Treasury Compliance: Requirements, Risks, Controls and Checklist for 2026

Treasury compliance is the process of ensuring that an organization’s cash management, payments, banking relationships, investments, debt, foreign exchange, financial risk activities, and related reporting comply with applicable laws, regulations, accounting requirements, sanctions, and internal policies.

For corporate treasury teams, compliance goes far beyond approving payments.

Treasury may need to control who can move money, verify counterparties, screen transactions against sanctions requirements, maintain accurate records, separate conflicting responsibilities, comply with authorization limits, monitor financial risks, support financial reporting controls, and provide evidence during audits.

The stakes are high. According to the 2026 Association for Financial Professionals Payments Fraud and Control Survey, 76% of organizations reported attempted or actual payments fraud during 2025. Checks remained the payment method most frequently affected, while business email compromise continued to be a major risk.

Strong treasury compliance therefore serves two purposes: meeting regulatory obligations and protecting the organization’s cash, financial information, and decision-making processes.

This guide explains treasury compliance requirements, major risks, internal controls, policies, audit expectations, regulatory considerations, and a practical treasury compliance checklist for 2026.

Highlights 

• Treasury compliance covers more than payments. It includes cash, banking, investments, debt, foreign exchange, sanctions, financial controls, reporting, and treasury policies.
• Requirements vary by organization. Public companies, financial institutions, multinational businesses, government contractors, and privately held companies may face different obligations.
• Sanctions compliance is a major concern. U.S.-connected transactions may require organizations to consider OFAC sanctions restrictions and screening.
• Internal controls are essential. Segregation of duties, approval limits, reconciliations, access controls, and independent reviews reduce fraud and financial reporting risk.
• Treasury policies need active governance. Limits, approved instruments, authorized banks, account access, escalation procedures, and exceptions should be documented and regularly reviewed.
• Evidence matters. Auditors need proof that controls were actually completed, not simply written into a policy.
• Treasury compliance should be continuous. Changes in regulations, banking relationships, sanctions, systems, counterparties, and business operations can quickly make old controls ineffective.

What Is Treasury Compliance?

Treasury compliance refers to the systems, controls, policies, responsibilities, and monitoring activities used to ensure that treasury operations meet legal, regulatory, financial reporting, contractual, and internal governance requirements.

Corporate treasury typically manages some of the organization’s most sensitive activities, including:

• Cash and liquidity
• Bank accounts
• Payments
• Debt and financing
• Investments
• Foreign exchange
• Interest rate exposure
• Financial instruments
• Bank counterparties
• Signatory authority
• Cash forecasting
• Intercompany funding
• Financial risk
• Treasury reporting

Because these activities involve access to company funds and financial markets, weak controls can create significant exposure.

A payment sent to the wrong party can result in fraud. An unauthorized hedge may exceed approved risk limits. An outdated bank signatory may retain access to an account. A sanctioned counterparty could expose the organization to enforcement risk. Missing documentation can turn a correctly executed transaction into an audit issue.

Treasury compliance creates the control environment designed to prevent those failures.

Why Treasury Compliance Matters in 2026

Treasury functions have become increasingly digital, global, and interconnected.

Organizations now use multiple banks, payment platforms, treasury management systems, enterprise resource planning systems, APIs, fintech providers, foreign exchange platforms, and third-party payment processes.

At the same time, payment fraud remains widespread.

The 2026 AFP Payments Fraud and Control Survey found that 76% of surveyed organizations experienced attempted or actual payment fraud in 2025. Treasury professionals are often directly involved in detecting suspicious payment activity because they monitor bank accounts, transfers, and cash movements.

Sanctions also change frequently. The U.S. Office of Foreign Assets Control maintains multiple sanctions programs and continuously updates sanctions lists and related restrictions. Treasury teams handling international payments, bank relationships, suppliers, investments, or cross-border transactions need processes capable of responding to those changes.

For public companies, treasury activities can also affect internal control over financial reporting. SEC rules implementing Section 404 of the Sarbanes-Oxley Act require applicable reporting companies to assess the effectiveness of internal control over financial reporting.

Treasury compliance sits at the intersection of these risks.

What Regulations Apply to Treasury Compliance?

There is no single regulation called the “Treasury Compliance Act.”

The requirements affecting treasury depend on the organization’s industry, legal structure, countries of operation, public or private status, financial activities, and counterparties.

Some of the most important areas include the following.

