Segregation of duties in banking is the control that requires two or more people to complete a transaction, so that one employee's work verifies that another's was authorised, and no single person can carry a change from request to posting. The FDIC's examination manual applies it explicitly to the bank's data: "certain modifications of data, such as master file changes, should require action from two authorized people before data is altered." An account maintenance request is exactly that kind of change. It rewrites who owns an account, who may sign, where the mail goes, which phone gets the codes and who receives the money at death, and it is the first move in most account takeovers. Botminds' Account Maintenance Requests is account maintenance request software that builds the split into the work: agents read and check each request, one specialist decides, a second specialist checks, and nothing posts on one signature.
This guide is written for the deposit operations manager who designs the desk, the chief operating officer who signs its procedures and the internal auditor who tests it. The worked figures come from a fictional sample bank as it runs through the solution; regulatory text is linked where it appears.
Why the desk that edits accounts is a control, not a back office
2
authorised people the FDIC expects to act on a master file change before data is altered
155,415
elder financial exploitation reports filed with FinCEN, June 2022 to June 2023
$27B+
of reported suspicious activity in those filings
What is segregation of duties in banking?
It is the assignment of work so that the person who starts a transaction is not the person who authorises, records or reconciles it. The FDIC's manual puts the reasoning in one line: "The possibility of fraud diminishes significantly when two or more people are involved in processing a transaction." Its standard for management is that responsibilities are assigned "so that one person cannot dominate a transaction from inception to completion" (FDIC RMS Manual, section 4.2).
The manual's examples are the familiar ones: a loan officer should not both make a loan and disburse its proceeds, and a person who signs official checks should not reconcile the official check account. The less familiar sentence is the one about data. Holds on dormant accounts, it says, should let a teller see the account but need a second person to authorise a transaction, and master file changes should need two authorised people. When a hold is added or removed, or an action needing supervisory approval occurs, an exception report should go to "a designated person who is not involved with the activity."
For a deposit operations leader that sentence is the design brief. An account's owners, signers, addresses, phones and beneficiaries are its master file. The split examiners expect on a wire or a loan disbursement applies with equal force to the change that decides who can send the wire next week.
Why every account maintenance change is a master file change
Each maintenance change moves something of value, even though no money moves on the day. A new phone receives every later one-time code; a new address receives the replacement card; a new signer can draw on the account; a new payable-on-death beneficiary takes the balance at death. That is why the FFIEC's 2021 authentication guidance lists "Account Maintenance Controls" among its examples of effective controls and names changes to address, contact information and enrolled devices as activities that warrant stronger authentication (FFIEC, Authentication and Access to Financial Institution Services and Systems).
What each maintenance change moves, and the rule that reaches it
| Change | What it moves | Rule or guidance |
|---|---|---|
| Mailing address | Statements, notices, replacement cards | Red Flags guidelines: verify change of address requests on existing accounts (12 CFR 41, App. J) |
| Phone or email | One-time codes, fraud alerts, the callback number | FFIEC 2021: enhanced authentication for contact and device changes |
| Signer added or removed | Who may withdraw, write checks and send wires | BSA: banks keep each document granting signature authority (31 CFR 1020.410(c)) |
| Owner added or removed | Who the bank must identify; insurance category | CIP: an added co-owner is a new customer (interagency CIP guidance) |
| Payable-on-death beneficiary | Who receives the balance at death | FDIC: beneficiaries must be named in the account records (12 CFR 330.10) |
| Name change | The identity every later check is matched against | Red Flags: identifying information inconsistent with what is on file |
Volume is what makes the control hard. At the sample bank, the deposit operations team received 2,214 maintenance requests on one Monday: 1,412 went to a low-risk lane, 647 needed a specialist and 155 carried at least one takeover signal. A segregation design that works for the 155 and stalls the 1,412 will be bypassed within a month, so the design has to scale the split, not just declare it. What one account maintenance request costs prices those lanes in minutes and wages.
The incompatible duties on a maintenance desk
The core rule is that the person who makes a change does not approve it, but a desk has more incompatible pairs than that one. Each pair below lets one person, or one compromised channel, take a change from start to finish. Most are invisible in a procedures manual that lists tasks rather than combinations.
