Keep bank signers, portal users and payment approvers in one register

A person can have internal approval authority without being registered with the bank to act on the account. Another person may remain a bank signer after their everyday portal access has been removed. Build the register from bank documents and current system permissions, then compare it with the company's approval policy. Do not assume that changing one record updates the others.

Bank terminology differs. Chase's account-opening guidance, for example, distinguishes authorized signers from authorized account users who are not signers. Ask the company's bank to identify its own roles and the documents needed to change each. Preserve the explanation with the register rather than forcing every bank into an identical set of labels.

List accounts and legal entities first. For each user, record whether they can view transactions, download statements, create beneficiaries, submit payments, approve payments, change limits or administer other users. Include payment channels managed outside the main bank portal. A person with view access to one account may have broader authority through a separate treasury product. For a group administrator, identify every subsidiary account exposed by the role rather than listing only the parent company.

Record internal restrictions alongside the technical permissions. If company policy requires two approvals above a threshold but the bank lets one person release the payment, identify how the additional approval is evidenced. The gap may be accepted with a documented control, or the bank settings may need to change.

Use the least authority needed for the role and assign individual credentials. FFIEC guidance to financial institutions discusses layered controls, least-privilege access and stronger authentication for higher-risk activity. Those principles provide useful questions for the company's bank review; they do not establish that a particular account already has those protections enabled.

For a departing employee, check signer status, portal roles, recovery contacts, tokens, payment templates and third-party connections. A removed email address may leave a mobile authentication method or an external payment platform active. Request confirmation of each bank-side change and retain it with the departure record.

For a new approver, confirm both appointment and actual access before the old approver leaves. Use a controlled walkthrough that does not release an unnecessary payment. Verify that the person can see the appropriate account and complete the approved authentication process. Avoid lending them an existing user's credentials while paperwork is pending.

Changes to directors, ownership or the entity itself may require different evidence from an ordinary user update. Ask the bank for its checklist and involve the company secretary or legal adviser where needed. Track pending requests as open items with an owner.

At a scheduled review, obtain the current user and entitlement reports and compare them with the approved register. Investigate unexpected additions, broader permissions and accounts with no responsible administrator. Review dormant users as well as active ones. An account used only for annual payments can still carry payment authority throughout the year.

Have an authorized reviewer confirm the results and record the evidence date. Keep sensitive identity documents in the approved restricted location; the general register should reference them without copying unnecessary personal data. The accountant needs enough information to obtain records and escalate exceptions, while the bank and company retain their respective authority controls.