1. OFAC Sanctions Compliance

The U.S. Treasury Department’s Office of Foreign Assets Control administers U.S. economic and trade sanctions programs.

Organizations subject to U.S. jurisdiction, and some foreign organizations with U.S. connections, may need to evaluate whether transactions involve blocked persons, restricted entities, sanctioned jurisdictions, or prohibited activities.

OFAC’s official Sanctions List Service provides access to the Specially Designated Nationals and Blocked Persons List and consolidated non-SDN sanctions data.

OFAC has also published a framework describing five core components of an effective sanctions compliance program:

1. Management commitment
2. Risk assessment
3. Internal controls
4. Testing and auditing
5. Training

For corporate treasury, practical controls may include screening counterparties where appropriate, reviewing payment information, escalating possible matches, documenting sanctions decisions, maintaining system controls, and monitoring changes to applicable sanctions programs.

OFAC does not prescribe one identical compliance system for every organization. The appropriate program should reflect the organization’s specific sanctions risks.

2. Sarbanes-Oxley and Financial Reporting Controls

Treasury transactions can significantly affect financial statements.

Cash balances, debt, investments, derivatives, foreign exchange transactions, interest expense, and other treasury activities may therefore form part of an organization’s internal control over financial reporting.

For companies subject to Section 404 of the Sarbanes-Oxley Act, management must assess the effectiveness of internal control over financial reporting.

Treasury controls that may support SOX compliance include:

• Bank reconciliations
• Payment authorization controls
• Segregation of duties
• Treasury account reconciliations
• Valuation controls
• Hedge documentation
• Journal approval
• Bank account reviews
• Access reviews
• Confirmation of debt balances
• Review of investment transactions
• Management review controls

Companies looking to strengthen these processes can also review VComply’s guide to internal control management software.

3. Anti-Money Laundering Requirements

Anti-money laundering obligations require careful treatment because they do not apply identically to every corporate treasury department.

Banks and other covered financial institutions are subject to specific requirements under the Bank Secrecy Act and related rules administered by FinCEN.

A nonfinancial corporation should not assume that all banking AML obligations apply directly to its treasury function.

However, organizations may still face AML-related requirements through their business model, financial services activities, contracts, banking relationships, jurisdiction, or sector.

Treasury should work with legal and compliance teams to identify which financial crime requirements apply to the organization rather than copying a banking compliance program into a corporate environment.

4. Beneficial Ownership Reporting

This is an area where treasury and compliance teams should be especially careful with older guidance.

On August 11, 2026, FinCEN finalized changes to beneficial ownership information reporting under the Corporate Transparency Act.

Under the current rule, U.S. companies and U.S. persons are exempt from BOI reporting requirements. Certain foreign entities registered to do business in the United States remain subject to reporting requirements for foreign beneficial owners.

Organizations should use FinCEN’s current guidance instead of relying on articles or checklists written before these changes.

5. Foreign Exchange, Derivatives and Investment Requirements

Organizations using derivatives, foreign exchange contracts, investments, commodities, or other financial instruments may face additional requirements depending on their activities and jurisdiction.

Treasury policies should establish:

• Permitted financial instruments
• Approved counterparties
• Risk limits
• Hedge objectives
• Authority limits
• Documentation requirements
• Valuation methods
• Accounting requirements
• Reporting procedures

Legal, accounting, tax, and compliance teams should be involved when applicable requirements extend beyond treasury’s operational expertise.

The 8 Most Important Treasury Compliance Risks

An effective treasury compliance program starts with understanding where failure is most likely.

1. Unauthorized Payments

Treasury teams often control high-value payments.

If one person can create a beneficiary, initiate a payment, approve it, and reconcile the transaction, the organization has a serious control weakness.

Payment controls should reduce the ability of a single person to execute an unauthorized transaction.

2. Business Email Compromise

Fraudsters increasingly impersonate executives, vendors, customers, or other trusted parties to redirect payments.

AFP’s 2026 research found business email compromise continued to affect a large proportion of organizations during 2025.

Treasury teams should never rely solely on an email requesting a change to bank details.

Independent verification, call-back procedures, approval workflows, and restricted beneficiary changes can significantly reduce exposure.

3. Sanctions Violations

A payment involving a sanctioned individual, organization, vessel, country, bank, or other restricted party may create significant legal risk.

Treasury should know when sanctions screening is required, which lists and programs are relevant, how possible matches are escalated, and who has authority to approve or reject a transaction.

