Verification of Payee produces a decision-relevant signal at a precise moment in time. If you do not capture that signal, you lose the ability to explain — or defend — what happened when a payment is later questioned. But logging everything indefinitely is its own risk, especially when the data concerns a third party. The goal is a log that is complete enough to be useful and lean enough to be responsible.
What to record for each check
- A stable request ID linking the check to the payment.
- The standardised outcome (match, close match, no match, not available).
- A timestamp, and whether the outcome was shown before authorisation.
- The payer's subsequent decision (proceeded, corrected, or stopped).
What to be careful with
Some data is sensitive or simply unnecessary to keep. Minimise it.
- 1 Avoid storing the full returned counterparty name when the outcome alone suffices.
- 2 Apply data-minimisation: keep what supports a decision, not what is merely available.
- 3 Protect the log with access controls and encryption, like any payment record.
- 4 Define a retention period aligned to disputes and regulation, then delete reliably.
Log the decision, not the dossier
The most defensible log captures the outcome and the payer's choice, not a detailed profile of the counterparty. It answers the dispute question while respecting data-protection principles.
RoxPay returns a structured outcome and a request ID designed to drop straight into your audit trail, so you can prove what was shown and chosen without collecting more than you need.