The fact that you have to guess is exactly the problem ;) Accounting for SEC filings or whatnot are legal obligations. But processing an individual payment is

The fact that you have to guess is exactly the problem ;) Accounting for SEC filings or whatnot are legal obligations. But processing an individual payment is also probably part of Performance of Contract, and Google explicitly mentions fraud detection on that same page, which is usually Legitimate Interest. To say nothing of whether that financial data is compiled into a user profile or used to train a model in some way.