4. Weak Segregation of Duties

Segregation of duties is one of the most important treasury controls.

Responsibilities for initiating, approving, settling, recording, and reconciling transactions should be separated where practical.

Smaller treasury teams may need compensating controls when complete separation is impossible.

5. Excessive System Access

Employees often accumulate access as roles change.

Former employees, transferred staff, external consultants, or users whose responsibilities have changed may retain access to bank portals and treasury systems.

Periodic access reviews should verify:

• Who has access
• Why access is required
• What permissions each user holds
• Whether approval limits remain appropriate
• Whether inactive accounts should be removed

6. Policy Exceptions

A treasury policy may set investment limits, permitted counterparties, approval levels, or foreign exchange limits.

If exceptions occur without documentation and approval, policy limits become ineffective.

Exceptions should be recorded, approved by the appropriate authority, assigned an expiration or remediation date when appropriate, and included in management reporting.

7. Incomplete Audit Evidence

A control can be completed correctly and still create problems if there is no evidence.

Treasury teams should retain evidence showing:

• Who completed the activity
• When it occurred
• What was reviewed
• What exceptions were identified
• Who approved the result
• What follow-up occurred

This is especially important for recurring controls.

8. Regulatory Change

Treasury requirements can change through sanctions updates, financial regulations, accounting requirements, tax rules, banking requirements, and organizational changes.

A treasury compliance framework should include a formal process for identifying changes and determining whether policies, controls, systems, or responsibilities need to be updated.

VComply’s guide to regulatory change management explains how teams can turn regulatory updates into assigned actions instead of relying on ad hoc monitoring.

Essential Treasury Internal Controls

Controls are where treasury policies become operational.

A strong treasury control environment commonly includes the following.

Segregation of Duties

Separate transaction initiation, approval, settlement, accounting, and reconciliation responsibilities where possible.

Dual Authorization

Require additional approval for payments or transactions above defined thresholds.

Approval levels should reflect the organization’s risk appetite and delegation-of-authority policy.

Bank Account Controls

Maintain a complete inventory of:

• Banks
• Bank accounts
• Legal entities
• Currencies
• Account purposes
• Authorized signatories
• Online banking users
• Approval limits

Dormant and unnecessary accounts should be reviewed and closed when appropriate.

Independent Bank Reconciliation

Bank balances and treasury records should be reconciled on a defined schedule.

Unexplained differences should be investigated rather than carried forward indefinitely.

Payment Verification

Changes to beneficiary details should be independently confirmed using trusted contact information.

Do not use the telephone number or contact information contained only in the change request itself.

Access Reviews

Review bank and treasury-system access periodically.

Remove obsolete accounts promptly and restrict privileged access to employees who need it.

Transaction Limits

Set clear limits for:

• Payments
• Investments
• Borrowing
• Foreign exchange
• Hedging
• Counterparty exposure
• Bank balances

Transactions outside approved limits should require escalation.

Sanctions Controls

Where sanctions requirements apply, establish documented processes for screening, possible-match review, escalation, blocking or rejection where required, documentation, and reporting.

Exception Management

Every material control exception should have:

• A description
• Owner
• Risk assessment
• Required action
• Due date
• Approval
• Evidence of closure

Periodic Control Testing

Organizations should verify that treasury controls are not only designed correctly but are operating as intended.

The COSO Internal Control Framework organizes internal control around control environment, risk assessment, control activities, information and communication, and monitoring activities.

What Should a Treasury Policy Include?

A treasury policy defines what the treasury function is allowed to do and where its authority ends.

A well-designed treasury policy commonly addresses:

• Purpose and scope
• Treasury governance
• Roles and responsibilities
• Delegation of authority
• Cash management
• Liquidity requirements
• Bank account administration
• Payment controls
• Investments
• Borrowing
• Foreign exchange
• Derivatives and hedging
• Counterparty exposure
• Credit risk
• Interest-rate risk
• Approved instruments
• Transaction limits
• Bank relationships
• Signatory rules
• System access
• Reporting
• Exceptions
• Escalation
• Policy review frequency

The policy should identify roles rather than individual employee names wherever possible so routine personnel changes do not immediately make the document outdated.

Most importantly, the treasury policy must be actively governed.

A policy stored in a shared drive but never reviewed, approved, distributed, or tested provides limited protection.

A policy management system can help treasury and compliance teams manage approvals, review cycles, version history, distribution, and employee acknowledgments.

