Changes to OWASP's Accounting Services


Andrew van der Stock

Friday, October 27, 2023

Many leaders may have already had an inkling that something was up with OWASP’s accounting services. We’ve been working on a solution for some time, and we’re pleased to announce that we’ve found a new accounting firm to work with.

What’s changed?

As of August 31, 2023, OWASP has changed from our long standing outsourced accounting partner, Virtual Inc, to our new outsourced accounting partner, the Charity CFO. Additionally, we had to change banks in the process, and our address.

Why did we change?

From time to time, we need to review our service providers to ensure that we’re getting the best value for money. We’ve been working with Virtual Inc for many years, and they’ve been a great partner. However, we had some disagreements regarding management controls in a revised consolidated contract. We were unable to resolve these issues, and so we went to market to find a new partner.

What’s the impact?

For most leaders, not much. Submit valid expense claims to Jira, and you will still get paid by OWASP within 30 days of submitting a ticket.

If you need our new address, it will be on our website under About Menu -> Contact Us.

Additionally, OWASP vzw - the OWASP European entity - will be changing, but as this is all but dormant, leaders will not need to do anything. Once we have our new Netherlands entity setup, we will again change the address details on our website. It’s extremely unlikely that we will transact through the EU entity as it’s so difficult to do, but that might change in the future. But for now, just like the last ten years, you’re extremely unlikely to be paid by the EU entity.

ACH transfers

For US-based ACH transfers, you will get messages from a service called We will need your routing number, account number, as well as receipts for the expense claims you are making.

International Wires

For international wires, we are still trying to work out how to go back to our existing money transfer solution, but in the meantime, we will be using either, or our new bank’s international wire service. The new bank is very insistent on:

  • The full name of the recipient
  • The full address of the recipient
  • IBAN / Swift account numbers
  • The full bank name
  • A BIC code, which gives us the full address of your bank
  • The currency you want to be paid in
  • and receipts for the amount you want to be paid

If any of this is missing, you will need to resubmit your ticket with the missing information. You may get emails on your tickets if any of this information is missing.

The downside of our new arrangement is your bank will often add a fee that we do not control and we cannot determine the amount before the transaction goes through. We’ve had fees as high as 30 euros, which means if you claim less than 30 euros, you might even owe your bank and get nothing back. ☹ This is not a good state of affairs. Many banks do not charge fees, or far less in fees, so we can’t simply add 30 euros (or whatever) to the amount. We are working on a solution to this problem, but in the meantime, we will be paying you in the currency you request, and you will need to pay any fees your bank charges.

Am I being phished?

This is a valid concern, and one that I share with our leaders. Please submit tickets through Jira (not email!), and expect to see emails from Jira and You might get emails from our new bank, Chase. We will never ask you to click on a link in an email. If you’re not sure, please ask us in the ticket, and we’ll help you out.