Duties a deposit operations desk should never give to one person
| Combined in one person | What it lets them do | The split |
|---|---|---|
| Keying a change and checking it | Post any change, including to an account they control | Maker and checker are different people; the maker cannot check their own request |
| Taking a phone change in the contact center and approving a form that relies on the new phone | Pass a callback they arranged | Callbacks go only to a number on file 90 days or more, chosen from the bank's data, not the request |
| Changing an address and ordering a card to it | Divert a card the customer never sees | Card reissue after an address change waits for the confirmation to the old address |
| Overriding a takeover signal and checking the override | Clear their own exception | An override needs a reason code, a note and a different checker |
| Maintaining their own or a relative's accounts | Edit the accounts they benefit from | Employee and related accounts route to another team |
| Changing thresholds and working the queue | Lower the bar for requests they process | Settings change only with a new version and compliance sign-off |
| Referring a case and talking to the customer about it | Disclose a referral, intentionally or not | Referrals stay out of deposit operations screens and letters |
The address and card row deserves emphasis because it sits across two teams. The Red Flags guidelines treat a request for a new card shortly after a change of address as a warning sign, and a card issuer must assess the address change before issuing an additional or replacement card. A maintenance desk that changes the address and lets the card system mail the card the same evening has split nothing; the change and its payoff ran through one decision.
The employee-account row is one examiners look for directly. The FDIC's manual tells examiners in its verification procedures to "watch for borrowers with common addresses or post office box numbers and for accounts having the same addresses as bank officers and employees." A desk where specialists can work requests on accounts that share their own address is a finding waiting to be written.
Who approves account changes at a bank?
At a bank that runs segregation of duties, every account change has two approvers: the specialist who makes it and a second specialist who checks it. Flagged requests add a third party, an elder protection specialist, legal, or financial crimes, before anything posts. Federal rules do not prescribe the titles. They prescribe the outcome, that no single person can complete the change, and leave the organisation to the bank.
Five seats on one maintenance request, and what each one keeps
Today
Finds the customer, opens the signature card, compares the signature by eye, keys the change. Fraud checks happen if someone notices.
With agents
Opens a request showing only the fields that change, each tied to its line on the form, with takeover signals and a safe callback number beside it.
Still theirs: The decision to approve, hold or send on
Today
Re-reads the keyed fields against the screen, not the document and not the account's history.
With agents
Sees the same evidence the maker saw, ticks a checklist and signs or returns with a reason code.
Still theirs: The second signature
Today
Hears of exploitation after the change has posted and money has moved.
With agents
Receives the case with the account unchanged and the call summary attached.
Still theirs: Protective actions and referrals
Today
Watches clean changes wait behind risky ones; builds monthly numbers by hand.
With agents
Sees the day by lane against the same-day target and callback deadlines; reassigns in bulk.
Still theirs: Staffing, thresholds, the monthly report
Today
Gathers the form, card, call notes and approvals from separate systems to test one file.
With agents
Filters a trail of every action by person and agent and exports an examiner file.
Still theirs: Testing and the examiner conversation
The flagged lane is not a formality. FinCEN's review of elder exploitation reports found that filers named adult children as the perpetrators of elder theft in nearly 40 percent of cases (FinCEN Financial Trend Analysis, April 2024). A request from a family member to add a beneficiary on an older customer's account is a case where the maker and checker both benefit from a specialist who works those cases every day.
What does the checker actually check?
The evidence, not the keystrokes. A checker who compares the keyed address with the form catches typing errors; a checker who sees the form, the signature card, the phone change six days earlier and the callback outcome catches the forgery. Only the second is segregation of duties in the sense the examination manual means: one person's work verifying that another's was properly authorised.
The checker's list for a maintenance change, in the order it should be worked
- The requester had authority for this change
An owner, a signer on the card, the officer a resolution names, or an agent whose power of attorney grants this power expressly.
- The signature was compared, and a weak match was verified
A score below the bank's threshold went to a callback, not to a reject or a pass.
