Dual control in banking is a procedure in which two or more people are equally accountable for protecting cash, keys or records, so that neither can act alone: two keys or two halves of a combination to open the vault, two counters for a recount, a maker and a different checker for a correction. It matters most where a drawer or an ATM does not balance, because that is the moment someone could make the difference disappear. Botminds' ATM & Teller Balancing is agentic software for that moment: agents trace each teller and ATM difference to the journal, recycler log and slip, and the recount and the correction stay with two named people, each signing on screen for what they personally did.
The chain below follows one shortage at Tessaly Community Bank, a fictional bank whose sample data the solution runs on. Drawer T07 at the Millbrook branch closed $90.00 short at 17:46 on October 21. Four people give five signatures before the difference is closed, and each signature answers a different question.
One $90.00 shortage in ATM & Teller Balancing: four steps by people, five signatures
A person decides
Teller closes the drawerCounts $8,322.60 against $8,412.60 expected from the teller platform and signs the close at 17:46. Proves what was in the drawer when the teller let go of it.
Agent
Balancing, Trace and Test agentsRaise a $90.00 shortage with the bank’s policy tier ($50.00 or more needs a recount by two people), find the 11:42 withdrawal keyed as $10.00 while the recycler paid out five $20 notes, and test it against the slip and the log.
Never: count cash, post a correction or name a person as the cause.
A person decides
Teller Supervisor, first countCounts the loose cash, $682.60, and signs at 18:06. Proves her own count, not anyone else’s.
A person decides
Second employee, second countSigns in with her own credentials, counts the same cash separately, gets $682.60 and signs at 18:09. Proves the total did not depend on one person.
A person decides
Supervisor proposes, Branch Manager approvesThe supervisor proposes the $90.00 correction at 18:14; the Branch Manager, who did not prepare it, approves at 18:20. Proves a second person saw the evidence before a customer’s account changed.
What is dual control in banking?
Dual control is the rule that two people, each accountable, must act together before certain cash, keys or records can be reached or changed. The FDIC's examination manual defines it under its other name: "Joint custody (a.k.a. dual control) refers to a procedure where two or more persons are equally accountable for the physical protection of items or records" (FDIC RMS Manual, section 4.2). Its example is the vault: "two keys or split combinations or passwords, under the separate control of different individuals, must be used in order to obtain access to vaults, files, or other storage devices."
The point of the control is arithmetic about people. One person with sole access can take cash and adjust the paperwork; two people who must both act can do it only if both agree. The same section says what that buys and what it depends on: "For the system to be effective, persons exercising control must guard their key, combination, or password carefully. If this is done, only collusion can bypass this control feature."
If this is done, only collusion can bypass this control feature.
FDIC RMS Manual of Examination Policies, section 4.2
"If this is done" carries the weight. A shared password, a combination taped inside a drawer or a second person who signs without counting turns two-person control back into one-person control with two names on it. The ways it fails are ordinary: habits that turn the second person into a witness instead of a participant.
What must be under dual control at a branch: the examiners' list
The examination manuals name the items, and they are mostly about the moments when cash or the means to reach it changes hands. The FDIC's own list under joint custody includes "reserve cash, negotiable collateral, certificated securities, trust assets, safekeeping items, reserve supplies of official checks, unissued electronic debit or credit cards, and unissued traveler's checks", and then "spare locks, keys, or combinations to night depositories, automated teller machines, safe deposit boxes, and tellers' cash drawers" (FDIC RMS Manual, section 4.2). The FDIC's examination module and the Federal Reserve's internal control questionnaire turn that into questions an examiner asks at the branch.
