Payment risk management (mokėjimų rizikų valdymas) is the documented set of limits, controls, roles and escalation steps that keep your company’s money from being lost, frozen or misdirected. For a Lithuanian or EU business, it covers four areas: fraud, operational failure, liquidity and compliance. It works only when it is written down, owned by named people and reviewed on a schedule.
This guide is for founders, CFOs and finance leads at SMEs, e-commerce companies and cross-border businesses. It uses current regulator data from the European Banking Authority (EBA), the European Central Bank (ECB) and the Bank of Lithuania, then turns it into controls you can apply to your own accounts, cards and payment flows.
DemivoltBuild More Control Into Business PaymentsDemivolt offers dedicated IBAN accounts, role-based user management and business cards to help companies manage payment flows.Explore DemivoltTL;DR
- Payment fraud is now a leading operational risk in European finance, and instant payments are where it is growing fastest.
- Technical tools are not enough. Most fraud starts with stolen credentials or social engineering, so people and approval rules matter as much as software.
- Define risk appetite in numbers: limits, indicators and a pre-approved escalation path, not a general statement.
- Account structure is a control. Separate accounts, role-based access and dedicated IBANs reduce the damage any single error or breach can cause.
- Review the setup on a fixed cycle, because fraud methods and EU rules change every year.
Table of Contents
- Why payment risk is rising
- The four payment risks every company should map
- Instant payments: faster money, shorter recovery window
- Strong Customer Authentication is necessary, not sufficient
- What the Bank of Lithuania expects from regulated firms
- Set risk appetite in numbers
- Account structure as a risk control
- Know your payment costs before you route money
- Our perspective: risk management belongs in the account design
- Practical checklist for the next 30 days
- Set up payments with built-in controls
- FAQ
- Sources
Why payment risk is rising
The EBA’s operational risk assessment shows how quickly the picture has shifted. In its Risk Assessment Questionnaire, agreement that fraud is a relevant operational risk rose from 33% in March 2023 to 52% by March 2025, making payment fraud the second most relevant operational risk for institutions. Respondents named theft of customer credentials and social engineering as the main drivers, at 60%.
The 2025 EBA and ECB report on payment fraud puts a figure on it: fraud reported across the European Economic Area amounted to EUR 4.2 billion in 2024. Most of it by value came from credit transfers and card payments, the two instruments nearly every company uses. The same report shows that over the period it analyzed, SEPA instant credit transfer volumes grew by 98% while related fraud grew by 175%.
The practical reading for a finance team: the instruments you rely on every day are the ones being targeted, and the attackers increasingly target your staff rather than your systems.
The four payment risks every company should map
A risk map does not need to be elaborate. For an SME it can start with four categories and one owner for each.
| Risk | What it looks like in practice | Typical control |
|---|---|---|
| Fraud | Fake supplier invoices, changed bank details, phishing of staff with account access, card misuse | Dual approval, payee verification, card limits |
| Operational | Payment missed because of a cut-off time, wrong IBAN, a single user holding all access | Payment calendar, role separation, backup approvers |
| Liquidity | Fees or SWIFT charges leave a shortfall, funds sit in the wrong account | Cash buffers per account, fee forecasting |
| Compliance | Incomplete due diligence documents, unexplained transaction patterns | Documented counterparties, retained invoices and contracts |
Fraud: the human element
The EBA’s finding that credential theft and social engineering lead the drivers means the weakest point is usually a person who is convinced to approve a payment. Typical scenarios are an email “from the CEO” asking for an urgent transfer, or a supplier “updating” its IBAN. The control is procedural: any change to payee details is confirmed through a second, independent channel, and no single person can both create and approve a payment above a set amount.
Operational: timing and access
Missed cut-off times are an everyday operational risk for companies paying in euro. Our guide to SEPA cut-off times and the instant payments rollout in Lithuania explains how a payment submitted too late can slip a business day, and why that matters for payroll and supplier deadlines.
Liquidity: fees and shortfalls
SWIFT transfers can arrive short once intermediary charges are deducted. If your supplier must receive an exact amount, you need a fee-aware process. Our treasury checklist on reducing SWIFT fees walks through this.
