Treasury Hygiene in Under an Hour

Earn Yield on Cash

ACTION 01 · TIME · 15 minutes

What it is

Move idle cash out of a near-zero-yielding business checking account and into a Treasury bills sweep, money market fund, or insured cash sweep program that pays a market yield while preserving same-day liquidity for operating cash.

Why it matters

Treasury bills, money market funds, and cash sweep products yield in the 3.5–3.9% range as of April 2026 (per FDIC and Bankrate). Meanwhile, the median yield on a business checking account is closer to 0.05%. That spread — about 3.5 percentage points — is real money on any balance above $500,000.

A Series A company with $4M in the bank is leaving roughly $138,000 on the table every year — over a 24-month runway, that's $276,000.

How to do it

1. Decide what's “idle” vs. “operating” cash. Your operating account should hold roughly two months of net burn — the cash you'll actually spend on payroll, vendors, and AWS over the next 60 days. Everything above that is idle and should earn yield.

2. Open a Treasury or money market account. Most modern startup banks (Mercury, Brex, Arc) offer this as a single click. Otherwise: Vanguard Cash Plus, Fidelity Cash Management, or a brokerage T-bills ladder. For most SaaS companies under $20M cash, a combination — operating cash in checking, near-term reserves in money market, longer reserves in T-bills — gives the best yield/liquidity tradeoff.

3. Set up an automated sweep from operating to yield. Define a target balance for the operating account — anything above moves to yield weekly; anything below pulls back to operating.

Done State

You can answer this in a board meeting: “Of our $X million in cash, $Y is in operating accounts and $Z is in yield-bearing accounts at a blended rate of W%.”

Enable Two-Factor Authentication

ACTION 02 · TIME · 5 minutes

What it is

Turn on multi-factor authentication on every account that has wire or ACH authority — the primary bank login, secondary banks if you have them, your treasury platform, and any service that can move money.

Why it matters

This is the single highest-leverage fraud prevention action available. According to the 2025 AFP Payments Fraud Survey, 79% of organizations experienced attempted or actual payments fraud in 2024. The vast majority of successful attacks start with credential theft — phishing emails that capture a username and password, then log into the banking platform from an unfamiliar IP. A password alone stops nothing. A password plus a second factor stops nearly everything. The math is asymmetric: five minutes of setup eliminates the most common attack vector in business banking.

How to do it

1. Log in to your business banking portal.

2. Navigate to security settings. Most banks bury this — look for “Security,” “Login Settings,” “Account Security,” or “Multi-factor Authentication.”

3. Enable an authenticator app, not SMS. Google Authenticator, Authy, or 1Password's TOTP feature. SMS-based 2FA is materially less secure than app-based — SIM-swap attacks are well-documented and have been used to drain corporate accounts.

4. Repeat for every signer. Every person with login credentials needs their own 2FA enabled. Shared logins are not acceptable for a company with material cash.

5. Print or save backup codes. Store them somewhere outside your email — a password manager, a physical safe, or a sealed envelope with your accountant.

Done State

Every signer on every bank account uses an authenticator app to log in. Nobody on the team has a “just SMS code” or “just password” login still active.

Require Dual Approval on Wires

ACTION 03 · TIME · 10 minutes

What it is

Configure your bank to require two separate human approvals before any wire transfer above a defined threshold can be sent.

Why it matters

The 2025 AFP Payments Fraud Survey found that the average attempted BEC wire request in early 2025 was $24,586 — small enough to feel routine, large enough to hurt. The most common attack pattern: a fraudulent email impersonating a vendor or executive instructs a single signer to wire funds to a “new” account. Single-approval setups process these without friction. Dual approval breaks the attack — the first approver sees the request, the second approver sees it independently, and any inconsistency between the email and the actual wire details surfaces in the gap. According to FedPayments BEC analysis, dual-approval workflows are the most-cited defense recommended by treasury professionals.

How to do it

1. Set a threshold. A common pattern: any wire above $5,000 requires dual approval; wires below run on single approval. Some founders set it at $1,000 to capture even small attempts. Some set it at $25,000 because most legitimate vendor payments are below that. The right threshold depends on your typical wire activity.

2. Identify two signers. Usually the founder/CEO and a CFO/controller, or co-founders. The two approvers should not have access to each other's email — that defeats the purpose if one of them gets compromised.

3. Configure in the banking portal. Look for “Approvals,” “User Permissions,” or “Wire Settings.” Most modern startup banks have a dual-approval toggle; some require a phone call to enable it.

4. Test it. Send a test wire of $5,001 (or just above your threshold) to a verified internal account. Confirm both approvers receive the request. Confirm the wire only sends after both approve.

