This bill imposes new, mandatory pre-payment verification duties on federal agencies, amends the disbursing and certifying official rules in title 31, and formalizes an expanded Do Not Pay system administered by Treasury’s Fiscal Service. It requires agencies to complete specified pre-certification checks before certifying vouchers and authorizes Treasury to return or pause payments that fail those checks.
Separately, the bill grants Treasury explicit access to data assets long used for program integrity—most notably the National Directory of New Hires, selected IRS return information under a privacy-preserving disclosure hook, and a Social Security Administration confirmation service—and requires a new one-time post-award report for entities receiving a covered federal award for the first time (threshold: $50,000 in FY2027 dollars). The package shifts anti-fraud activity frontward in the payment lifecycle, creates reporting obligations for award recipients, and layers rulemaking and privacy safeguards (and criminal penalties for unlawful disclosure).
At a Glance
What It Does
The bill amends title 31 to require agencies to satisfy pre-certification checks (fund availability, correct payee identifiers, account validation, deceased-payee screening, and other Treasury-specified verifications) before certifying vouchers and permits Treasury to return or pause noncompliant payment vouchers. It expands the Do Not Pay system’s data assets and authorizes Treasury to access NDNH, specified IRS return data through a limited redisclosure mechanism, and SSA confirmation services.
Who It Affects
Federal disbursing and certifying officials, agency program and grants offices, Treasury Fiscal Service, the IRS and SSA (as data providers), first-time recipients of covered federal awards (including pass-through entities and subrecipients), and State/local governments administering federally funded programs.
Why It Matters
By moving fraud and improper-payment controls to the pre-payment stage and centralizing data with Treasury, the bill could materially reduce downstream recoveries and losses—but it also creates new operational, privacy, and compliance burdens for agencies and recipients, and relies on novel statutory data access pathways for traditionally confidential data.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The bill inserts a new statutory pre-certification duty (new 31 U.S.C. §3325a) that bars an agency official from certifying a voucher until a set of pre-payment checks are completed. Those checks are partly listed in statute (funds availability, correct payee and amount formatting, valid taxpayer or payee identifiers, deceased-payee screening, and bank-account validation) and partly left to Treasury rulemaking.
Treasury must publish rules and guidance on required pre-certification data, timeframes for supplying verification records to Treasury, and a process for agencies to seek documented exemptions when statutory, policy, or operational reasons make checks impracticable.
The bill also updates existing certification and disbursing responsibilities (amending 31 U.S.C. §§3325 and 3528) to require certifying officials to confirm agency compliance with the new pre-cert requirements and to allow disbursing officials to return or pause payments that fail the checks (including compliance with a pause order defined in related statutes). Agencies must incorporate fraud-risk indicators into improper-payment risk assessments, and Treasury will issue Do Not Pay guidance treating certain data comparisons as not being “matching programs” for Privacy Act purposes.On the data side, the Do Not Pay system (31 U.S.C. §3354) becomes the statutory vehicle for Treasury-run screening.
The bill explicitly authorizes inclusion of the National Directory of New Hires, a privacy-preserving channel to certain IRS return fields via a new 6103(i)(9) mechanism, and a Social Security confirmation service created under a new SSA provision. Treasury may designate additional data asset categories after coordination with OMB and public notice; it may also add non-sensitive datasets at its discretion with public disclosure.
Access extends to State and local grantees, contractors acting on their behalf, and the judicial and legislative branches for payment verification purposes. The statute limits Do Not Pay use to improper-payment prevention and law enforcement, sets criminal penalties for unlawful disclosure ($5,000 fine and/or up to 5 years’ imprisonment), and requires an annual report to Congress on Do Not Pay operations.Finally, chapter 61 gains a new section requiring a one-time post-award report from any entity that receives a covered award for the first time in a program’s life.
Covered awards are those at or above $50,000 (FY2027 constant dollars); recipients must submit the report within 180 days of award receipt, subject to narrow deadline exceptions. Agencies must withhold further disbursements and decline to issue payment vouchers to noncompliant recipients until the report is filed.
