In 2020, a German payments company called Wirecard told investors it had €1.9 billion sitting in two banks in the Philippines. Auditors had signed off on that cash for years. When they finally insisted on an original, direct confirmation instead of another scanned PDF routed through a trustee, the banks issued a one-sentence denial: they had never held an account for Wirecard. The money didn't exist. The company collapsed within days.
Wirecard is an extreme case, but the underlying weakness it exposed — auditors trusting confirmations that pass through an intermediary instead of coming straight from the institution holding the cash — is disturbingly ordinary. Most small and mid-sized businesses today don't hold their operating cash in a single named bank account they can walk into and verify. It's split across a payment processor's rolling reserve, a professional employer organization's payroll trust account, an escrow agent's holding account, or a fintech "banking-as-a-service" partner three layers removed from an actual chartered bank. Auditors have been confirming bank balances for decades. They've been much less consistent about confirming cash that sits somewhere else.
The AICPA just closed that gap. In July 2026, it issued Statement on Auditing Standards (SAS) No. 150, and its headline change is blunt: auditors will now be required to externally confirm cash and cash equivalents held by third parties, unless narrow conditions let them skip it. If your business runs any of its cash through a processor, a PEO, or an escrow arrangement, this standard is going to change what your accountant asks you for — even if you've never thought of yourself as an audit client.
What SAS No. 150 Actually Changes
SAS No. 150 amends the existing confirmation guidance in SAS No. 122 (AU-C sections 330 and 505) and SAS No. 142 (Audit Evidence). Three changes matter most for anyone outside the audit profession:
- Mandatory external confirmation of third-party cash. Auditors must now perform an external confirmation procedure for cash and cash equivalents held by an intermediary — a payment processor, a PEO's trust account, an escrow agent, a bank via a fintech partner — to respond to the assessed risk of misstatement, unless specific conditions are met that let them rely on other evidence instead.
- New rules for confirmations routed through an intermediary. The standard directly addresses the reality that a lot of "bank confirmations" today don't come from a bank at all — they come from a processor's dashboard, a portal, or a report the intermediary generates. SAS No. 150 sets conditions for when that kind of evidence is acceptable and when the auditor has to go further, including recognizing direct access to a knowledgeable external source's own records as an acceptable form of confirmation.
- Tighter conditions on negative confirmation requests. Negative confirmations (the "reply only if you disagree" kind) get new limits on when they're appropriate, pushing auditors toward positive confirmations — the kind that require an actual reply — in higher-risk situations.
The standard takes effect for audits of financial statements for periods ending on or after December 15, 2028, with early adoption permitted. That sounds far off, but audit firms are already updating their confirmation templates and client request letters, and businesses that get audited or reviewed annually will start feeling the ripple effects well before the mandatory date — auditors tend to phase in stricter evidence-gathering ahead of a hard deadline rather than flip a switch on the first eligible year-end.
Why This Wasn't a Rule Already
Confirming a bank balance used to be simple: send a form to First National Bank, First National Bank replies with the balance, done. That model assumes your cash sits at one regulated depository institution that will pick up the phone and put a number in writing.
That assumption has been eroding for a decade. Consider where a typical small business's cash actually lives on any given day:
- Payment processor reserves. Stripe, PayPal, Square, and similar processors routinely hold back 5–15% of your card revenue in a rolling reserve for 90 to 180 days (longer if your account is flagged high-risk), to cover potential chargebacks and refunds. That money is yours, it will eventually hit your bank account, and in the meantime it exists only as a balance on the processor's platform — not in a bank account you control.
- PEO payroll trust accounts. If you outsource HR and payroll to a Professional Employer Organization, your payroll funds and payroll tax deposits often flow through the PEO's trust or holding account before the PEO remits them to employees and tax authorities. You're trusting a report from the PEO that the money moved correctly and the taxes were actually deposited.
- Escrow and title accounts. Real estate, M&A, and any transaction with holdback provisions routes cash through a third-party escrow agent, sometimes for months, with the balance evidenced only by the escrow agent's own statements.
