For AP/Finance Teams • EU hosting • Immutable timestamped evidence

Stop risky payments before they reach the bank.

One fraudulent transaction can cost millions. Runward sits between your ERP and bank, catching suspicious payments automatically — everything backed by immutable evidence and receipts for every payment run.

Start 90-day pilot View sample pack

Deploy in days • SEPA + CSV • No supplier onboarding

→

Next: 15-minute assessment → ERP export files review → first gated run.

Without Runward

Approved — beneficiary change missed

With Runward

Control enforced — payment held

Supplier

ACME GmbH

Ref: INV-2026-3847

Amount

€12,800

Last paid: Jan 2025

Expected

AT77••••3204

Payment file

AT91••••7781

Changed

€12,800 sent to the wrong account

Invoice looked legitimate — the bank details change went unnoticed.

Supplier

ACME GmbH

Ref: INV-2026-3847

Amount

€12,800

Last paid: Jan 2025

Expected

AT77••••3204

Payment file

AT77••••3204

Held

✓ Supplier verified · Dual approval · Audit-ready

Payment held. €12,800 protected.

Matched against the verified beneficiary record and stopped before execution.

Encryption in Transit & At Rest

Hosted in EU (Germany)

RFC 3161 Timestamp Anchoring

Built on ISO 27001 Principles

Why now

Instant payments raise the stakes. Controls need to move upstream.

VoP is mandatory — but it won't enforce your process.

EU rules roll out instant payments and Verification of Payee (VoP). VoP is a name/IBAN check — it won't enforce dual control, callbacks, or payout holds. Runward enforces those controls before bank upload.

VoP in force since 9 Oct 2025.

Credit-transfer fraud is costly — and payers eat the loss.

Social engineering and invoice diversion target bank-detail change workflows. Regulators report billions in fraud losses, with most losses borne by payment service users.

EBA reports €4.2bn in payment fraud losses (EU, 2024) and ~€2.2bn in credit transfers.

Auditors don't want screenshots. They want receipts.

"Who changed what and why?" and "What exactly was submitted?" — Runward produces line-level outcomes (blocked/cleansed + reasons), control sums, run hashes, and RFC 3161 timestamps — so you can prove what happened, end-to-end.

CORE WORKFLOW

Verify → Gate → Prove

Three safeguards — one workflow — total confidence from detection to proof.

STEP 1 — VERIFY

Verify bank changes using contacts you already trust.

When bank details change, Runward assesses the risk, locks the payout, sends a one-time code to a trusted contact, and requires a verified callback + 4-eyes sign-off. Every step is recorded for audit.

Trusted sources only

Contacts come from pre-verified sources (ERP master data or contract). Using details from a change request is blocked by policy.

Privacy by Design

Contacts are masked by default and time-limited on reveal. We store verification metadata (who / when / source / result), not unnecessary personal data.

Email is the default channel. If no verified email exists, Runward supports a phone read-back challenge to a trusted number—still time-boxed, logged, and dual-controlled.

Verification Requestvf_9a2b3c4d

Vendor

ACME GmbH

Change type

New IBAN

RISK: AMBERNew Corridor / Country MismatchHold Applied: 72h

Contact method

Operator

ManagerTOTP

Gatekeeper

SEPA validation

Sample data

Input

payment_run.xml

pain.001.001.03

Output

PayRun_GATED.xml

pain.001.001.003 watermarked

GATED

Format Check·Apply Rules·Flag Risks·Catch Duplicates

12 payments10 payments−2 (€2,000)

Export:Clean file

Finding

Evidence

Proof

Duplicate payment detectedAMBER

Same invoice appears in a prior run and reappears inside this file.

Invoice

INV-HARDDUP-002

Amount

€1,000.00

Rule evaluationIMMUTABLE

Matched ruleR-44 Duplicate Invoice

Rules versionv1.2 (pinned)

IBANAT77••••••••3204

DecisionLine removed from clean file

Deterministic evaluation — same inputs = same outputs

Audit trail

RFC 3161 timestamped

Run ID05384bd8

Run hashd6ee6644da0e71286763…756dab43

SHA-256 proof artifactVerifiable

Proof artifacts generated automatically for every run.

STEP 2 — GATE

The checkpoint between your ERP and the bank.

Every payment file passes through Runward's policy engine before upload. We enforce your rules, block suspicious transactions, and output a clean file — or tell you exactly what failed and why.

IngestValidate & enforceClean output

Catch risk before money moves

Amount spikes & unusual totals • Duplicate invoices / beneficiaries • New payment corridors / first-time recipients • Vendor holds & restricted payouts

STEP 3 — PROVE

Evidence you can verify — without screenshots.

Every payment run generates a complete audit package: the file you uploaded, the file we released, what changed, and why — all with checksums, timestamps, and a tamper-proof chain you can verify independently.

Complete event history
A tamper-evident history of what happened and who approved it.
Checksums + reproducible hashes
Recompute hashes and validate every file against checksums.
RFC 3161 timestamp receipt
Independent anchoring via the embedded TSA proof.

Audit Summary: Run #13812

VERIFIED

At a glance

File type

pain.001.001.03

Counts

3 total • 1 blocked

TSA

anchored

Control sum

€23,500.00

Pack contents

Rules v1.2 • 5 checksums

manifest.json — schema + hashes + checksums
receipts.json — TSA receipt + watermark token
README.txt — how to verify everything

Hash chain verified

Timestamp receipt embedded

Click the tabs to inspect the underlying audit pack files.

OPERATE & MONITOR

Keep coverage high over time.

Track holds, surface exceptions, and detect payments that bypass the gate.

Bypass Detection

Catch payments that bypass your controls.

