Two to Sign: How Payment Authority Really Works Inside a UK Business Bank Account
Photo: YBStauber, CC BY-SA 4.0, via Wikimedia Commons
There is a sentence that turns up in almost every small company's inbox eventually: 'Just add me as a signatory.' It arrives from a new finance manager, a co-founder, an outgoing director's replacement, sometimes a parent who has put money in. It sounds like admin. It is actually a governance decision with a bank account attached to it, and it deserves to be treated as one.
Where authority actually comes from
A company's ability to move money rests on three layers. First, the Companies Act and the company's articles of association, which set out how decisions are taken. Second, a board resolution recording who is authorised to operate the account and in what manner. Third, the bank's own mandate form and identity checks, which translate that resolution into practical permissions inside its systems.
When those three layers disagree, the bank follows its records. That is why a director who believes they are authorised, but is not on the mandate, cannot release a payment — and why a former director who is still on the mandate can, until someone tells the bank otherwise in writing.
The three roles people confuse
Most business banking platforms now separate permissions that used to be bundled together. The distinction matters far more than the label on the account.
| Role | What it allows | Typical holder |
|---|---|---|
| Viewer | Read balances, statements and transaction history | Bookkeeper, auditor, non-executive director |
| Initiator | Add a payee, draft a payment, submit for approval | Accounts assistant, outsourced finance team |
| Approver | Release a payment or approve a new payee | Director, finance director, second authorised person |
| Administrator | Change users, limits and permissions | Managing director or company secretary, never shared |
The administrator role is the one to guard. Anyone who can add users can add an approver, and anyone who can add an approver can eventually move money.
Why one compromised login is enough
Faster Payments settle in seconds and cannot be recalled. If a single individual can both set up a new payee and release a payment to it, then a single set of stolen credentials — harvested by a convincing invoice scam, a lookalike login page or a compromised laptop — is enough to empty the account before anyone opens the post.
Dual authorisation breaks that chain. Two separate people, on two separate devices, both acting deliberately, is a far harder thing to counterfeit than one password. Add a rule that new payees require a callback to a number held on file (never a number in the email that requested the payment) and most invoice fraud stops at the first gate.
Smaller companies should note that mandatory reimbursement for authorised push payment fraud, introduced by the Payment Systems Regulator in 2024, covers consumers, micro-enterprises and smaller charities. Businesses above that threshold generally bear the loss themselves. For them, controls are not a compliance nicety; they are the only insurance available.
Adding and removing with the same ceremony
Companies are usually careful about adding a signatory and careless about removing one. Both should require the same paperwork: a board resolution, a completed mandate amendment, fresh identity and address verification for anyone new, and written confirmation to the bank from an existing authorised person.
When a director resigns, the clock starts immediately. Their resignation takes effect at law on the date recorded, but their access to the bank account continues until the mandate is changed. Best practice is a leavers checklist that runs in parallel with the payroll one: revoke bank access, revoke accounting software access, recover devices, and confirm in writing to the bank the same week.
Delegated access for bookkeepers
Giving an external bookkeeper or outsourced finance provider access is normal and sensible. Giving them the ability to approve their own payments is not. The usual pattern is for the bookkeeper to hold initiator rights and for one or two directors to hold approver rights, with a monthly export of the audit trail sent to the board.
Avoid the temptation to share a director's login 'just for the bank feed'. Most platforms offer read-only connections precisely so that this does not happen, and shared credentials destroy the evidential value of the audit trail if something later goes wrong.
A one-page annual mandate review
An annual review need not be elaborate. One page, signed and minuted, is enough to demonstrate that the board has looked.
| Account | Holder of access | Role | Payment limit | Approver required | Reviewed | Action |
|---|---|---|---|---|---|---|
| Current a/c | A Patel | Approver | £50,000 | Yes, plus B Okafor | Nov 2026 | None |
| Current a/c | J Whyte (left Mar) | Initiator | — | — | Nov 2026 | Remove |
| Deposit a/c | Outsourced finance | Viewer | — | — | Nov 2026 | Confirm |
The review should answer four questions. Who can see the money? Who can prepare a payment? Who can release it? Who can change the answers to the first three?
Five red flags worth acting on this week
- A single person who can add a payee and approve the payment to it.
- An administrator account whose credentials are known to more than one person.
- A former employee or director still listed as a signatory.
- No callback process for payments above an agreed threshold.
- A mandate that has not been reviewed since the company last changed banks.
Bank mandates are dull until the day they are not. Treating them as an internal control — reviewed on a fixed date, minuted, and changed only by resolution — costs an hour a year and removes an entire category of risk from the business.