- Embedded finance and banking-as-a-service. A growing number of fintech products aren't banks themselves; they partner with a chartered bank behind the scenes. The balance you see in the app may be one or two contractual layers removed from the FDIC-insured account actually holding the funds.
Auditors kept treating all of this the same way they treated a bank confirmation — accept whatever document or portal export the client or the intermediary provided. SAS No. 150 says that's no longer good enough by default: the auditor now has to affirmatively justify not going out and confirming that money independently.
When Auditors Can Still Skip the Confirmation
SAS No. 150 doesn't force a confirmation letter for every dollar in every situation — it just removes the default assumption that skipping one is fine. Auditors can forgo an external confirmation of third-party cash when they've assessed the risk of misstatement as low and can point to alternative evidence, such as direct, read-only access to the intermediary's own records (a live processor dashboard the auditor can independently query, for instance, rather than a static export the client hands over). The standard treats that kind of direct access from a knowledgeable external source as functionally equivalent to a traditional confirmation reply.
In practice, that means the businesses least affected by SAS No. 150 are the ones whose processors, PEOs, and escrow agents already offer auditors a transparent, verifiable window into the balance — and the businesses most affected are the ones relying on relationships where the only "proof" of a balance is a PDF someone forwards once a year.
What This Means If You're the One Being Audited
If your company gets an annual audit or review — because of a lender covenant, an investor requirement, a nonprofit grant, or state licensing — expect your auditor to start asking sharper questions about anywhere your cash sits outside a plain bank account:
- Be ready to name every intermediary holding your cash. Payment processor reserves, PEO trust balances, escrow holdbacks, and fintech partner-bank arrangements should all be identifiable line items, not buried inside a "cash and equivalents" total with no supporting detail.
- Expect requests to go directly to processors and PEOs, not just to you. Your auditor may now request a confirmation letter be sent to your payment processor or PEO directly, rather than accepting a screenshot of your processor dashboard. Some processors and PEOs aren't set up to respond to third-party confirmation requests quickly — that's a new friction point worth raising with your provider before your next audit cycle, not during it.
- Reconcile reserve and trust balances continuously, not just at year-end. If your books already separate "cash in bank" from "cash held by processor" and "cash held in trust by PEO" as distinct accounts, reconciled monthly, you'll sail through this. If a payment processor reserve is buried as a contra-revenue adjustment instead of tracked as restricted cash on the balance sheet, that's exactly the kind of gap this standard is designed to surface.
- Small businesses without a statutory audit aren't off the hook culturally. Even if SAS No. 150 technically only binds AICPA-member auditors performing audits under these standards, lenders and investors increasingly expect the same discipline in reviewed or compiled financials, and the standard raises the bar for what "good bookkeeping hygiene" looks like industry-wide.
The Bookkeeping Habit That Makes This Painless
The businesses that will barely notice SAS No. 150 are the ones that already treat every intermediary holding their cash as a distinct, trackable account rather than an asterisk on a bank statement. That means:
- A separate account (or sub-account) for each payment processor's reserve balance, reconciled against the processor's own reporting every month.
- A separate account for funds in a PEO's trust, reconciled against the PEO's remittance reports — not just assumed to match because payroll "looks right."
- Escrow and holdback balances tracked with their release conditions and expected timing, not lumped into a generic receivable.
This is really just an extension of good double-entry bookkeeping: every dollar you're owed by an intermediary is a real asset with a real counterparty, and it deserves its own line, not a footnote. Plain-text, version-controlled accounting makes this kind of granular tracking natural — each processor, PEO, and escrow relationship gets its own account in your ledger, and every reconciliation is a diffable, auditable commit rather than a spreadsheet someone has to reconstruct from memory when the confirmation letter arrives.
Keep Your Cash Trail Auditable From Day One
As more of your cash sits with processors, PEOs, and escrow agents instead of a single bank, the businesses that fare best under standards like SAS No. 150 are the ones whose books already treat those balances as first-class, reconciled accounts. Beancount.io gives you plain-text accounting with full transparency and a complete history of every reconciliation — no black boxes, no vendor lock-in. Get started for free and keep every dollar, wherever it's held, traceable back to a real source.