UCC Article 4A and Wire Transfers: What a “Security Procedure” Means for Your Business and Your Bank

When a business wire goes out, two questions decide who bears the loss if something is wrong: was the payment order really authorized, and did the bank follow the agreed way of checking it? Most U.S. states have adopted Article 4A of the Uniform Commercial Code to answer those questions for funds transfers. This article walks through the key ideas in plain language, using the published text of the code, so finance teams know what to ask their bank. It is education, not legal advice.

Who is bound by a payment order

Under UCC 4A-202(a), a payment order is treated as the sender’s order if the sender actually authorized it, or is bound by it under the law of agency. That covers the ordinary case: an authorized person at your company instructs the bank to send funds, and the bank sends them.

The “verified” route: security procedures

The more interesting rule is in 4A-202(b). If the bank and its customer have agreed that payment orders issued in the customer’s name will be checked through a security procedure, the bank may be able to treat an order as the customer’s even if the customer did not actually authorize it. Two conditions apply. The security procedure must be commercially reasonable as a way to guard against unauthorized orders, and the bank must prove it accepted the order in good faith and followed both the procedure and any written restriction the customer gave it.

UCC 4A-201 describes a security procedure as a method the customer and receiving bank agree on to confirm that a payment order, or a message changing or canceling one, came from the customer, or to detect errors in it. Examples named in the text include codes or algorithms, identifying words or numbers, encryption, and callback verification. The text also says that comparing a signature on the order to an authorized sample signature is not, by itself, a security procedure.

What “commercially reasonable” means

According to 4A-202(c), commercial reasonableness is a question of law. A court considers the customer’s wishes as expressed to the bank, the customer’s circumstances known to the bank (including the size, type and frequency of its payment orders), alternative procedures the bank offered, and the procedures that similar banks use with similar customers. The section also says a procedure is deemed commercially reasonable if the bank offered a commercially reasonable alternative, the customer declined it and chose the procedure in place, and the customer agreed in writing to be bound by orders the bank accepts in compliance with the chosen procedure.

The practical takeaway is that the choice your business makes at account setup can matter later. If a bank offers a stronger option, such as dual approval or a callback, and you decline in writing, that decision can shape how a later dispute is analyzed.

Parts of the rule you cannot contract away

Section 4A-202(f) says that, except as stated in that section and in 4A-203(a)(1), the rights and obligations under 4A-202 and 4A-203 cannot be changed by agreement. Your funds transfer agreement with the bank matters, but it does not override that structure.

A deadline worth knowing

Under 4A-505, if a customer has paid its bank for a payment order that was sent in the customer’s name and accepted, and the customer received a notice reasonably identifying the order, the customer generally cannot later claim the bank has no right to keep the payment unless the customer objects within one year after receiving that notice. The one year runs from receipt of notice, not from the debit itself. Many agreements and other laws set shorter practical windows, so read your own documents and review statements promptly.

Questions a finance team may want to ask its bank

1. What security procedure applies to our wire payment orders, and where is it written down?
2. Were other options offered at account setup, such as dual approval, callback, or limits, and what did we choose?
3. How are changes to beneficiary instructions or standing templates verified?
4. Which written restrictions, such as amount limits, can we place on the account?
5. How and when will we receive notice of executed payment orders?

Also look at your own internal controls. A bank procedure does not replace a company policy of verifying new or changed payee details through a separately known phone number before releasing funds. Our post on business email compromise and vendor changes covers one common way those instructions get altered, and the article on recalling a B2B payment explains what can and cannot be undone after the fact.

What this article does not cover

Article 4A is a model uniform law, and each state enacts it with its own text and case law. Wires over Fedwire also involve Federal Reserve rules, and consumer transfers are governed by other laws. Fraud outcomes depend heavily on the facts. This summary is a starting point for questions to ask, not a prediction of how any dispute would come out.

Sources

• Cornell Law School Legal Information Institute, UCC 4A-201, Definitions (security procedure), checked 19 October 2026.
• Cornell Law School Legal Information Institute, UCC 4A-202, Authorized and Verified Payment Orders, checked 19 October 2026.
• Cornell Law School Legal Information Institute, UCC 4A-505, Preclusion of Objection to Debit of Customer’s Account, checked 19 October 2026.

This article is for general informational purposes only and is not financial, legal, or tax advice. Laws, bank practices and agreements vary by state and institution, so consult your bank, payment provider or a qualified attorney about your specific situation.