# Online Banking User Permissions and Approval Rules

- Author: PreciseBankFlow (https://precisebankflow.com)
- Published: 2026-10-17
- Category: Internal controls over cash
- Canonical: https://precisebankflow.com/blog/online-banking-user-permissions

> How to set online banking user permissions: view, initiate and approve roles, dual approval for payments, token control and quarterly access reviews.
Online banking user permissions decide who can see an account, who can create a payment, who can approve it and who can add or change users. Set them so no single login can both initiate and release money, keep administration with two people, give each user their own token, and review the user list every quarter.

## Which online banking user roles should a business set up?

A business should set up four kinds of online banking role: view only, initiate, approve and administer. Most staff need view only. A small number initiate payments, a different person approves them, and administration of users sits with someone who neither initiates nor approves day to day.

### What each role allows

- **View.** Balances, transactions, statements and check images. A bookkeeper or outside accountant usually needs nothing more.
- **Initiate.** Create wires, ACH batches, bill payments or transfers, which then wait for approval. Initiators should not be able to approve their own work.
- **Approve.** Release payments others created. Approvers ideally have no initiate rights on the same payment types.
- **Administer.** Add users, set limits, reset tokens and change permissions. This role can grant itself anything, so it is the most sensitive of the four.

Business banking platforms name these differently and slice them more finely, sometimes per account and per payment type. Map the bank's options onto these four ideas before you assign anyone.

### Limits by user

Most platforms let you set limits per user: a maximum per payment, per day, or per batch. Set them low for initiators and raise them only for the payment types each person actually handles. A payroll clerk does not need wire rights.

### Outside users and service providers

Outside bookkeepers, payroll providers and accountants often ask for their own logins. Give them view access by default. If a payroll provider must initiate payments, limit its user to the payroll account and the payroll payment type, and keep approval inside the business. Never let an outside party hold administration rights, because a dispute or a breach at their firm then becomes a breach of your bank access. When the engagement ends, remove the user the same week, and note the removal in the quarterly review file. The same applies to former owners and partners after a sale or a split: their access is removed on the closing date, not when someone remembers.

## Dual approval rules for online banking payments

Dual approval means a payment created by one user is not sent until a second user approves it. Turn it on for every wire, every ACH batch and any payment to a new payee. Where the platform allows, apply it to internal transfers out of the main operating account too.

### Choosing the threshold

Some businesses require dual approval only above an amount. That saves time but invites payments split just under the line. If you use a threshold, have the approver review a report of payments made just below it each month. For wires, consider a threshold of zero, because wires are hard to recall once sent. The steps for verifying and releasing a wire, including the call-back, are covered in [wire transfer approval process](/blog/wire-transfer-approval-process).

### Payee changes need approval too

A second approver on the payment is not enough if one user can quietly edit the payee's bank details. Fraud often works by changing the account number on a trusted supplier template, then sending a normal payment through normal approval. Require approval for new payees and for edits to saved payee details, and confirm the change outside the email that asked for it, as described in [vendor bank account change verification](/blog/vendor-bank-account-change-verification).

## The online banking administrator role and its risks

The online banking administrator can create users, change limits and grant rights, so an administrator acting alone can give themselves both initiate and approve rights. That makes the role the weakest point in the permission design. Banks often let you require two administrators to approve user changes; turn that on.

### Who should hold it

The administrator should be an owner, a senior officer or a controller, and there should be two. One administrator makes a change and the other approves it. Neither should be the person who initiates payments every day. In very small companies, the owner and an outside accountant sometimes share the role.

### What to watch

Most platforms keep an audit log of user changes. Ask for it or export it each quarter. Look for rights added and removed within a short period, which can hide a one-time payment, and for limits raised just before a large transfer.

## Security tokens and login control for business online banking

Each user should have a personal login and their own security token or authenticator app, never shared. Shared credentials mean the bank's log cannot show who did what, and a shared token turns dual approval into one person approving twice. Tokens for departed staff should be disabled on their last day.

