batch and drafts remittance advice. Two authorised people review the total and release it in online banking. The automation account should have no rights to release payments at all, so a fault or a compromised credential cannot move money on its own.
- Select approved bills due before the next run.
- Exclude bills that are disputed, on hold or missing approval.
- Check each supplier's bank details against the verified record.
- Build the batch payment and the bank file.
- Draft remittance advice for each supplier.
What does Xero's batch payment allow?
A Xero batch payment bundles several bills into one payment, so one line on the bank statement reconciles against one transaction in Xero. Through the API, batch payments can only be made in the organisation's base currency, cannot mix sales invoices with bills, and cannot include credit notes, prepayments or overpayments. In practice, apply supplier credit notes to their bills before the run, and pay foreign currency bills separately. The Details field, which is sent to the bank as the reference for the batch, is limited to 18 characters, so agree a short reference format.
How should bank detail changes be handled?
Business email compromise is when a criminal gains access to a business email account and uses it to trick contacts into sending money to accounts the criminal controls. The Australian Cyber Security Centre advises an approval process for any request to change payment details, and verifying the request by calling the sender on a verified number, never one taken from the email. Build that into the workflow so it cannot be skipped.
- Supplier bank details change only through a change request in the workflow, never by editing the record directly.
- A change puts the supplier on hold until a verification call is logged.
- The call uses the phone number already on file, not the one in the request.
- A second person confirms the call record before the hold is lifted.
- Every invoice is compared with the stored bank details, and any difference is flagged.
Does Confirmation of Payee help?
It adds a check at the bank. Since July 2025, Australian banks have rolled out Confirmation of Payee, which compares the account name you enter with the BSB and account number when you add or edit a payee, and shows a match, close match or no match result. For business accounts the account name may be shown whatever the result. Use it when you set up a new supplier as a payee in online banking. It does not replace the phone call to the supplier, and you should ask your bank whether its checks apply to bulk payment files as well as single payments.
Who should approve and who should release?
Separate the duties so no single person can both change where money goes and send it. The person who approves a bill confirms the goods or services were received at the agreed price. The person who updates supplier bank details should not be able to release payments. Release in online banking should need two authorised people; ask your bank how to set up dual authorisation on the account. Write these roles down, including who covers each one during leave, because payment runs that wait for one absent person tend to get approved by whoever is available.
How are payments recorded and suppliers told?
After the bank processes the batch, the workflow marks the bills as paid in Xero through the batch payment, so the single bank statement line reconciles against it. It then emails remittance advice to each supplier's accounts address already on the record, listing the bills paid and the amounts. Store the batch file, the approval records and the bank's confirmation together. If the bank rejects part of a batch, for example because an account number is invalid, the workflow reopens those bills and puts the supplier on hold until the details are verified again.