What the FDIC and the Federal Reserve ask about dual control at a branch
| Item | FDIC examination module (section 22.1) | Federal Reserve questionnaire (section 2310.4) |
|---|---|---|
| The vault | “vault opening and closing procedures are adequate and require dual control” (item 19) | “is the vault under dual control” (item 26c) |
| Reserve cash | Named in the FDIC manual’s joint custody list | “Is reserve cash under dual custody?” (item 19) |
| Currency shipments | “prepared and sent, received, and counted under dual control” (item 22) | Prepared, sent, received and counted under dual control (item 20) |
| Spare keys and combinations | “duplicate keys and combinations are under dual control” (item 2) | “are all spare keys kept under dual control?” (item 1) |
| An absent teller’s cash | “the total cash supply for tellers that are on vacation or absent for an extended period is counted under dual control” (item 3) | The absent teller’s total cash supply is counted (item 3) |
| Cash passed between tellers | “both tellers verify and initial teller transfer entries” (item 14) | Transfers verified and initialed by both tellers (item 14) |
| The ATM | Keys or combinations named in the manual’s joint custody list | “Is daily access to the automated teller machine (ATM) made under dual control?” (item 31) |
Two things stand out. The teller's own drawer is not on the list for daily dual control; it is the opposite. The FDIC expects each teller to have sole access to their own cash supply and drawer, so that a difference belongs to one person. Dual control enters when that drawer is opened by someone else: when the teller is absent, when cash moves between tellers, and when a difference is recounted. And the ATM is on both lists, because loading and emptying a machine is a vault visit in another place.
Joint custody vs dual control in banking: one control, two names
In the FDIC's usage they are the same thing: the manual heads the section "Joint Custody" and defines it as "a.k.a. dual control". The Federal Reserve's questionnaire uses both words in neighboring questions, "dual custody" for reserve cash and "dual control" for the vault and the ATM, without drawing a distinction. A bank may reserve "custody" for holding things (keys, combinations, reserve cash) and "control" for doing things (opening, counting, approving). That is a useful house convention, as long as the policy says which is which.
What matters to an examiner is not the word but whether both people were equally accountable. A vault opened by two people, one of whom holds both halves of the combination, is joint custody on paper only. So is a count where one person counts and the other watches from across the room.
Dual control vs separation of duties: together, or one after the other
Dual control puts two people on the same act at the same time; separation of duties puts different people on different steps of the same transaction. The FDIC frames separation of duties as the broader idea: "The possibility of fraud diminishes significantly when two or more people are involved in processing a transaction." Its standard is that "one person cannot dominate a transaction from inception to completion" (FDIC RMS Manual, section 4.2).
A teller difference needs both. The recount is dual control: two people count the same cash and both sign. The correction that follows is separation of duties: one person proposes the entry and a different person approves it. The manual expects the same principle inside software: an automated hold "allows tellers or customer service representatives to access an account for a customer, but requires the approval of a second person to authorize a transaction", and "certain modifications of data, such as master file changes, should require action from two authorized people before data is altered."
Maker and checker on the correction: the person who proposes cannot approve
Who can perform a dual control count?
Any two employees the bank's policy authorizes, provided each actually counts and each is accountable for the result. The regulators' texts set the principle, equal accountability, and leave the roster to the bank. A sound policy adds three conditions, and each closes a gap the principle leaves open.
Independence from the drawer. The teller whose drawer is short should not be one of the two counters of their own difference; at Tessaly that is written into the recount screen: "neither counter is the teller who closed the drawer". Independence from each other. If the second counter reports to the first, or depends on the first for a schedule or a review, a request to sign quickly is hard to refuse.A count each, not a count between them. Each person should arrive at the total separately. If one counts and the other reads the number off the first count, the bank has one count and two signatures.
A dual-control recount in ATM & Teller Balancing: two counts, two sign-ins
A second signature is not a second count
The gap between signing and counting is where dual control can fail quietly, and federal prosecutors have described it in plain terms. A branch manager in Spokane, Washington, took at least $345,664 from the vault, the ATM and her own cash drawer between June and September 2023. According to the U.S. Attorney's Office, she covered the theft by falsifying the cash reconciliation and having staff sign count sheets that were false (U.S. Attorney's Office, Eastern District of Washington, July 2024; the case is set beside the surprise count that should have caught it in surprise cash count). She was sentenced to 24 months in prison.
