Bank Statement Scrubbing: Compliance and Documentation Requirements

Introduction

Every funded deal in the merchant cash advance and alternative lending space begins with a stack of documents. Before a single number is calculated, before a single risk flag is raised, someone has to answer four questions: Is this the right business? Are these the right statements? Do the numbers match? Is anything hidden in the file?

That is compliance in bank statement scrubbing - and it is the difference between a funder that survives a portfolio review and one that does not. This guide gives you the complete compliance system: the 6-Document Compliance Stack, how to verify every document, the red flags that kill a file, and how to keep the audit trail that protects you in both the USA and Canada. [R1]

The 6-Document Compliance Stack

After working with hundreds of MCA funders and ISOs across North America, we have condensed compliance into the 6-Document Compliance Stack - the six documents that cover 95% of the verification work in MCA underwriting:

The stack is deliberately small. Six documents, collected in the same order on every file, create a process that is fast, consistent, and auditable - the three things compliance actually requires. [R2]

How to Verify Each Document

Collecting the stack is half the work; verifying it is the other half. Run the same four checks on every document:

Each document gets a specific verification pass:

• Bank statements: verify the bank logo, routing prefix, account number against the voided check, and check every page number is present and sequential.
• Bank letter: call the bank's verification line when in doubt - a two-minute call has stopped more fraud than any software.
• Voided check: confirm the name and account match the statements, not just the application.
• Formation documents: confirm the entity type, state of formation, and that the entity is active (not dissolved).
• Owner ID: compare name, date of birth, and photo against the application and any video verification.
• Proof of authority: confirm the signer is an owner or officer with documented authority to bind the business.

Let us look at the two documents where verification mistakes are most common, because getting these right saves the most money.

Verifying the Bank Statement Deep Dive

The bank statement is the heart of the file - every underwriting decision flows from it. A fake or altered statement is the single most expensive compliance failure in the industry, so the verification pass on this one document deserves the most rigor.

Start with the source. Original PDFs downloaded directly from the bank's online portal are the gold standard; they carry the bank's true file metadata and formatting. Scanned copies are acceptable only when the scan is complete and legible, and screenshots should be treated as red flags - a screenshot of a statement is trivially easy to edit and hard to authenticate. When the file arrives as a screenshot, ask for the original PDF or a bank-verified copy before the file moves forward.

Next, check the mechanics that forgers get wrong. The bank logo should be sharp, not pixelated. The routing number on the statement should match the routing number on the voided check. The statement period dates should be consecutive with the previous month's statement. The page count should be continuous - statement page 1 through page N, with no jumps. And the account holder name should match the legal business name on the application, character for character, including the entity suffix (LLC, Inc., Corp.). [R2][R4]

Verifying the Voided Check Deep Dive

The voided check has one job: prove the account the advance will be funded to is the account being underwritten. It is the bridge between the application and the money, and a mismatch here means funding the wrong account.

Three checks matter. First, the name on the check must match the business on the application and the statements. Second, the account number must match the statements - and note that many banks truncate account numbers on statements, so the full number should be compared against the bank letter rather than the statement alone. Third, the routing number must be a valid US or Canadian routing prefix for the bank named on the check; a routing number that belongs to a different bank is an instant red flag.

When in doubt on either document, the rule is the same as everywhere else in the stack: verify with the bank directly, and if verification fails, decline. A funded file you can prove is the single best outcome; a declined file you cannot verify is the second best. Everything else is where the losses live. [R4][R5]

Verification is where compliance is actually won - a document that is collected but not verified has no compliance value at all. [R3]

Red Flags That Kill a File

Some files should never reach funding. The compliance team's most important job is to catch them early, before the file costs hours of analysis work:

The rule is simple: when in doubt, verify; when verification fails, decline. A declined file costs you a few minutes; a funded fraud costs you the advance plus the reputation. [R4]

The Real Cost of Compliance Failure

Compliance failure is rarely a single dramatic event. It is more often a slow leak: a missing voided check here, an unverified bank letter there, a file funded on a verbal "we checked it" that nobody can prove. Each leak is small. The aggregate is not.

Run the math on a 300-file month: if 2% of files carry a compliance defect, that is six files a month, seventy-two a year. At even a conservative $2,000 average cost per defect - between rework, fees, and relationship damage - that is $144,000 a year leaking out of a single operation. The 6-Document Stack is not paperwork; it is a cost control system. [R1][R4]

Common Compliance Mistakes (and How to Avoid Them)

After reviewing hundreds of scrubbing operations, we see the same mistakes repeated. Each one is fixable - once it is named:

The pattern behind every mistake is the same: compliance treated as a speed bump instead of a system. The fix is also the same: run the stack, verify everything, document everything, and give every red flag a named owner. [R2][R5]

USA Compliance Landscape

MCA is a purchase of future receivables, not a loan - and that distinction drives the compliance landscape. In the USA, there is no single federal MCA licensing regime, but the picture is changing fast at the state level:

• State licensing: a growing number of states (including California, New York, and others) now require registration or licensing for commercial financing providers - and the definitions are expanding to include MCAs.
• Disclosure rules: states like California and New York have enacted commercial financing disclosure laws that require funders to disclose the total cost of capital in standardized terms.
• Usury and interest limits: several states apply interest-rate frameworks to MCA transactions, and courts in some states have recharacterized MCAs as loans - making compliance documentation the only defense.
• BSA/AML: funders are expected to maintain AML programs, including customer due diligence and suspicious activity monitoring on every funded file.

