Six Steps to Audit Ready Co-op Payee Verification for U.S. Brokerages

Brokerage staff verifying co-op payee details

Do not release a co-op or referral commission until you have verified the payee’s identity, confirmed their authority to receive that specific payment, and documented the services behind it. This single hold protects a brokerage against two distinct exposures: a RESPA Section 8 violation and a business email compromise wire-fraud loss. One platform is built to enforce that hold automatically.

TL;DR:

  • Verifying the payee’s identity, authority, and documented service before releasing a co-op payment prevents RESPA violations and wire-fraud losses.
  • Out-of-band confirmation through a trusted phone call significantly reduces the risk of payment redirection in wire fraud schemes.
  • Maintaining a single organized transaction folder with signed agreements, service proof, approval logs, and call records ensures auditability and compliance.
  • Avoid paying through informal apps like Venmo or Zelle, which lack proper documentation and increase regulatory and fraud exposure.
  • Implementing automated controls and approval workflows reduces human error and enforces adherence to verification steps during disbursements.
Brokerpay
brokerpay.io
Make Co-op Payments Audit Ready
BrokerPay tracks, documents, and processes agent splits, referral fees, and co-op commissions for compliant real estate brokerage payments.
Visit BrokerPay

Table of Contents

Why verification matters: RESPA, fraud, and audit risk

RESPA Section 8 bars kickbacks and unearned fees in real estate settlement services, and payments must correspond to services actually performed. Violations can carry civil and criminal penalties, which turns a sloppy commission split into a liability question, not just a bookkeeping one. CFPB and HUD guidance specifically flags marketing services agreements and similar arrangements as vehicles that often disguise referral payments, so a brokerage has to show the fee tracked to a distinct, documented service.

Fraud is the second front. The FBI’s reporting on business email compromise and real-estate wire fraud describes attackers redirecting payment instructions by compromising or spoofing an email thread between parties expecting a transfer. A co-op commission sent on the strength of an email alone is exposed to exactly that tactic.

Informal payment apps compound both risks. Venmo and Zelle transfers carry no agreement, no service record, and no approval trail, which leaves a brokerage with nothing to show an auditor or a regulator. Evidence that actually holds up includes:

Statistic: the FBI’s BEC and real-estate wire fraud report names out-of-band verification, confirming instructions through a separate, trusted channel, as a core recommended defense against payment redirection.

Step-by-step verification checklist before you send a co-op payment

A defensible payment follows the same order every time: identity, authority, service, funds, approval, and record. Treat each step as a gate, not a formality.

  1. Confirm identity. Verify the receiving broker’s or agent’s license status, business entity name, and TIN, and save a copy of that documentation in the transaction file.
  2. Confirm authority to receive. Locate the written broker-to-broker agreement or the commission split documented in the transaction, and check that the payee named matches the party entitled to the fee.
  3. Confirm the service behind the split. Look for the work product that justifies the payment: MLS entries, showing records, attendance at closing, or a referral note tying the fee to an actual introduction.
  4. Confirm financial details out-of-band. Call a phone number already on file, not one pulled from the same email thread requesting payment, and verify the bank or wire instructions directly. Never treat bank details received only by email as reliable, a guidance point the FBI repeats in its Tech Tuesday advisory on real estate fraud.
  5. Route the payment through an approval gate. Require at least one finance or compliance approver to sign off on any disbursement above a set threshold, with that approval time-stamped.
  6. Retain everything in one place. Save the agreement, the call log, the approval record, and any related communications in a single transaction audit folder rather than scattered email threads.

Pro Tip: Keep a short, pre-verified contact list of co-op brokers’ phone numbers on file so step four never depends on a number supplied in the same message that asks for money.

This order matters because each gate closes a different hole. Identity and authority checks address the RESPA question of whether the payee is even entitled to the fee. The service check addresses whether the fee is earned rather than a disguised referral. The out-of-band confirmation and approval gate address fraud, specifically the scenario where legitimate parties and a legitimate deal get hijacked by a last-minute instruction change. Skipping any single step leaves a gap that either a regulator or a fraudster can exploit. A brokerage that wants a closer look at how this plays out in practice can review sample verification workflows built around these same checkpoints.