5. Document the policy. A short internal note: “All wires above $X require approval from [name] and [name]. New vendor payment instructions require a verbal callback to a known number before approval.” The verbal callback is the cherry on top — it stops vendor-impersonation BEC even when the email looks perfect.

Done State

You cannot single-handedly send a wire above your threshold. Try it. If you can, it's not configured.

Set ACH Whitelist and Review Cadence

ACTION 04 · TIME · 15 minutes

What it is

Restrict which vendors are allowed to debit your bank account via ACH (the “pull” mechanism most subscription billing uses), and establish a quarterly review of that whitelist.

Why it matters

ACH debits are quieter than wires. Wires require active sending — somebody initiates a transfer. ACH debits are pulled by the receiver, often automatically, often on a recurring basis. Most companies have dozens of recurring ACH debits running through their account: AWS, payroll provider, software vendors, lease payments, insurance. Two things go wrong: (1) Old vendors keep pulling after you've stopped using them. A SaaS subscription you canceled last year keeps debiting because the cancellation didn't propagate. The amount is small enough nobody notices. Multiplied across 12+ months and 5+ stale vendors, this is real money. (2) Unauthorized vendors get pulled in. A fraudster with your account and routing numbers can attempt ACH debits. Without a whitelist, the bank processes them. Without a review cadence, you don't notice until reconciliation.

How to do it

1. Pull a list of all ACH debits over the last 6 months. Most bank portals export this directly. Note: this should match the AP categories in your bookkeeping. If it doesn't, that's a separate flag.

2. Categorize each as Active, Stale, or Unknown. Active: current vendor, current contract, current usage. Stale: vendor you no longer use. Unknown: you don't recognize this vendor at all.

3. Cancel or block the Stale vendors. Most banks let you place an ACH block on a specific originator (the vendor's ACH ID). Otherwise, contact the vendor directly and confirm cancellation in writing.

4. Investigate the Unknowns immediately. An unknown ACH debit is either a vendor someone else on the team set up (verify with that person) or fraud (notify the bank).

5. Set up a quarterly review cadence. Calendar invite, recurring, owned by whoever runs accounts payable. Fifteen minutes every quarter to refresh the whitelist.

6. Enable ACH positive pay if your bank offers it. Positive pay automatically blocks any ACH debit that isn't on a pre-approved list. Most major business banks offer this for an annual fee — usually $50–500. For any company with material cash, the fee is worth it.

Done State

You can answer: “These are the 12 vendors authorized to ACH debit our account. We review the list every March, June, September, December. Anything else gets blocked.”

Build a Credit Card Program

ACTION 05 · TIME · 15 minutes

What it is

Move company spending onto a corporate credit card with cash-back rewards, expense management built in, and per-employee card controls — instead of running it through debit cards, personal cards with reimbursement, or the bank's default checking-linked card.

Why it matters

Three things compound here. Yield. Modern corporate cards (Brex, Ramp, Mercury IO, Capital One Spark) offer 1.5–3% cash back on most spending categories, with some categories paying 4–8%. A company spending $500K/year on the card is leaving $7,500–$15,000 on the table annually if the card pays nothing. Float. Credit card spending floats interest-free for ~30 days. That's not life-changing on small balances, but on a company spending $50K/month it's a permanent ~$50K of working capital improvement. Visibility and controls. Modern cards integrate with your accounting system, categorize spending automatically, and allow per-employee limits. The alternative — debit-card or personal-card spend with manual reimbursement — leaks bookkeeping accuracy at every step.

How to do it

1. Choose a provider. For most early-stage SaaS companies, the choice is between Brex, Ramp, Mercury IO, and Capital One Spark. The differences are meaningful but not enormous; pick based on (a) integration with your accounting platform, (b) rewards profile that matches your spending, (c) team controls you actually need.

2. Move 80% of company spend onto the card. Software subscriptions, travel, marketing spend, contractor payments where the contractor takes cards. Recurring vendors that take card on file should be migrated. Wires and large vendor invoices stay on the bank.

3. Issue per-employee cards with limits. Each team member with spending authority gets their own card with a monthly cap and category restrictions. This eliminates the “let me put it on my personal card and expense it” workflow that breaks bookkeeping.

4. Connect the card to your accounting platform. Most modern cards push transactions directly to QuickBooks, Xero, or NetSuite with vendor categorization. Set up the integration on day one — don't let three months of uncategorized transactions pile up.

5. Pay the card from the operating account, automatically, in full, every month. Carrying a balance on a corporate card defeats the float advantage and signals operational sloppiness.

Done State

Three months from now, your accountant can pull a single export from the card platform and see categorized company spending — by employee, by vendor, by category — with no manual reconciliation. And the cash-back rewards line on your P&L is non-zero.