A duplicate file submission occurs when the same payment population is transmitted more than once, potentially creating duplicate debits even though each individual file is internally valid. This guide explains the mechanics, evidence, failure points and controls a UK business should understand before relying on the process.
What this means in practice
A duplicate file submission occurs when the same payment population is transmitted more than once, potentially creating duplicate debits even though each individual file is internally valid. The practical question is whether the company can evidence the condition at the moment a payment, drawdown or hedge decision is made.
Controls can combine unique file identifiers, source-batch status, control totals, file hashes and bank acknowledgements so a failed or uncertain transmission is investigated before resubmission. Translating these mechanics into a short checklist helps only if the checklist still points users back to the authoritative wording and current transaction data.
How the process works
The operating sequence should move from identification to validation, approval, external submission or notice, and then confirmation. For this topic, the critical mechanics are: Controls can combine unique file identifiers, source-batch status, control totals, file hashes and bank acknowledgements so a failed or uncertain transmission is investigated before resubmission.
Timing should be planned backwards from the required result. Notice periods, value dates, bank cut-offs and internal approval windows can make a technically correct action late, so the process needs enough recovery time to repair data or obtain another consent. For this subject, the file should specifically reconcile source batch ID, file ID, creation timestamp, transaction count, control sum, hash or checksum, transmission response, bank acknowledgement and resubmission reason. Those fields are not interchangeable with a generic approval record because they are the facts that determine whether this particular transaction remains inside the agreed rule.
The data and evidence that matter
At minimum, retain source batch ID, file ID, creation timestamp, transaction count, control sum, hash or checksum, transmission response, bank acknowledgement and resubmission reason. If one of these items is uncertain, the case should remain open rather than being presented as fully resolved.
The record should distinguish internal intention from external outcome. An approved instruction proves what the company wanted to do; a bank acknowledgement, lender consent, statement entry or counterparty confirmation proves what happened outside the company.
Where the process can fail
During a connectivity outage, one operator can resend a file because no acknowledgement is visible while the first transmission is already waiting at the bank. The financial cost of the problem usually increases as the payment, settlement, test date or financing event gets closer.
Fragmented ownership can hide exceptions. Legal, treasury, accounts payable and the bank may each see part of the issue, so one person should own the case until the final external status is known.
Worked example: test the mechanics
A £2.6 million supplier file is sent at 09:14 and the portal times out before showing confirmation. A second user recreates and resubmits the batch at 09:25. If the bank accepts both, every supplier can be paid twice unless duplicate detection stops the second file.
The example is intentionally simplified. In a live case the business should replace every illustrative amount, date and threshold with current source evidence, then repeat the test before treating cash, consent or hedging capacity as available.
Governance and control design
Lock approved batches after first transmission and require evidence of rejection or cancellation before any material file is resent. Where technology supports it, the rule should be enforced in workflow and exceptions should require explicit approval rather than a warning that can be ignored.
Routine review should include resubmitted files, duplicate-detection alerts and uncertain transmissions awaiting bank confirmation. Stable top-line activity can otherwise hide growing concentration, stale exceptions or shrinking liquidity headroom.
Change control matters as much as daily operation. When a bank changes a service, a facility is amended, an entity joins the group or a system is migrated, the company should retest the process from source data through final reconciliation. The management signal for this topic is resubmitted files, duplicate-detection alerts and uncertain transmissions awaiting bank confirmation. That indicator should have an owner and escalation threshold so treasury can intervene while the exposure is still manageable rather than discovering the problem only after the external deadline.
Contingency planning should be proportionate to value and urgency. The team should know the alternate approver, funding route, bank contact or manual fallback before a live duplicate payment file submission issue becomes time-critical.
Documentation should be short enough to use under pressure. A one-page operating checklist can point staff to source batch ID, file ID, creation timestamp, transaction count, control sum, hash or checksum, transmission response, bank acknowledgement and resubmission reason while the fuller policy keeps the legal, technical or scheme background.
Periodic review should compare the documented procedure with what staff actually do. Where practice has drifted, management should either update the policy deliberately or restore the intended control rather than accept an undocumented compromise.
A tested fallback is part of the control. The team should know which pieces of source batch ID, file ID, creation timestamp, transaction count, control sum, hash or checksum, transmission response, bank acknowledgement and resubmission reason are essential to act safely if the preferred system, approver or communication channel is unavailable.
Editorial Verdict
BanksGB's editorial view is that duplicate payment file submission should be managed as a practical cash-and-control issue. A duplicate file submission occurs when the same payment population is transmitted more than once, potentially creating duplicate debits even though each individual file is internally valid. The best process links the rule to the amount, entity, timing and external status rather than relying on shorthand.
The final test is reproducibility. A second person should be able to explain what triggered the action, which evidence was used, who approved it, what the external party did and what remains outstanding. If that chain is not visible, the control is weaker than it appears. The control should also be tested against the article's core failure scenario: During a connectivity outage, one operator can resend a file because no acknowledgement is visible while the first transmission is already waiting at the bank. A practical review should demonstrate how the company would recognise that condition early, stop or redirect the transaction, and preserve evidence of the decision.
Sources
- Swift, ISO 20022 for corporates: https://www.swift.com/standards/iso-20022/iso-20022-faqs/corporates
- NCSC, Business payment fraud: https://www.ncsc.gov.uk/section/respond-recover/business-payment-fraud