How Should a Small Team Control Business Bank Access?

Start with the work, not the job title. An accountant preparing the books may need statements but no payment rights. A staff member preparing supplier payments may need to create drafts but should not approve those same payments. The owner should decide and record each person's access.

Use the following as a starting point, then match it to the options your bank actually offers. Ask the bank to explain any permission whose effect is unclear before enabling it.

Write down the named user, business reason, accounts covered, permissions and person who approved access. Keep this register free of passwords, authentication codes and recovery secrets.

Make payment preparation a proposal, not permission to release money. The preparer assembles the invoice, checks it against the business record and creates the payment. The approver checks the payee, account details, amount, purpose and supporting approval before authorising it.

Configure the bank to prevent the preparer approving the same payment where that option exists. Check whether the restriction also covers uploaded payment files, scheduled payments and other payment channels the business uses.

Illustrative example: a shop's accounts assistant prepares the supplier run. The owner checks the invoices and bank details, then approves through their own login. If the owner is away, a previously authorised second approver handles the run. The assistant does not borrow either person's access.

Use the related supplier payment run guide to organise the records behind each batch. Bank approval should be the final check on an explained payment.

Treat adding a beneficiary or changing bank details as a separate decision from paying an invoice. Confirm requested changes with a known contact using details already held in your records. Do not rely only on the contact details supplied with the change request.

• ✓Restrict beneficiary maintenance to people who need it.
• ✓Use separate approval for beneficiary changes where the bank offers it.
• ✓Record who checked the new details and how they checked them.
• ✓Set user and payment limits around normal business needs.
• ✓Review temporary limit increases afterwards and restore the usual setting.

Check how each limit works: per payment, per day, per user or across an account. Ask the bank whether a person can change their own limit. Do not assume a low payment limit also restricts user administration.

Put access review beside the monthly bank reconciliation. The reconciliation checks transactions; the access review checks who remains able to view or move money. Use the bank's current user list rather than relying on last month's register.

1. Compare active bank users with current staff and external advisers.
2. Confirm that each person's permissions still match their work.
3. Check payment limits, beneficiary rights and user-administration rights.
4. Review backup approvers and remove temporary access that is no longer needed.
5. Confirm recovery contacts and alert recipients remain appropriate.
6. Record changes, unresolved questions, the reviewer and the next action.

Where the bank provides an activity log, inspect user additions, permission changes and changes to contact details. Investigate anything the owner cannot explain. Save a review record without copying credentials into it.

Make bank access part of the handover. Agree who will remove it and when. For an unexpected departure or suspected misuse, contact the bank promptly through an established official channel to restrict access.

• ✓Disable the person's bank user and confirm the resulting status.
• ✓Review their access to every business account and payment channel.
• ✓Reassign pending drafts, approvals and scheduled-payment responsibilities.
• ✓Remove their contact details from recovery and alerts where appropriate.
• ✓Deal with bank-issued devices or tokens through the bank's process.
• ✓Ask whether a separate signatory or account mandate change is required.
• ✓Review recent activity and record completion of the handover.

For a role change, reduce permissions when the old responsibility ends. For an external accountant, remove access when the engagement ends unless the owner records a continuing business need.

Review recovery arrangements separately from everyday payment work. Identify whose mobile number, email address and device are registered for each user and for account-level recovery. Follow the bank's rules for individual authentication and keep business recovery arrangements under authorised oversight.

Prepare for an unavailable owner without sharing their credentials. Ask the bank about a second authorised administrator or another documented recovery route. Record the procedure and official contact route, not secret answers or codes.

Enable available alerts for outgoing payments, beneficiary changes and access changes. Give an owner or designated reviewer responsibility for checking them. Keep alerts distinct from authentication: receiving a payment notification should not require receiving someone else's approval code.

Agree what happens after an unfamiliar alert. The reviewer should check the account through the usual banking route and contact the bank if the activity is unexplained. Review alert recipients when staff leave and after contact details change.

• Giving everyone full access because it is easier to set up.
• Calling a process separate approval while the preparer uses the owner's login.
• Approving a batch without checking its payments and supporting records.
• Leaving a former employee's number in recovery settings.
• Sending alerts to an inbox nobody is responsible for reading.
• Assuming removal from one banking channel removes every form of authority.

If you work alone, describe the limitation honestly: there is no independent second approver. Keep access personal, review destination details before release, use suitable limits and check completed payments against the books.

If your bank cannot provide separate named users or the permissions you need, keep payment access with the authorised operator while others prepare supporting records outside banking. Ask about a suitable business facility. Do not solve the gap by circulating a password or authentication code.