Financial services firms are well known for vetting their payments providers hard. Uptime, security, controls, regulatory standing, how long records are kept and in what form, all of it gets assessed before anyone signs.
However, the tooling that handles internal spend rarely gets the same treatment. Cards, expenses and reimbursements are often chosen on convenience, even though some of what they record (gifts, entertainment and hospitality in particular) is exactly what the regulator can ask to see.
In a regulated firm, a payment can also be a record you have to defend. The FCA's inducement rules require a firm to keep a record of the benefits it gives to and receives from other firms for at least five years, and SYSC 9 requires orderly records of the firm's business, sufficient for the FCA to check that it has met its obligations. When the FCA reviewed 23 firms' inducement arrangements, one of its findings was that hospitality logs "did not always record relevant detail or were not well maintained" (FCA).
Your payments infrastructure is built to answer questions like that, but is your spend tooling able to do the same?
Where spend tooling quietly falls short
The gap is rarely in the big, obvious payments. Instead it tends to sit in the long tail of smaller spend: employee expenses, card purchases, reimbursements and the like. When that spend runs through weak tooling, or worse, through personal cards and manual claims, the record gets assembled after the fact. This can mean that metadata is inconsistent or missing completely, the approval trail lives in email if it exists at all, and turning it into something audit-ready takes real work. In most businesses that's an inefficiency that can be worked on. But in a regulated firm, where some of that spend is the hospitality and gifts the regulator can ask to see, it's a genuine compliance risk.
What 'the same scrutiny' actually means
Applying the same standard to spend tooling as to a payments provider comes down to five questions. They are the questions a due diligence questionnaire would ask of a payments provider, translated to the tooling your own staff spend through.
1. Does it enforce the required data before the record is final?
Mandatory fields captured at the point of spend rather than chased afterwards, so nothing reaches the ledger missing its context.
2. Is approval built in and logged?
A recorded approval workflow rather than an email thread, so you can show who signed off what and when.
3. Are the records structured and audit-ready?
Clean, exportable records you can produce on request, rather than a reconstruction job.
4. Can it be configured to your obligations?
The specific fields your regime requires should map onto the tool's mandatory fields; you shouldn't have to bend what you record to the tool's defaults.
5. How long are records kept, and in what form can you get them out?
A five-year retention period can outlast a subscription, a supplier or an employee, so you need to know whether records stay accessible after an employee leaves or a subscription ends, and whether they export in a form your own archive and your auditor can use.
A tool that fails the first three produces records you will rebuild by hand. A tool that fails the last two produces records you cannot rely on when the question comes.
Where Moss fits
Moss is built to meet the standards financial services firms expect of their payments providers. In the UK, payment and e-money services are delivered through FCA-authorised partners, and the platform itself is ISO/IEC 27001:2022 certified and hosts data in the EU (Moss security), the evidence your own third-party review will ask a supplier for.
Mandatory fields and approval are enforced at each step of the workflow across Cards, Reimbursements and Accounts Payable, and a transaction cannot move to the next step, including approval and export, until the required fields are filled. For a reimbursement or a supplier invoice that is before any money leaves; for a card transaction it is before the record is approved and exported.
Moss also exports records in a structured form to your accounting system, by API for Xero, QuickBooks Online, NetSuite and Business Central and by CSV for Sage and others, so the evidence exists by default rather than being assembled later. Those records are yours to archive for as long as your retention policy requires.
Moss's mandatory fields, part of the Advanced Accounting add-on, cover cost centre, cost carrier, supplier and custom fields, so the information your gifts and hospitality register needs can be made a condition of every transaction. One limit to know about: a field is mandatory for every transaction or for none, so you cannot make one mandatory for hospitality spend alone. Whether the fields cover everything your register has to show is worth confirming with your compliance team before the tool goes live.
Hold it to the same standard
While your spend tooling doesn't have to be as heavy as your core payments stack, some of the records it produces live under the same rules. As a result it deserves the same questions before you choose it. In a regulated firm, ease of rollout is a weak reason on its own to pick a tool. Whether it captures what you would need to defend a payment is the better test.
If you want to put Moss through that test, the Moss security page and Trust Center set out the certifications, controls and data handling behind the platform, and the team can walk your compliance function through how mandatory fields and approvals map onto your own record-keeping obligations.