Upload your bank statement (CSV, CAMT, MT940) and Runward flags any payment that didn't go through the gatekeeper — giving you a weekly coverage report and email alerts when bypasses occur.

Automatic watermark detection
Every clean file includes a traceable Run ID token. Missing tokens = bypass.
Analytics Dashboard
Track Gatekeeper coverage, verified bank-change adoption, € prevented, and top risk drivers over time.
Close the loop
Weekly bypass summaries with amounts and dates — plus optional Slack/Email nudges when new bypasses appear.

Bypass Count

Total Txns

Bypass Total

€12,800.00

Bank Statement Upload: Jan 2026Last upload: 2026-01-17 09:32 CET

Value Date	Beneficiary	Amount	Runward Tag	Status
1/15/2025	Supplier A GmbH	€1,500.00	RW-13805-A7B3	MATCH
1/15/2025	Supplier B AG	€2,300.00	RW-13806-C2E1	MATCH
1/16/2025	Freelancer C	€800.00	—	BYPASS
1/16/2025	Vendor D Ltd	€5,000.00	RW-13807-F4D9	MATCH
1/17/2025	Office Supplies Direct	€12,000.00	—	BYPASS

Mock data for illustration. Real reconciliation uses uploaded bank statements.

DEPLOY & SECURE

Fast rollout. Built for compliance.

How to get started and what guarantees you can rely on.

Procurement Ready

Security & compliance for EU finance teams

German-hosted, GDPR-first, and built on proven security standards.

Hosted in Germany

AWS Frankfurt. EU data residency guaranteed. No US data transfers.

Privacy by design

Minimal data collection. Contacts encrypted and masked. Complies with GDPR requirements.

Enterprise security

Encrypted in transit and at rest. Multi-factor auth. Built on ISO 27001 principles.

Verifiable audit trail

Independent timestamps. Tamper-evident logs. Export evidence packs for auditors.

Live in days — no IT project required

Finance teams can protect the next payment run without changing your ERP or coordinating with suppliers.

File-based workflow—works with any ERP export (SEPA XML or CSV)

No supplier onboarding or vendor communication needed

Most teams run their first protected file within 5 business days

Supported:SEPA pain.001.001.03Standard CSVCAMT / MT940 (reconciliation)

PRICING & ACCESS

Start protecting your business today

Full platform access • Unlimited usage • Setup included

Early access (Q1 2026)

What's included in the pilot

Full access to Gatekeeper, Verification Console, and Audit Packs

Guided setup: policy configuration + support through your first gated run

Bank-ready output: pain.001.001.03 + CSV validated to your portal profile

Bypass detection: watermark + statement matching for payments outside Runward

Unlimited usage during the pilot (no caps on runs, vendors, or verifications)

€0 for 90 days

Cancel anytime • Pricing shared before day 90 — no surprises

Stop risky payments before they reach the bank.

Instant payments raise the stakes. Controls need to move upstream.

VoP is mandatory — but it won't enforce your process.

Credit-transfer fraud is costly — and payers eat the loss.

Auditors don't want screenshots. They want receipts.

Verify → Gate → Prove

Verify bank changes using contacts you already trust.

The checkpoint between your ERP and the bank.

Evidence you can verify — without screenshots.

Complete event history

Checksums + reproducible hashes

RFC 3161 timestamp receipt

Keep coverage high over time.

Catch payments that bypass your controls.

Automatic watermark detection

Analytics Dashboard

Close the loop

Fast rollout. Built for compliance.

Security & compliance for EU finance teams

Live in days — no IT project required

Start protecting your business today

What's included in the pilot

Frequently Asked Questions

Verify bank changes using contacts you already trust.

The checkpoint between your ERP and the bank.

Evidence you can verify — without screenshots.

Complete event history

Checksums + reproducible hashes

RFC 3161 timestamp receipt

Catch payments that bypass your controls.

Automatic watermark detection

Analytics Dashboard

Close the loop

Security & compliance for EU finance teams

Live in days — no IT project required

Frequently Asked Questions

Stop risky payments before they reach the bank.

Instant payments raise the stakes. Controls need to move upstream.

VoP is mandatory — but it won't enforce your process.

Credit-transfer fraud is costly — and payers eat the loss.

Auditors don't want screenshots. They want receipts.

Verify → Gate → Prove

Verify bank changes using contacts you already trust.

The checkpoint between your ERP and the bank.

Evidence you can verify — without screenshots.

Complete event history

Checksums + reproducible hashes

RFC 3161 timestamp receipt

Keep coverage high over time.

Catch payments that bypass your controls.

Automatic watermark detection

Analytics Dashboard

Close the loop

Fast rollout. Built for compliance.

Security & compliance for EU finance teams

Live in days — no IT project required

Start protecting your business today

What's included in the pilot

Frequently Asked Questions

Which banks and SEPA dialects do you support?

What if I have an urgent payment to a vendor on hold?

Will the bank reject the file if Runward holds a payment?

What happens when Runward verifies a new IBAN but my ERP still has the old one?

What CSV formats does Runward support?

What notification channels do you support?

Verify bank changes using contacts you already trust.

The checkpoint between your ERP and the bank.

Evidence you can verify — without screenshots.

Complete event history

Checksums + reproducible hashes

RFC 3161 timestamp receipt

Catch payments that bypass your controls.

Automatic watermark detection

Analytics Dashboard

Close the loop

Security & compliance for EU finance teams

Live in days — no IT project required

Frequently Asked Questions

Which banks and SEPA dialects do you support?

What if I have an urgent payment to a vendor on hold?

Will the bank reject the file if Runward holds a payment?

What happens when Runward verifies a new IBAN but my ERP still has the old one?

What CSV formats does Runward support?

What notification channels do you support?