Treasury Compliance Checklist for 2026

Use this checklist as a starting point for reviewing your treasury control environment.

Governance

• Confirm treasury responsibilities and reporting lines.
• Maintain an approved delegation-of-authority matrix.
• Define payment and transaction limits.
• Review treasury policies on schedule.
• Document policy exceptions and approvals.

Cash and Banking

• Maintain a current bank-account inventory.
• Review authorized signatories.
• Remove inactive banking users.
• Reconcile bank accounts on schedule.
• Review dormant accounts.
• Monitor cash concentrations and liquidity limits.

Payments

• Separate payment initiation and approval.
• Use dual approval for higher-risk transactions.
• Independently verify changes to beneficiary bank details.
• Restrict who can create or modify beneficiaries.
• Monitor unusual or high-value payments.
• Maintain transaction audit trails.

Sanctions and Counterparties

• Determine which sanctions requirements apply.
• Use current sanctions data where screening is required.
• Establish procedures for potential matches.
• Document escalation decisions.
• Review relevant counterparties according to risk.
• Monitor regulatory updates affecting transactions.

Systems

• Review treasury-system access periodically.
• Require appropriate authentication controls.
• Restrict administrator privileges.
• Remove access promptly when personnel leave or change roles.
• Monitor system changes.
• Maintain appropriate logs and records.

Risk Management

• Maintain a treasury risk register.
• Assign risk owners.
• Monitor foreign exchange exposure.
• Monitor interest-rate exposure.
• Review counterparty concentration.
• Test key controls periodically.
• Track corrective actions to completion.

Audit Readiness

• Maintain evidence for recurring treasury controls.
• Document management reviews.
• Track audit findings.
• Assign corrective actions.
• Verify remediation before closing findings.
• Keep policies and procedures current.

Organizations can use VComply’s risk management software to maintain risk registers, assign owners, conduct assessments, and connect mitigation activities with broader compliance programs.

How to Build a Treasury Compliance Framework

A practical treasury compliance framework can be built in seven steps.

Step 1: Define the Scope

Identify treasury processes, entities, jurisdictions, banks, systems, payment types, investments, and financial instruments.

Step 2: Identify Applicable Requirements

Work with compliance, legal, accounting, tax, and audit teams to determine which laws, regulations, standards, contracts, and internal requirements apply.

Avoid assuming that every financial regulation applies to every corporate treasury operation.

Step 3: Map Risks to Controls

For each treasury risk, identify the control designed to prevent or detect failure.

For example:

Risk: Unauthorized vendor payment
Control: Independent verification of bank-detail changes plus dual authorization
Owner: Treasury Manager
Frequency: Every change
Evidence: Verification record and approval history

This simple structure turns treasury compliance into something measurable.

Step 4: Assign Ownership

Every recurring control needs a named role responsible for execution.

An unassigned control is rarely a reliable control.

Step 5: Automate Recurring Activities

Recurring access reviews, bank-account reviews, policy certifications, reconciliations, risk assessments, and control testing should be scheduled rather than dependent on memory.

VComply’s compliance automation guide explains how organizations can assign recurring responsibilities, automate reminders, collect evidence, and maintain audit trails.

Step 6: Collect Evidence

Require evidence at the point where each control is performed.

This reduces the audit-time scramble to reconstruct what happened six months earlier.

Step 7: Monitor Exceptions and Trends

Do not measure treasury compliance only by the percentage of tasks completed.

Track indicators such as:

• Overdue controls
• Failed controls
• Payment exceptions
• Policy exceptions
• Unreconciled transactions
• Unauthorized access findings
• Sanctions alerts
• Fraud attempts
• Audit findings
• Corrective actions past due
• Counterparty-limit breaches

These indicators give leadership a clearer picture of the health of treasury controls.

Common Treasury Compliance Mistakes

Relying on Spreadsheets for Everything

Spreadsheets may work when the treasury function is small.

As the organization grows, however, spreadsheets make it difficult to control ownership, approvals, evidence, recurring deadlines, and version history.

Reviewing Controls Only Before an Audit

Treasury compliance should operate throughout the year.

A control that is tested only during audit preparation provides little visibility into what happened during the rest of the period.

Confusing Policy With Compliance

Writing “all payments require approval” does not prove payments were approved.

Compliance requires evidence that the control operated.

Giving Too Many Users Bank Access

Treasury access should follow least-privilege principles.

Users should receive only the access needed for their role.