Instant payments: faster money, shorter recovery window
SEPA instant transfers settle in seconds. That is an advantage for cash flow and a problem for fraud recovery: once a fraudulent payment is authorized, there is almost no time to stop it. Industry reporting cited in the EBA and ECB material puts instant payment fraud rates at roughly ten times those of conventional credit transfers.
The EU’s Instant Payments Regulation responds in part with Verification of Payee. Payment service providers must offer the payer a check that the name matches the account holder before a transfer is sent. This applies to both standard and instant credit transfers and must be free of charge to the payer. The ECB page lists the staged implementation deadlines for euro area and non-euro area providers, including e-money and payment institutions, so confirm the date that applies to your provider.
What to do on your side:
- Treat a payee-name mismatch warning as a stop, not a formality. Contact the supplier by phone using a number you already hold.
- Set lower per-transaction and daily limits for instant transfers than for scheduled SEPA payments.
- Keep instant payments off accounts that hold your main reserves.
In Lithuania the regulator is also pushing banks to do more. In February 2026 the Bank of Lithuania presented legislative changes that would oblige providers to stop suspicious transfers and clarify when a payment counts as authorized by the client. These were proposals at the time of reporting, so check the current status of the legislation before relying on them.
Strong Customer Authentication is necessary, not sufficient
Strong Customer Authentication (SCA) requires two independent factors for most electronic payments. The regulatory technical standards behind it also require providers to run transaction monitoring mechanisms, which should take account of risk factors such as unusual spending, device and location patterns. In other words, a correct code does not prove a legitimate payment.
The EBA’s opinion on new types of payment fraud notes that as SCA has been successful, fraudsters adapted by manipulating people into giving up credentials or authorizing payments themselves. For a company this means:
- Never share one-time codes or approval prompts with anyone, including someone claiming to be from your bank.
- Train every user with payment access on the specific scams above, at least once a year and whenever staff change.
- Review unusual patterns yourself: a new beneficiary, a first payment to a new country, a round-number urgent transfer.
What the Bank of Lithuania expects from regulated firms
If you are a payment or e-money institution, or you run a fintech platform, the regulator’s expectations are direct. In its 2023 review of 80 institutions, 41 e-money and 39 payment institutions, the Bank of Lithuania found that none scored fully on risk management, internal control and internal audit requirements. Fifty met them only partially and 15 did not meet them at all.
The central bank’s guidelines on organizing the risk management process for e-money and payment institutions describe what a supervisor looks for: a risk map, an incident register, a board-approved communication plan and a framework that develops with the institution’s life cycle stage. The Bank also publishes recommendations for e-money and payment institutions, including on governance and compliance culture.
These rules bind licensed institutions, not every SME. They are still a useful template. A company that can show the same artifacts to its bank or payment provider will usually move through due diligence and periodic reviews with less friction.
Set risk appetite in numbers
“We have a low tolerance for fraud” is not a control. The Bank of Lithuania’s guidelines point to quantitative indicators for each risk category, and the same discipline works for an SME. Build a one-page table:
| Risk | Indicator | Example threshold (set your own) | Escalation |
|---|---|---|---|
| Fraud | Payments to new beneficiaries per week | Any above the approval limit | Finance lead confirms by phone |
| Fraud | Card declines or chargebacks per month | A set percentage of card volume | Freeze the card, review merchant category |
| Operational | Payments sent after the cut-off time | More than zero for payroll | Move payment to the previous day’s batch |
| Liquidity | Balance in the operating account | Below two weeks of outgoing payments | Transfer from reserve account |
| Compliance | Counterparties without documents on file | Any above a set payment size | Hold payment until documents arrive |
The thresholds above are examples only. Your numbers depend on volume, margins and sector. What matters is that each threshold has an owner and a pre-approved action, so nobody improvises while a problem is unfolding.
Account structure as a risk control
How you set up accounts and access often prevents more loss than any monitoring tool. A sound structure has these elements:
- Separate accounts by purpose. Keep operating cash, tax reserves, payroll and customer funds apart, so a single compromised payment flow cannot reach everything.
- Role-based access. Give each user only the permissions the job requires. Separate the person who prepares payments from the person who approves them.
- Dedicated IBANs. A dedicated IBAN per business line or customer group makes reconciliation faster and unusual inflows easier to spot.
- Card controls. Issue virtual cards for online subscriptions and advertising, and physical cards only where needed, each with its own limit.