The practical takeaway: the document stack is your first line of defense in any state review. A file with the complete 6-Document Stack, verified and documented, is a file you can defend. [R1][R2]

Canada Compliance Landscape

Canada has its own compliance layer, and funders serving Canadian merchants must respect both:

• PIPEDA: the Personal Information Protection and Electronic Documents Act governs every piece of personal data in the file - owner ID, bank account details, and financial information. Consent, collection limits, and secure storage are mandatory.
• Provincial rules: provinces like Ontario and British Columbia have their own consumer and commercial protection frameworks that can apply to financing products.
• Bank document standards: Canadian bank statements and voided checks follow different formats - the verification checklist must be adapted, not copied from the US playbook.
• Cross-border handling: files moving between US and Canadian operations need clear data-residency and transfer policies to stay PIPEDA-compliant.

The Canadian stack is the same six documents, with a stricter lens on personal data: collect only what you need, store it securely, and document why you have it. [R3]

There is one more Canadian consideration that US-only operations routinely miss: the format of the documents themselves. Canadian bank statements print account and branch numbers in the transit-number format (XXXXX-YYY), voided cheques carry a different MICR layout, and some Canadian business accounts are held with credit unions rather than chartered banks. A scrubbing team trained only on US formats will misread these files - and misreading a transit number is how money goes to the wrong account. The verification checklist must be built for the market the file actually comes from. [R3][R6]

The Audit Trail

Compliance is not what you do; it is what you can prove you did. The audit trail is the record that turns good intentions into defensible operations:

Build the audit trail into the workflow, not after it:

• Time-stamp every verification - who checked the voided check, and when
• Save the original documents, not just extracted data
• Log every exception and how it was resolved
• Run periodic audits - pull 10 random files and verify the trail is complete

There is an important detail in the audit rule that most operations miss: the audit trail must capture negative decisions too. A file that was declined because of a red flag is compliance gold - it proves the controls worked, it trains the team on what to look for, and it protects the funder if the merchant later claims the decline was unfair or discriminatory. Log every decline with the reason, the evidence, and the reviewer. The declines are the files that defend you in a dispute. [R2][R5]

Document storage matters just as much as documentation. Original files should live in access-controlled storage with a retention policy that matches the funder's regulatory obligations - most operations keep funded files for at least three to five years, and declined files for at least one to two. Files that are stored indefinitely without policy are a liability; files deleted too early are a risk. Set the retention window, enforce it, and let the audit trail age out on schedule. [R1]

The funders that pass reviews without stress are the ones whose audit trail is a byproduct of the process, not a cleanup project. [R5]

Why Funders Outsource Compliance

Compliance is expensive to build in-house: hiring, training, tooling, and the constant updates as state rules change. That is why a growing number of MCA funders and ISOs outsource the scrubbing function entirely to specialists like Target Underwriting Solutions.

There is a second reason funders outsource that has nothing to do with cost: accountability. When compliance runs inside a busy in-house team, the pressure to "just get the file funded" is always present - the closer the team sits to sales, the harder it is to say no. A specialist partner has no incentive to push a weak file through; their entire business is the quality of the scrubbing itself. That separation is itself a compliance control. [R5]

Outsourcing compliance gives you:

• Built-in standards: the 6-Document Stack runs on every file, every day
• Current knowledge: specialists track state and provincial rule changes continuously
• Scalable capacity: compliance volume spikes with deal flow, and a partner absorbs the spike
• Cleaner audit trails: professional operations document everything by default

The best compliance program is the one you never have to think about in a crisis - because it ran on every file, every day, before the crisis existed.

Every file is processed under strict NDA, with data security protocols that meet both US and Canadian expectations. [R6]

Implementation: Run the Stack

Compliance in bank statement scrubbing is not a department - it is a discipline that runs on every file. The operations that win are the ones that treat the 6-Document Stack as the floor, not the ceiling: collect it, verify it, document it, and you will fund faster, fail less, and sleep better when the review comes. [R1][R5]

Conclusion

Compliance in bank statement scrubbing is a document discipline. The 6-Document Compliance Stack - bank statements, bank letter, voided check, formation documents, owner ID, and proof of authority - covers 95% of the verification work in MCA underwriting, and the four verification checks (ownership, continuity, math, red flags) turn collection into compliance.

The landscape differs by market: state licensing and disclosure rules are tightening across the USA, while PIPEDA and provincial frameworks set the bar in Canada. But the defense is the same everywhere: a complete stack, verified on every file, with an audit trail that proves it.

Funders that run compliance as a daily discipline fund faster, fail less, and pass reviews without stress. The stack is the floor - collect it, verify it, document it, and your operation is built to survive the scrutiny that is coming to this industry.