Remote Deposit Capture for Business: Workflow and Risk

Map the full check workflow, not only the scanner step

RDC begins when the business receives a check and ends only after the deposit is accepted, reconciled and the original check is disposed of under policy. Document who receives the mail, who prepares the batch, who scans, who approves the deposit and who stores the originals. Separating these steps reduces the chance that one person can remove or redeposit a check without detection.

Use batch control totals. If the mailroom delivers 37 checks totaling $84,215.44, the RDC batch should show the same count and amount before transmission. Keep a deposit log that ties the batch to the accounting entries. When the bank rejects one image, the correction should not cause the other 36 checks to be submitted again. Clear batch identity is the foundation for avoiding duplicate deposit problems.

Set deposit limits from real volume and loss exposure

Banks often establish RDC dollar and item limits based on the customer’s expected activity and risk profile. The company should know daily, rolling and per item limits before relying on RDC for large receipts. A sudden $500,000 check may exceed a service designed for ordinary $20,000 daily deposits, forcing the business to use a branch or another approved method.

Request limit changes before seasonal peaks or acquisitions. Do not wait until the final day of a quarter to discover the portal will not accept the batch. At the same time, avoid excessively high limits without need because limits are a risk control. Review who can deposit within the limit and whether approval is required above a threshold. The bank may also monitor volume that materially differs from the activity described during onboarding.

Prevent duplicate presentment with restrictive handling

The same physical check should never be deposited through two channels. After scanning, mark or endorse the check according to the bank’s instructions and move it immediately into controlled storage. Do not return scanned checks to a general accounts receivable inbox where another employee may later take them to a branch. The FDIC has long identified duplicate presentment and inadequate customer controls as important RDC risks.

Use system reports to detect duplicates by routing number, account number, check number and amount when the bank provides that capability. Internal reconciliation also matters because a fraudster can alter information or intentionally submit a second image. If a customer later asks for the original check back, the retention procedure should ensure staff know its status and do not accidentally create a second negotiable item.

Control devices, users and deposit locations

RDC workstations and scanners should be treated as payment equipment. Restrict access to authorized employees, keep software current and avoid using shared administrator credentials. If mobile deposit is used for business checks, apply the same principles to the device and user account. A lost phone with active banking access or a shared scanner workstation can create an account security problem beyond the specific deposit.

Review user rights when employees change roles or leave. Limit who can add a new scanner or change deposit settings. If the bank supports dual control for large batches, use it where the value justifies the extra step. Also consider physical location. A scanner in an unlocked reception area has a different risk profile from one in a controlled finance office. Security should match the value and volume of the checks being processed.

Create a documented retention and destruction policy

After image capture, the paper check remains sensitive because it may contain account information and can potentially be presented again. Follow the bank agreement for the required retention period and endorsement method. Store originals securely during that period, organized so a specific check can be located if the bank requests it. Do not mix retained scanned checks with unprocessed incoming checks.

At the end of the retention period, destroy the check in a way that prevents reconstruction or reuse. Record the destruction process for higher volume operations. The policy should balance two risks: destroying too early can leave the company unable to resolve an image or legal question, while keeping checks indefinitely increases exposure. The bank agreement and legal counsel can help determine the appropriate schedule for the company’s circumstances.

Reconcile deposits and exceptions every business day

RDC accelerates deposit only if accounting can confirm that each batch reached the bank and posted correctly. Compare scanner totals with bank deposit confirmations and accounts receivable entries. Investigate rejected images, amount corrections and delayed availability. A batch marked transmitted on the workstation is not the same as a deposit accepted by the bank.

Track recurring exception causes. If the same customer’s checks repeatedly fail image quality, the company can request a different payment method. If one office generates repeated duplicate alerts, retrain that team and review physical controls. Measure RDC by deposit speed, exception rate and manual time saved. A disciplined reconciliation process turns remote capture from a convenience feature into a reliable treasury service.

For high value batches, have a second employee compare the accepted deposit total with the accounting batch before originals are moved into retention storage. That final control catches both scanning errors and missing items while the paperwork is still easy to trace.

Editorial Verdict

Sources

• FDIC remote deposit capture risk guidance
• OCC Payment Systems handbook

Primary, regulatory and payment network sources were checked for this update. Bank specific terms can change after publication.