Giving an accountant bank access: permissions and payment controls

Ask what the accountant needs to do: read transactions, download statements, connect an accounting feed, enter bills, or prepare payments. These are different capabilities. Grant the permissions required for the agreed job and review them when the scope changes.

Use the bank's documented user and access controls. Do not assume every institution offers the same role names or integrations. If a limited role is unavailable, discuss an alternative such as company-provided statements before granting unnecessary authority.

Invite a named user where the platform supports it. Avoid sharing the owner's reusable login or authentication codes. Use secure channels for documents containing financial or personal information.

The FTC recommends businesses limit and protect sensitive information. Apply that principle to bank statements and payroll records as well as credentials. Share the material needed for reconciliation without exposing unrelated accounts or customer data.

An accountant may prepare a payment list while an authorized company officer approves release. Define approval limits, supporting documents, and the process for changes to vendor banking details.

For a small team without enough people for full separation, arrange a compensating review by the owner or another appropriate person. A documented review of bank activity and payee changes can expose problems that a single person's unchecked access would miss.

Treat emailed bank detail changes as requests to verify, using a trusted contact method already on file. Record the verification and approval. An invoice with new account details should not become payment authority on its own.

Maintain an access register with person, system, role, purpose, approval, and review date. Include provider-managed integration connections, which can continue to work after an individual loses access.

Before an accountant leaves, retain the required records and identify integrations that depend on their account. Remove access when the handoff work is complete and the company-controlled connection is functioning.

Periodically check users and payment permissions against the current scope. The accounting team needs enough access to reconcile reliably, while the company retains control over moving money and over the financial record itself.