- Safeguarded funds. Check that your provider holds client money in segregated accounts and is regulated in the EU.
Know your payment costs before you route money
Cost surprises are a form of liquidity risk. These are the Demivolt fees for core payment flows:
| Payment type | Fee |
|---|---|
| SEPA In | €0 |
| SEPA Out | €0.40 per transfer |
| SWIFT In | €25.00 |
| SWIFT Out | €30.00 |
| Internal transfers between Demivolt accounts | €0 |
| Account opening, verification, monthly maintenance, closure | €0 |
You can check euro transfer costs with our SEPA fee calculator. Routing supplier payments inside the SEPA area, and keeping SWIFT for cases where there is no alternative, lowers both fees and the number of intermediaries that can delay or alter a payment.
Our perspective: risk management belongs in the account design
We see the same pattern in many onboarding conversations. Companies treat payment risk as something to bolt on after the account is working: a security tool, a policy document, a training session. In our experience, it is more effective to decide the structure first.
Our position is that three things make the biggest difference for SMEs and cross-border companies. First, a clear account hierarchy, with multiple accounts and role-based users, so access mirrors responsibility. Second, transparent fees, so finance teams can forecast cash and do not discover costs after a payment is made. Third, a regulated provider with segregated client funds and risk-based onboarding that is rigorous but quick, so compliance questions are answered at the start rather than during an incident.
We also think regulators are right that risk management has to be a cycle. The fraud figures above change every year, and a framework written once will be out of date by the next review. Put a date in the calendar, assign an owner, and treat each incident as an input to the next version of the map.
— dd
Practical checklist for the next 30 days
- List every account, card, payment method and user with access. Remove anyone who no longer needs it.
- Write the four-category risk map and name an owner for each risk.
- Set approval thresholds: single approver below one amount, two approvers above it.
- Add a rule that supplier bank-detail changes need a call-back to a known number.
- Set separate, lower limits for instant transfers.
- Put limits on every card and use virtual cards for recurring online spending.
- Create an incident log with date, description, amount, response and lesson learned.
- Schedule a quarterly review, and a full one each year.
Set up payments with built-in controls
If you are restructuring how your company holds and moves money, our business accounts give you dedicated IBANs, multi-account structures and role-based user management under EU regulation. Our payments service covers SEPA and SWIFT, and our card programmes provide virtual and physical Visa business cards. Opening an account carries no fee, and a dedicated client manager is included at no charge. Get started or contact us to discuss your payment flows.
Advisors who guide clients through this kind of review can also look at our reseller programme.
FAQ
What does payment risk management include?
It covers fraud, operational errors, liquidity and compliance across every way your company sends or receives money. In practice it means a risk map, approval limits, access controls, an incident log and a regular review. It should be written down so you can show it to a bank, an auditor or a regulator.
Do SMEs in Lithuania have to follow the Bank of Lithuania’s risk guidelines?
The guidelines are addressed to licensed e-money and payment institutions, not to ordinary SMEs. Still, they describe good practice that any company can adopt, and your payment provider will expect sensible controls. If you are unsure which rules apply to your business, ask a qualified lawyer or your compliance adviser.
Are instant payments riskier than standard SEPA transfers?
The EBA and ECB data show fraud on instant credit transfers growing faster than their volume, and the money can be gone within seconds. Verification of Payee and lower limits on instant transfers reduce the exposure. Standard scheduled transfers leave more time to notice a problem.
How can I reduce SWIFT-related shortfalls?
Confirm the fee arrangement before sending, and budget for the SWIFT Out fee of €30.00 and, on the receiving side, the SWIFT In fee of €25.00 where they apply. Where the beneficiary has a euro account in the SEPA area, a SEPA transfer at €0.40 is usually simpler and cheaper.
Sources
- EBA: Operational risks and resilience
- EBA and ECB: 2025 Report on Payment Fraud
- EBA: Opinion on new types of payment fraud and possible mitigations
- ECB: Instant Payments Regulation
- EUR-Lex: Delegated Regulation 2018/389
- Bank of Lithuania: 2023 review of e-money and payment institutions
- Bank of Lithuania: risk management process guidelines
- Bank of Lithuania: recommendations for e-money and payment institutions
- 77.lt: Bank of Lithuania proposals on stopping suspicious transfers