Reports are retained for 5 years and made available to relevant oversight and law-enforcement actors. The act becomes effective 180 days after enactment, giving Treasury and agencies a compressed window for rulemaking, system changes, and interagency agreements.
The Five Things You Need to Know
The bill creates new 31 U.S.C. §3325a: agencies cannot certify a voucher until specified pre-certification checks (funds available, correct payee identifiers, deceased-payee screening, account validation, and Treasury-specified identifiers) are satisfied.
Treasury’s Do Not Pay program (31 U.S.C. §3354) must include the National Directory of New Hires and may receive specified IRS return fields under a new Internal Revenue Code 6103(i)(9) disclosure, plus an SSA confirmation service under a new SSA section 235.
The act requires first-time recipients of a covered federal award (≥ $50,000, FY2027 dollars) to submit a one-time post-award report within 180 days; agencies must stop further disbursements to recipients that fail to submit the report.
The bill directs Treasury to publish regulations and guidance on pre-certification within 180 days of enactment, and it authorizes Treasury to return or pause payment vouchers that fail pre-certification requirements.
Unlawful disclosure of Do Not Pay data is criminalized in statute: a knowing, willful disclosure carries up to a $5,000 fine, up to 5 years in prison, or both.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Mandatory pre-certification before voucher certification
This provision inserts a new statutory bar on certifying officials: they may not certify vouchers until pre-certification requirements are met. The statute lists specific checks (funds availability, correct amount and payee formatting, valid tax/payee identifiers, deceased-payee screening, account validation) and gives Treasury authority to define additional identifiers and formats. It also requires Treasury to issue regulations and guidance on timing—essential for agencies to collect and transmit verification records to disbursing officials before payment.
Expanded duties for certifying and disbursing officials
The bill amends duties of certifying officials to explicitly require ensuring agency compliance with §3325a and to confirm recipient reporting under new 31 U.S.C. §6107. It also augments §3325 to require practical bank-account verification and record comparisons before disbursing, and clarifies that disbursing officials may consider compliance with Treasury pause orders and return vouchers that fail pre-certification.
Fraud-risk indicators in improper payment risk assessments
The bill expands definitions and requires agencies to design and apply fraud-risk indicators—objective signals such as anomalous payment volumes, verified data mismatches, or Do Not Pay matches—to programs subject to improper-payment reviews. That change pushes agencies to bake analytical signals into risk assessments rather than treating such indicators as an afterthought.
Do Not Pay system: broader data access, state use, and privacy rules
Treasury’s Do Not Pay becomes a statutory system to be operated by Fiscal Service. The statute names particular data assets to be included and establishes a process for Treasury to designate further categories (with OMB coordination and public notice). It authorizes State/local grantees, contractors, and the legislative and judicial branches to use Do Not Pay for verification, imposes Privacy Act–consistent safeguards, prohibits secondary uses, and creates criminal penalties for unauthorized disclosure. It also requires an annual effectiveness report to Congress.
One-time post-award report for first-time recipients of covered awards
This new provision mandates a single report from entities receiving a covered award for the first time in a program’s history (covered award = ≥ $50,000 based on FY2027 dollars). Agencies must set standardized content and format via governmentwide regulation, place a reporting requirement into award terms and Notices of Funding Opportunity, and withhold further payments until the report is filed. Reports must be retained for 5 years and shared with OMB, Treasury, DOJ, IGs, and appropriate congressional committees.
Statutory data access pathways for Do Not Pay
The bill amends SSA and IRC confidentiality provisions to authorize limited, mission-limited disclosures to Treasury (and Do Not Pay users). It adds SSA confirmation authority for name/SSN checks as a paid service and creates an IRS disclosure mechanism (6103(i)(9)) for a constrained set of return fields under intra-agency agreements and strict redisclosure limits. The agreements must limit use to improper-payment identification, prevention, and recovery.
Effective date and transition
The act takes effect 180 days after enactment. Transition rules allow the existing Do Not Pay initiative to continue as needed; existing guidance remains until updated by Treasury or OMB. The compressed window means Treasury and agencies must rapidly finalize rulemaking, data-sharing agreements, and system changes before the effective date.
