Using HMAC SHA256 to protect payment files in local trusted network
With regards to the algorithm, HMAC-SHA256 is considered very secure. As with most symmetric algorithms it can probably not be proven secure, but that should not worry you overmuch.

The most important security consideration with HMAC is to use a time consistent compare when verifying the authentication tag. A 256 bit key could be considered for the simple reason that the overhead won't make any difference when ~2MB files are being protected.

It's probably better to focus on other parts of the system security and make sure you implement the key management well.