Operational controls and recordkeeping that make a payment defensible

A checklist only works if a policy forces people to use it. The strongest brokerage policies spell out who approves payments, at what dollar threshold a second approver is required, what documents must exist before a payment clears, how long records are retained, and how often the process gets reviewed.

A practical approval workflow looks like this: an operations or compliance lead checks the agreement and service documentation, a finance lead confirms the out-of-band call was made and logged, and the payment clears only after both sign off with a timestamp attached to the record. Version control on the agreement and a dated approval log turn a one-off judgment call into something a third party can reconstruct months later.

Acceptable proof generally includes:

Clean payee identification also feeds directly into tax reporting. Collecting a correct legal name and TIN at verification time, rather than scrambling at year-end, keeps 1099 reporting accurate and avoids mismatched filings.

The same controls double as fraud detection. A payee whose name doesn’t match the agreement, an account number that changed days before closing, or a request to route funds to an account outside the usual pattern are all red flags worth escalating before funds move. FinCEN’s guidance on real estate transactions supports voluntary suspicious activity reporting with safe-harbor protection for businesses that flag concerns, and that path should be documented the same way a payment approval is: who raised it, what they saw, and what decision followed.

What brokerages consistently get wrong on co-op payments

The most common mistake is paying on the strength of an email alone, followed closely by letting agents settle splits through personal payment apps that leave no record of why money moved. A close third is approving a payment without ever confirming what service justified it.

The single fastest fix: require a phone call to a stored, pre-verified number and a named approver before any co-op release, no exceptions for familiar names or repeat counterparties. That one rule closes the gap that both regulators and fraudsters exploit most often.

— Wes

How BrokerPay enforces verification and auditability

Manual verification works until someone skips a step under deadline pressure, which is exactly when a RESPA gap or a wire-fraud loss happens. The platform turns the checklist into something the system requires rather than something a person remembers to do.

Brokerpay

The platform is designed to keep stored payee records on file, require out-of-band verification before payment release, route disbursements through an approval workflow, and maintain a full audit trail. It also aims to keep records organized for cap tracking and 1099 reporting, consolidating payee identity and documentation in one place.

BrokerPay replaces Venmo and Zelle workarounds with a workflow brokerages can point to in an audit. Visit Brokerpay to see plan details or request a demo.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

How BrokerPay enforces verification and auditability — overview diagram

FAQ

What is co-op payee verification in real estate?

Co-op payee verification is the process of confirming the correct broker or agent, their authority to receive a specific commission, and documentation of the service behind it before a brokerage sends a co-op or referral payment. It protects against both RESPA compliance gaps and payment redirection fraud.

Why does RESPA matter for co-op commission payments?

RESPA Section 8 prohibits kickbacks and fees for services not actually performed, and the CFPB’s regulation requires that cooperative brokerage payments correspond to real services. A payment without documentation of the service behind it is difficult to defend if questioned.

How does out-of-band verification prevent wire fraud?

Out-of-band verification means confirming payment instructions through a channel separate from the one that delivered them, typically a phone call to a number already on file. The FBI recommends this step specifically because email threads are a common target for business email compromise schemes that redirect real estate payments.

What records should a brokerage keep for every co-op payment?

A defensible file includes the signed broker-to-broker agreement, documentation of the service performed, a log of the out-of-band confirmation call, a timestamped approval record, and the final disbursement record. Keeping these in one transaction folder rather than scattered emails makes the payment easy to reconstruct later.

When should a brokerage escalate a suspicious payment request?

Escalate when payee details don’t match the agreement on file, when bank instructions change close to disbursement, or when a request arrives only by email with no prior contact. FinCEN’s guidance supports documenting the concern and, where warranted, filing a suspicious activity report with safe-harbor protection for the reporting business.

Sources