Ignoring Policy Exceptions

A large number of approved exceptions can indicate that the policy itself no longer reflects operating reality.

Review trends rather than treating every exception as an isolated event.

Failing to Update Requirements

Sanctions, legal requirements, business activities, bank relationships, and systems change.

Control frameworks need to change with them.

How VComply Supports Treasury Compliance

Treasury compliance often involves several departments.

Treasury owns financial processes. Compliance tracks regulatory obligations. Risk teams assess exposure. Internal audit tests controls. Legal interprets regulatory requirements. Employees across the organization may own specific actions.

Problems occur when all of this activity is spread across spreadsheets, shared drives, emails, calendars, and separate tracking systems.

VComply’s compliance management platform helps organizations connect requirements, controls, responsibilities, policies, risks, evidence, and corrective actions within one system.

Teams can use it to:

• Assign treasury compliance responsibilities
• Schedule recurring controls
• Automate reminders
• Collect supporting evidence
• Track overdue activities
• Manage control testing
• Monitor findings
• Assign corrective actions
• Maintain audit trails
• Report compliance status to leadership

PolicyOps can support treasury-policy reviews, approvals, publishing, acknowledgments, and version history, while RiskOps provides centralized risk registers, assessments, ownership, and mitigation tracking.

The objective is not to replace treasury management systems or banking platforms.

It is to create an operational compliance layer that shows what must happen, who owns it, when it is due, whether it happened, and what evidence proves it.

Frequently Asked Questions About Treasury Compliance

What is treasury compliance?

Treasury compliance is the process of ensuring that cash management, payments, banking, investments, debt, foreign exchange, financial risks, and related treasury activities follow applicable regulations, financial controls, contracts, and internal policies.

What are treasury compliance requirements?

Requirements vary by organization. They may include sanctions controls, financial reporting controls, segregation of duties, payment authorization, bank-account governance, access management, transaction limits, risk monitoring, recordkeeping, and requirements specific to the organization’s industry or jurisdiction.

What are the most important treasury controls?

Key controls include segregation of duties, dual payment authorization, bank reconciliations, beneficiary verification, user-access reviews, transaction limits, approved counterparties, sanctions controls where applicable, policy reviews, exception management, and periodic control testing.

Does OFAC apply to corporate treasury?

U.S. sanctions requirements can affect corporate treasury when transactions fall within U.S. jurisdiction or otherwise involve activities subject to OFAC-administered sanctions. Applicability depends on the organization and transaction. Treasury teams should establish a sanctions compliance process appropriate to their risk and seek legal guidance when necessary.

Does every company need an AML program?

No. Specific Bank Secrecy Act and AML program requirements apply to defined categories of financial institutions and other covered businesses. Nonfinancial companies should determine which requirements apply to their activities rather than assuming banking regulations automatically apply.

Does the Corporate Transparency Act still require U.S. companies to submit beneficial ownership information?

As of August 2026, U.S. companies are exempt from FinCEN’s BOI reporting requirement under the current final rule. Certain foreign entities registered to do business in the United States remain subject to requirements relating to foreign beneficial owners.

How often should treasury controls be tested?

Frequency should be risk-based. Some controls operate for every transaction, while others may be daily, monthly, quarterly, or annual. Higher-risk activities and key financial reporting controls generally require more frequent monitoring.

What is a treasury compliance audit?

A treasury compliance audit evaluates whether treasury activities conform to applicable regulations, internal policies, authorization requirements, financial controls, and risk-management procedures. Auditors typically review control design, evidence of operation, access, transactions, reconciliations, approvals, policies, and exceptions.

Build Treasury Compliance Into Daily Operations

Treasury manages one of the organization’s most valuable and vulnerable assets: its money.

That makes treasury compliance more than a regulatory requirement.

It is the system that determines who can move funds, what they are allowed to do, which risks are acceptable, how exceptions are handled, whether transactions can be traced, and whether leadership can trust the financial processes supporting the business.

A strong treasury compliance program starts with a simple structure:

Identify the requirement. Define the control. Assign the owner. Set the frequency. Capture the evidence. Monitor the result. Fix exceptions.

When those steps operate continuously, treasury teams spend less time reconstructing evidence for auditors and more time identifying risk before it turns into a loss.

If your treasury controls are currently managed through spreadsheets, email reminders, shared drives, and manual follow-ups, VComply can help centralize compliance responsibilities, controls, evidence, risks, policies, and corrective actions in one place.