- The 90-day history was read
Contact center calls, password resets, new devices, external accounts and card requests before the form.
- The callback went to a number of record
On file at least 90 days and not in the request; the outcome was recorded by the person who called.
- The keyed values match the document line by line
Every changed field, on every affected account.
- Confirmations go to the old and the new contact details
So a real customer learns of a change they did not make.
- Any override carries a reason code and a note
And the checker is not the person who overrode.
A desk can make the checker's job real only if the checker sees what the maker saw. When the evidence sits in five systems, the check collapses into re-reading the core screen. That is the most common way a bank has a maker and a checker on paper and one decision in practice.
A checker signs a business signer change against the same evidence
Staffing the split: the arithmetic of makers and checkers
Segregation of duties costs people, and the cost depends on which requests get two full reviews. If every one of 2,214 daily requests takes a maker's full read and a checker's full read, the desk needs roughly twice the staff it would need for one review. The answer most banks reach is risk-based lanes: full maker-checker on the flagged and specialist requests, and group approval with a sample on the clean ones.
A day's specialist capacity, worked on the sample bank's Monday
Specialist requests
647 requests ÷ 40 a day per maker
About 16 maker-days. Specialists at the sample bank work 35 to 50 requests a day as maker.
Flagged requests worked by hand
155 × 77 minutes
About 199 hours, or 25 specialist-days at 8 hours, if each flagged request is worked the slow way.
Flagged requests with the evidence assembled
155 × 21 minutes
About 54 hours. The callback and the decision stay with people; the searching does not.
Low-risk lane, checked in groups
1,412 ÷ 20 opened in full
72 requests sampled across four groups, with a checker approving each group.
The arithmetic shows where a manager's choice lies. The flagged lane is small in count and large in hours, and it is the lane where a rushed second review costs most. The low-risk lane is large in count and small in risk, and it is where a sampled group check keeps the control honest without doubling the headcount. The sample rate is the lever: at one in 20 the sample bank opened 72 requests in full across four groups; at one in 10 it would have opened about twice as many.
The FDIC's manual has a view on the tooling too: "When properly designed, automated control methods are generally considered superior to manual procedures." A system that refuses to let the maker check their own request does not depend on a supervisor noticing who signed.
Vacations, rotation and the insider who never leaves
Segregation of duties is paired in the examination manual with two people controls, and both apply to a maintenance desk. Banks should require officers and employees to be absent "for an uninterrupted period of not less than two consecutive weeks," because embezzlement "usually require[s] a perpetrator's ongoing presence to manipulate records, respond to inquiries, and otherwise prevent detection" (FDIC RMS Manual, section 4.2).
The benefits of such policies are substantially, if not totally, eroded if the duties normally performed by an individual are not assumed by someone else.
FDIC RMS Manual of Examination Policies, section 4.2
On a maintenance desk the insider risk takes a specific form: a specialist who quietly changes an address or phone on a dormant or older customer's account, then handles the follow-up calls and returned mail. Two weeks away, with the queue genuinely reassigned, brings the returned mail and the confused customer to someone else. Rotation does the same across teams, and the manual adds that rotations "should not be announced ahead of time to the involved personnel." Both are cheaper to run when the work routes by rule, so the manager can move a specialist's open requests in bulk without losing their history.
Training and confidentiality: the two duties a split cannot replace
Two people who do not know what to look for will both approve a forgery. The Red Flags Rule makes staff training, as necessary to implement the program effectively, part of administering it (12 CFR 41.90(e)), and its guidelines list the address-change and inconsistent-information warning signs a maintenance desk meets daily (Appendix J).
Confidentiality is the other duty the split must respect. A maker who holds a request and a checker who returns it both talk to customers, and neither may hint at a report: "A SAR, and any information that would reveal the existence of a SAR, are confidential and shall not be disclosed" except as the rule allows (31 CFR 1020.320(e)). That is why the solution keeps financial crimes referrals out of deposit operations screens and checks every customer message for any mention of one before it is sent. The design question for the bank is the same with or without software: who on the desk knows a referral exists, and does the customer-facing seat need to?
