Bank mandates and payment authority: keep the keys

Key takeaways

Your bank mandate says who can operate the business account and release payments. Signatories and payment approvers should always be named people in your business, never an outsourced provider. A provider can prepare payment batches and upload them for approval. Use dual authorisation above a set amount, and review the mandate whenever someone joins or leaves.

• Only named people in the business can approve payments.
• A provider can create payments but never release them.
• Use dual approval above an amount you set.
• Review the mandate when anyone joins, leaves or changes role.

Why should payment authority never be outsourced?

Because whoever can release payments controls your cash. A provider with approval rights could pay a fraudulent invoice, overpay a supplier or empty an account by mistake, and recovering money after it leaves is slow and uncertain. Keeping release rights in-house also means every payment has been seen by someone who cares about the business.

• Which business processes should you never outsource?
• Fraud controls: the checks that must stay inside

How should payment roles be split?

Most business banking platforms let you set separate roles for creating and approving payments. Use them.

• Provider: matches invoices, prepares and uploads the batch.
• Manager: checks the batch against approved invoices.
• Director: releases payments, with a second approver above a limit.
• Nobody: approves a payment they created.

• Supplier payment runs: outsource the prep, keep approval
• The four eyes principle for small businesses

What belongs in a bank mandate review?

Check the list of signatories and online banking users against current staff, confirm each person's limits and roles, remove anyone who has left, and make sure at least two people can approve, so payments do not stop when one is on holiday. Keep a record of the review.

• Admin accounts and master passwords: never hand them over
• Approval bottlenecks: when sign-off holds up the work

What can a provider see and do?

A provider can usually have view access to statements for reconciliation and create-only access for payments. They should never be able to add new payees without approval or change supplier bank details. These limits should be set in the bank's system, not just agreed in writing.

• System access for outsourced teams: fast but safe
• Bank reconciliation outsourcing: daily, not month-end

What does this look like in practice?

A pattern we see: one director holds the only approval rights and payments stall during their holiday. Adding a second approver and moving batch preparation to a provider keeps payments on time without widening who can release money.

• See client work
• BPO Solutions for UK businesses

Payment authority checklist

• List every signatory and online banking user.
• Separate create and approve roles.
• Set dual approval above a chosen amount.
• Give providers create-only and view access.
• Review the mandate when people change.

• Business plan writers: what to hand over and what to write
• Discount approval: who can change your prices?

Next step

Log in to your business banking and list who can approve payments today. If anyone outside the business appears, or anyone who has left, fix it this week.