### Why login discipline affects who pays for a loss

For wire transfers and other funds transfers, the bank and the business usually agree on a security procedure, such as passwords, tokens and call-backs. Under [Uniform Commercial Code section 4A-202](https://www.law.cornell.edu/ucc/4A/4A-202), an unauthorized payment order can still be treated as the customer's own if the agreed procedure was commercially reasonable and the bank followed it in good faith. If the procedure was a token you shared or a password left on a sticky note, the bank may have followed it exactly. Read the security section of your treasury agreement, and decline weaker options the bank offers only after understanding what that means for you.

### Practical rules

- One person, one login, one token.
- No logins saved in shared browsers on office machines.
- Tokens stored with the person, not in a desk drawer.
- Out-of-band confirmation for payments, such as a code sent to a separate device, turned on where offered.
- A written rule that nobody ever gives a token code over the phone, including to someone claiming to be the bank.

## How often should online banking access be reviewed?

Review online banking access at least quarterly, and immediately when someone leaves or changes role. A quarterly review is short: print the bank's user list with rights and limits, compare it with current staff and their jobs, and remove or change anything that no longer fits.

### Steps for a quarterly review

1. Export the user list from the bank, showing every user, their role, account access, payment types and limits.
2. Compare it with the current staff list. Remove anyone who has left.
3. For each remaining user, confirm the rights match the job. Remove rights not used in the last quarter.
4. Check that no user holds both initiate and approve on the same payment type.
5. Confirm at least two administrators exist and that user changes need both.
6. Pull the administrator audit log for the quarter and read every change.
7. Sign and date the reviewed list and file it with the quarter's close.

### An example permission matrix

The matrix below is an example for a five-user company. The names and limits are illustrative.

| User (example) | View | Initiate ACH | Initiate wire | Approve | Administer | Per-payment limit |
| --- | --- | --- | --- | --- | --- | ---: |
| Owner | Yes | No | No | Yes | Yes | 250,000 |
| Controller | Yes | No | No | Yes | Yes | 100,000 |
| AP clerk | Yes | Yes | Yes | No | No | 25,000 |
| Payroll clerk | Yes | Payroll only | No | No | No | Payroll batch only |
| Outside bookkeeper | Yes | No | No | No | No | n/a |

Read across each row and ask whether one person can complete a payment alone. In this example, nobody can: the clerks create, the owner or controller releases, and the two administrators must agree on any change to this table.

## Online banking permission gaps that bypass dual approval

A permission design can look sound and still let one user send money alone. The usual gaps are file uploads that skip approval, mobile apps with their own settings, templates that can be edited without approval, and an administrator who can approve their own user changes. Check each one with the bank.

### Gaps to test

- **ACH file upload.** Some platforms treat an uploaded payment file differently from a payment keyed on screen. Confirm uploads require the same approval.
- **Mobile banking.** Mobile apps sometimes carry separate limits or allow transfers the desktop blocks.
- **Template edits.** Editing a saved template's account number may not trigger approval, even when sending from it does.
- **Internal transfers.** A transfer to a linked account at the same bank may skip approval, and that linked account may have weaker controls.
- **Single administrator.** One administrator can grant a second login to themselves.
- **Approval by the initiator's second login.** Two logins held by one person defeat every rule above.

### Keeping evidence

User lists, audit logs and statements are evidence if a payment is ever disputed. Keep each quarter's reviewed list. If a loss leads to a claim or a lawsuit, those records, together with the statements, are what a forensic accountant will work from, and the way they are later organized for a court is explained in [summary exhibit of bank records](/blog/summary-exhibit-of-bank-records).

Permissions stop a bad payment from being sent; the monthly review of the statement confirms nothing got through. [PreciseBankFlow](/) reconciles each statement and lists unmatched and duplicate payments as exceptions, so that review is quick and documented.