What examiners and internal audit test
They test whether the split happened, file by file, and whether the bank can prove it. The evidence is the request, the documents relied on, who made the change, who checked it, what each of them saw and when, and the reason for any override. Documents granting signature authority must be retained under the Bank Secrecy Act (31 CFR 1020.410(c)), for five years under the general retention rule.
Common findings on maintenance desks, and the evidence that closes each
| Finding | Why it happens | Evidence that closes it |
|---|---|---|
| Maker and checker are the same user on some files | Shared logins, or a supervisor clearing a backlog | System-enforced separation, with the trail showing two user IDs per change |
| Checker re-keyed values but did not review the documents | Evidence in separate systems | The checker's view shows the form, card, history and callback; opening each is logged |
| Callback made to the number in the request | Script reads the request back | The callback number chosen from data on file 90 days or more, and the reason recorded |
| Overrides without reasons | Free-text optional | Reason codes and notes required to submit an override |
| Low-risk lane approved without a sample | Volume pressure | Sample rate as a setting, with each sampled request opened in full on the trail |
| Employee accounts maintained by colleagues on the same team | No routing rule | Employee and related accounts route to a separate queue |
The examiner file: every action, by person and by agent
A bank evaluating tools for this desk should ask how each of these findings would be closed, not whether the product has an approval button. Twelve questions for comparing account maintenance software turns that into a buying checklist, and callback verification when the phone on file has just changed covers the control examiners most often find broken.
Where agents fit without breaking the split
Agents can do the reading and searching on both sides of the split, but they must not become a third approver that nobody checks. In Account Maintenance Requests an Intake agent reads the request into the fields that change, an Authority agent checks the card, the resolution or the power of attorney, a Signature agent scores the signature and never decides, a Takeover agent reads 90 days of history across channels, and a Callback agent picks the number of record and drafts the script. Agents do not post, call the customer or decide a hold.
That design keeps the two signatures meaningful and moves the time to where judgment is needed. Prompts and models are versioned, and a new version runs on the previous month's requests, 45,870 at the sample bank, before it goes live, with compliance signing the comparison. For a deposit operations leader, that is the same discipline as any other change to the control: a new version, tested, approved by someone who did not build it. How a maintenance team comes to trust the agents covers the rollout.
Questions people ask
What is an example of segregation of duties in banking?
A loan officer who makes a loan does not also disburse the proceeds or accept the payments; a person who signs official checks does not reconcile the official check account. In deposit operations, the specialist who keys a change to an account's phone or beneficiary does not approve it, and a second authorised person must act before the data changes, as the FDIC's manual expects for master file changes.
What is the difference between dual control and segregation of duties?
Dual control, which the FDIC calls joint custody, means two people are equally accountable for protecting the same asset at the same time, such as two keys to a vault. Segregation of duties splits a transaction's steps among different people, so one person's work checks another's. A maintenance desk mainly uses the second: one person makes the change and another checks it.
How can a small bank segregate duties with only a few people?
By splitting the riskiest pairs first and using compensating controls for the rest. A three-person desk can still keep maker and checker separate on every change, route employee accounts to someone outside the team, and have an officer review a daily exception report of overrides and high-value beneficiary changes. The FDIC notes that automated controls written into software can act like manual segregation.
Can a supervisor be both maker and checker to clear a backlog?
Not on the same change. A supervisor may act as checker on a specialist's work, or as maker with someone else checking, but not both. Backlogs are where the control most often fails; a low-risk lane with a sampled group check is a safer way to clear volume than letting one person sign twice.
Does segregation of duties apply to changes made through the contact center?
Yes, and it is where it is most often missing. The FFIEC's 2021 guidance says attackers frequently deceive call center staff into resetting credentials. A phone or email change taken on a call should be treated as a maintenance change with the same controls, including notice to the old contact details and a check of the account's recent history.
How long must a bank keep evidence of account maintenance approvals?
Documents granting signature authority over a deposit account must be retained under the BSA recordkeeping rule, 31 CFR 1020.410(c), for five years. Many banks keep the whole maintenance file, approvals and callbacks included, for five years after the account closes as a matter of policy, which is the sample bank's setting.