Business Online Banking Permissions: Separate Payment Creation and Approval

Inventory every action an online user can perform

List the capabilities available on the account: view-only access, download statements, mobile check deposit, ACH batch creation, payroll file upload, wire initiation, wire approval, positive-pay decisions, external account linking, user administration and account closure requests. Different institutions bundle these into roles with similar names, so do not infer that 'bookkeeper' means the same set of permissions at every bank. Read the actual permission matrix or test the account using a nonproduction user. Record whether access applies to the whole customer profile, one legal entity, one account or a defined set of payment templates.

For a small manufacturer, the bookkeeper may need to enter a $1,400 supplier payment but should not necessarily approve it. The controller may approve it, and the owner may be the only person allowed to change authorized recipients. If the bank allows everyone to change saved payees, a wire approval step can be undermined by a separate payee-tampering path. Review which actions generate alerts and whether one user can silently raise limits. Limit the number of administrators and make one person responsible for quarterly permission reviews. When an employee leaves, disabling only the payroll application is insufficient if the person still has access to the bank's separate mobile token.

Design dual control around the riskiest payments

A maker-checker workflow requires one individual to prepare a transaction and a different authorized individual to approve or release it. It can reduce mistakes and some insider-fraud scenarios, provided the two identities are genuinely separate and an administrator cannot bypass the rules without another approval. Use stronger safeguards for a first-time beneficiary, new international wire, unusual amount or after-hours request. Confirm whether the bank verifies payee changes independently and whether approvers can review the full bank details, amount and originator account. A screen that says 'payment approved' without showing the destination is a weak control.

Consider a fictional company that sends 40 invoices averaging $2,000 each month. Its owner can approve all payments but does not have time to type each one. A two-person workflow lets accounting create a $2,000 instruction while a manager checks the invoice against the amount and recipient. For a surprise $23,000 payment to a new vendor, the policy could require an additional call to the vendor using a previously verified number. Those figures are an internal design example, not standard bank limits. A dual-approval arrangement works only if the second person performs an independent check rather than accepting a routine approval notification while doing unrelated work.

Strengthen login and device authentication

The 2021 FFIEC guidance superseded its 2005 and 2011 internet-banking authentication documents. It emphasizes risk-based layered security for customers, employees and other users rather than relying on a password alone. A business should ask its bank specifically which controls are enforced for a new payee, a changed device, and an unusually large funds-transfer instruction.

Use individual bank credentials, strong authentication methods and a documented device-replacement process. A shared login prevents the business from determining which person entered a payment and can undermine the bank's security requirements. Multifactor authentication can help, but it cannot prevent an employee from approving an instruction initiated by a fraudster who has persuaded them that the CEO urgently requested it. Teach users to verify changes to supplier banking information through known channels. Avoid conducting treasury work from unmanaged shared laptops, and remove permissions from old phones when replacements are activated.

Train staff to distinguish a real bank alert from a phishing message. If a caller claims the account is under attack and demands a 'safe' transfer, end the call and contact the bank using its official number. Require employees to report suspicious attempts promptly without creating a punishment incentive for silence. Monitor failed logins, unexpected device registrations and beneficiary edits. An organization with only one person able to approve payments also needs a continuity plan for sick leave, emergencies and travel; otherwise a legitimate payroll run may be delayed when the sole approver is unavailable. Security requires controlled redundancy rather than an undocumented shared password.

Align bank limits with payroll and cash flow

Set transaction and daily limits high enough for normal operations but low enough to make unusual outflows visible. Some banks distinguish per-user limits from company-wide limits and may set separate controls for ACH, wire, bill pay and checks. Review these differences during account onboarding. A $15,000 daily ACH limit might support routine vendor bills but fail during a $40,000 quarterly payroll and tax-payment cycle. Request a documented temporary increase with appropriate approvals rather than asking the bank to disable control limits permanently. Keep a forecast of major payments and bank holidays so the authorized approval window is realistic.

Check whether the bank's fraud service allows immediate suspension of a user or beneficiary without closing the entire business account. The ability to pause wires while permitting payroll credits may be valuable during an investigation, but the exact product features vary. Test how alerts are delivered when the primary approver is away. A payment that cannot be initiated because of a control is inconvenient; an unauthorized payment that escaped notice until settlement can be much more expensive. Measure the process by actual reconciliation: the team should match approved instructions with bank-settled payments, not merely count an approval log as proof that the correct account received the money.

Audit changes and incidents instead of trusting setup forever

Review a monthly export of users, roles, limits, newly added payees and successful large payments. Reconcile these records to human approval evidence. When an employee changes roles, remove unnecessary permissions immediately and record who made the change. Periodically test whether an entry-level user can add a beneficiary, submit ACH batches or override an approval; access controls sometimes broaden quietly when product upgrades or account migrations occur. Require dual review of permission changes for high-risk roles, especially administrator grants. A business with a well-designed initial matrix can still become exposed a year later if departed employees and unused devices remain authorized.

In a suspected breach, preserve the relevant payment IDs, timestamps, recipient details, approvals and audit records. Contact the bank's fraud team promptly and ask which payments can still be stopped and which have settled. Do not delete user accounts before exporting relevant records if doing so would destroy evidence; coordinate containment and investigation. Obtain new credentials and tokens through official bank channels, and separately verify any payroll or vendor instructions recently changed. Debrief the event with a narrow, useful question: which control failed or was bypassed, and what specific policy change closes that gap? A written permissions matrix is valuable only when it continues to match real user capabilities.

Editorial Verdict

A payment-approval policy works only when the bank platform enforces the same authority it describes on paper. Business online banking should be treated as a controlled payment system, not a collection of convenience logins. Separate payment preparation, beneficiary maintenance, approval and administration wherever the bank supports those functions. Pair technical rules with independent vendor verification, individual multifactor authentication, realistic transaction limits and regular entitlement reviews. Dual control does not eliminate social engineering, but it raises the chance that a fraudulent instruction is challenged before money is released. Test the bank's actual permissions rather than relying on generic role names, and design a backup approver so security does not become an operational single point of failure.

Frequently Asked Questions

Does two-factor authentication replace dual approval of a wire?

No. Authentication checks who logged in; dual approval checks whether a second authorized person reviewed the payment.

Should the company owner share an administrator password with the bookkeeper?

No. Use separate identities and delegated permissions with an accountable audit trail.

Do business ACH and wires have the same approval limits?

Not necessarily. Limits and release workflows can differ by bank, channel and customer agreement.

Sources

• FFIEC — 2021 authentication and access guidance
• Federal Reserve — Article 4A funds-transfer legal framework
• Nacha — ACH reversal rules and timing