Modelling corporate wire exposure under the commercial-reasonableness rule

The default assumption is that a bank absorbs fraudulent wires. For commercial accounts the framework is different, and the variable that decides it is a procedure the customer usually agreed to without reading.

Part of Research, datasets and methods

How the framework differs from consumer rules

The last row is what surprises treasurers. A customer who was offered a procedure and declined it in writing has generally accepted a different risk allocation than one who took it.

The three questions that decide allocation

1. Was there an agreed security procedure? Usually yes, in the cash management agreement, often unread.
2. Was it commercially reasonable? Assessed against the customer's circumstances — volume, size, the alternatives offered.
3. Did the bank comply with it, in good faith? If so, the loss may sit with the customer even though the payment order was not authorised.

Question two is where the analysis lives. A procedure appropriate for a small business sending two wires a month may not be for a company sending two hundred, and the assessment is fact-specific.

Building the exposure model

Four inputs, all of which a treasury function can produce from its own data.

# 1. Volume distribution
   wires per month, by value band
   largest single wire in the last 24 months
   95th percentile wire value

# 2. Procedure in effect
   what the cash management agreement specifies
   what is actually performed  ← usually different
   which wires are exempt, and why

# 3. Offered and declined
   what additional procedures the bank has offered
   what was declined, when, and in writing

# 4. Insurance
   social engineering sub-limit
   deductible
   verification conditions precedent

The gap in input two is the finding. Agreements commonly specify callback verification above a threshold; operations commonly apply it inconsistently under time pressure.

The calculation

  Exposure on a single fraudulent wire
    = wire value
    − recovery (low; depends on speed and receiving bank)
    − insurance recovery (sub-limit less deductible)
    − allocation to the bank (depends on the three questions)

  Worked, with illustrative figures:
    95th percentile wire              $840,000
    Expected recovery                        $0
    Insurance: $250k sub-limit less
               $50k deductible          $200,000
    Bank allocation, procedure agreed
               and followed                   $0
    ------------------------------------------------
    Net corporate exposure             $640,000

These figures are illustrative. The exercise is to substitute your own, which most organisations have never done and which typically produces a larger number than expected.

What actually shifts the allocation

The second row is usually the cheapest and highest-value. Most organisations have a procedure that would be adequate if it were applied every time, and the exposure comes from the exceptions.

The conversation to have with your bank

1. What security procedure is specified in our agreement, exactly?
2. What procedures have you offered that we have not taken up, and is our declination on file?
3. What do you consider commercially reasonable for a customer of our profile?
4. If we implement a stronger verification on our side, does that change anything in our agreement?

The fourth question rarely has a good answer today and is worth asking anyway. Banks are not currently set up to price a customer's own controls, and asking is how that starts to change.

This describes a legal framework at a general level and is not legal advice. Article 4A adoption, agreement terms and judicial interpretation vary; take specifics to counsel.

Building the model from your own data

# 1. Volume distribution
   wires per month by value band
   largest single wire in 24 months
   95th percentile wire value

# 2. Procedure in effect
   what the cash management agreement specifies
   what operations actually performs   ← usually different
   which wires are exempt, and why

# 3. Offered and declined
   what the bank has offered; what was declined, in writing

# 4. Insurance
   social engineering sub-limit, deductible,
   verification conditions precedent

Those figures are illustrative. The exercise is substituting your own, which most organisations have never done and which typically produces a larger number than the treasurer expects.

Objections and honest limits

“The bank absorbs fraudulent wires.” For consumer accounts, largely. Commercial wire transfers are governed by a different framework in which the agreed security procedure, not the fraud, decides allocation.

“We never chose a procedure.” You almost certainly did, in the cash management agreement. The gap that matters is between what that document specifies and what operations performs under time pressure.

The model, with numbers you can change

The point of a model is to make the argument arithmetic instead of adjectival. Six inputs are enough. Take them from your own treasury system rather than from a benchmark, because the whole value is that the figures are yours.

The single-event exposure is what one successful diversion costs after recall attempts, so it is the tail value net of the fraction you get back:

single_event = C * (1 - E)
             = 740,000 * (1 - 0.40)
             = 444,000

Annualised exposure scales that by how many wires are plausibly reachable in a year. The reachable population is the one that leaves the standard workflow, because those are the payments where an out-of-band instruction is not obviously out of place:

reachable_per_year = A * 12 * D
                   = 420 * 12 * 0.06
                   = 302 wires

annual_exposure   = reachable_per_year * single_event * p_success
                  = 302 * 444,000 * 0.001
                  = 134,088

The last term is the one people argue about, and they should. A success probability of one in a thousand on the reachable population is a guess; replace it with your own attempted-fraud rate if you have one, and run the model at ten times and a tenth of it. If the answer is uncomfortable across two orders of magnitude, the number was never the point.

What shifts the allocation is not the size of the exposure but the third row of the input sheet meeting the sixth: high-value payments approved by a method that produces no evidence. That is the combination that turns a commercial-reasonableness discussion into an unwinnable one.

These figures are illustrative and the framework is described generally. Loss allocation for commercial wire transfers is fact-specific and jurisdiction-specific; take any actual matter to counsel.

The conversation to have with your bank

1. What security procedure is specified in our agreement, exactly? Read it. Most treasurers have not.
2. What have you offered that we declined? And is our declination on file?
3. What do you consider commercially reasonable for our profile? Volume and transaction size drive this.
4. If we implement stronger verification, does anything change? Asking is how the market learns there is demand for a term that does not yet exist.

Terms used here

Security procedure

The agreed method for verifying that a payment order is authorised. Under Article 4A it is the variable that decides loss allocation.

Commercially reasonable

Assessed against the customer's circumstances — volume, transaction size, and the alternatives the bank offered.

Condition precedent

A requirement that must be met for insurance cover to respond; failing to prove it can defeat a claim independently of the loss.

Frequently asked questions

Doesn't the bank absorb fraudulent wires? For consumer accounts, largely. For commercial wire transfers the allocation depends on whether an agreed security procedure was commercially reasonable and followed.

Why does declining a procedure matter? A customer offered a procedure who declined it in writing has generally accepted a different risk allocation than one who took it.

What is the most common finding? A gap between the procedure in the agreement and what operations actually performs, particularly under time pressure.

What is the cheapest improvement? Applying your existing procedure consistently. Most organisations have an adequate procedure and get their exposure from the exceptions.

What success probability should I use? Your own attempted-fraud rate if you have one. Otherwise run the model across two orders of magnitude — if the answer is uncomfortable throughout, the precise figure does not matter.

Why model the 95th percentile rather than the mean? Because a diversion targets the tail. Attackers pick the large payment, not the average one.

Sources and further reading

• Uniform Commercial Code Article 4A on funds transfers and security procedures.
• Published case law on commercial reasonableness of security procedures.
• Bank cash management agreement terms on funds transfer security.
• FBI IC3 2025 Internet Crime Report
• UCC Article 4A — Funds Transfers (Cornell LII)