This bill is one of many.
Codify tracks hundreds of bills on Finance across all five countries.
Explore Finance in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Treasury Fiscal Service: Gains centralized access to multiple federal data assets and statutory authority to run governmentwide pre-payment screening, which should increase detection of suspect payments before disbursement and reduce the scale of downstream recoveries.
- Federal program managers and grant officers: Get clearer, governmentwide standards (and data tools) for pre-payment verification and fraud-risk indicators, enabling more consistent upfront controls across agencies and programs.
- State and local governments (as grantees) and auditors: Obtain statutory access to Do Not Pay data for eligibility screening of federally funded programs, which can reduce risk of improper payments at the subaward level.
- Inspectors General and law enforcement: Receive structured reporting and retention of first-time recipient post-award reports and broader Do Not Pay matches, delivering richer leads for investigations and potential criminal or civil actions.
- Taxpayers and program beneficiaries: Potentially benefit indirectly from lower improper payments and reduced taxpayer losses if front-end checks prevent large-scale fraudulent disbursements.
Who Bears the Cost
- Federal agencies and program offices: Must implement new pre-certification workflows, update IT systems, train certifying/disbursing officials, and run additional verifications—costs that are not explicitly funded in the bill.
- First-time award recipients and pass-through entities: Face a new one-time reporting obligation (180-day deadline) and must collect/subaggregate subrecipient data, increasing administrative burden for award acceptance and ongoing compliance.
- Treasury, IRS, and SSA operations: Must establish or expand secure data-sharing interfaces, privacy-preserving validation services, and SLAs; SSA and IRS incur processing and systems costs (though Treasury must pay SSA for confirmation services).
- Financial institutions and payment processors: May be asked to respond to increased account-validation queries and reconcile more frequent pre-payment checks, which might require new interfaces and compliance procedures.
- Individuals and privacy stakeholders: Bear the risk of increased exposure of personally identifiable information across a broader set of users (State/local staff, contractors), and face the consequences of erroneous matches (payment delays, additional scrutiny).
Key Issues
The Core Tension
The central dilemma: reduce taxpayer losses by stopping fraud before payment versus protect individual privacy, due process, and program access; aggressive front-end screening and broad data sharing help prevent improper disbursements but increase the risk of false positives, payment delays, and privacy incursions—trade-offs that require tight technical safeguards and resourced agency implementation to manage.
The bill creates clear operational momentum toward stopping improper payments before funds leave the Treasury, but it raises immediate implementation and legal questions. First, the privacy carve-outs and new 6103(i)(9) disclosure for IRS data—while explicitly limited and routed through intra-agency agreements—depend on careful technical controls (minimization, access logging, purpose-limiting redisclosure rules) and robust oversight to prevent mission creep.
The statute criminalizes improper disclosure, but criminal penalties do not substitute for operational safeguards or real-time redress for harmed individuals whose payments are delayed by false positives.
Second, the bill treats some automated data comparisons “not” as matching programs for Privacy Act purposes, which changes administrative obligations such as notice and appeal mechanisms; that recharacterization may limit individual rights to contest erroneous matches unless Treasury and agencies layer separate notice and remediation processes into guidance. Third, the act places a heavy, largely unfunded administrative lift on agencies and recipients: agencies must change 31 U.S.C. and grants processes, stand up new checks, and pause payments where necessary, while recipients must meet a new reporting obligation.
Without targeted appropriations or transition resources, smaller agencies and nonprofit recipients may see delayed payments or get squeezed by compliance costs.
Finally, the balance between aggressive front-end screening and program integrity hinges on match accuracy and error rates. False matches will delay legitimate payments and could create reputational and legal exposure for agencies; conversely, setting thresholds too permissive will blunt the preventive effect.
The statute sets up rulemaking, public notice for data-designation, and Congressional reporting—these are necessary but leave substantial discretion to Treasury and OMB, so much of the program’s actual contours will be in implementing guidance rather than the statute itself.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.