Every one of those count sheets carried two signatures. What they did not carry was two counts, and the person who directed the signing was the person the control was meant to check. The lesson is not that dual control failed; it is that a signature on a paper sheet records that someone signed, and nothing more.
What the second person on a recount actually proves
A second signature: Reads the first person’s total and signs beneath it.
A second count: Counts the same cash separately and enters a total of their own.
A second signature: That two people were present, or said they were.
A second count: That the total did not depend on one person’s count or honesty.
A second signature: A wrong or invented total; a signer who was pressed to sign.
A second count: Only collusion between both counters.
A second signature: A paper sheet with two names, filed in a drawer.
A second count: Two totals by denomination, two separate sign-ins, each timed.
A second signature: Whether the sheet exists.
A second count: Whether the two counts agree, who counted, when, and which explanation the count settled.
Does dual control prevent fraud?
It prevents one person acting alone; it does not prevent two people acting together, and it does not prevent a person with authority over the other from acting through them. That is why the examination manuals pair it with controls that do not depend on the same two people: sole access to drawers, so a difference has an owner; daily proof against an independent control; cumulative over-and-short records for every cash handler; surprise counts; and required absences, so that someone else runs the work for a while.
It also helps to look at who is on each side of the count over time. If the same two people count each other's differences every week, the bank has a pair, not a control. A record of who counted with whom, kept with every recount, lets an auditor see that pattern; a paper sheet in a drawer does not. Where cash disappears without collusion, the tool that finds it can be the record rather than the count: our guide to teller balancing covers the cumulative over-and-short record examiners ask for, and four federal embezzlement cases show what each control would have caught.
Each role in the chain signs for something different
A signature chain is only useful if each person knows what their own signature means. The People figure below sets out the four roles that sign on a teller difference, what each did before the work was traced by agents, and what each keeps afterwards. The pattern is that agents take over the reading and matching that used to fill the supervisor's evening, and every judgement and every signature stays with a person.
Four roles that sign on a teller difference, and what each signature proves
Today
Signs the close and the proof sheet; hears about a shortage the next morning, often without the reason.
With agents
Signs the close; sees only their own drawer, its difference and its explanation, never a referral about themselves.
Still theirs: The count at close, and their own sign-in on it.
Today
Prints the drawer’s transactions, the recycler log and the journal and reads them line by line after close; counts and signs.
With agents
Opens the difference on its leading explanation with the records side by side, does the first count and proposes the correction.
Still theirs: The first count and the proposal; never the approval of her own entry.
Today
Often asked to sign a sheet already filled in.
With agents
Signs in separately and enters their own total by denomination.
Still theirs: A count of their own, timed and attributed.
Today
Approves corrections with little more than the supervisor’s word for why.
With agents
Sees the explanation, the recount and the records before approving; cannot approve what he proposed.
Still theirs: The approval, with a recorded meaning: this correction, for this reason.
How to document dual control so an examiner can test it
Document each person's act, not the event. The Federal Reserve marks its dual-control questions with an asterisk because they "require substantiation by observation or testing" (Commercial Bank Examination Manual, section 2310.4); a policy saying the vault is under dual control does not answer them, and neither does a sheet with two names. Evidence an examiner can test has five parts.
Who: two named people, each identified by their own sign-in, not by initials one of them wrote for both. What each counted: two totals, by denomination, entered separately. When: a time for each signature, so that a count signed before the drawer closed shows up. Why: the difference, the policy tier that required the count and the explanation the count settled. What happened next: the correction, its maker and its checker, linked to the count that justified it.
Vault and ATM access deserve the same treatment. A vault register signed by the people opening and closing it is one of the Federal Reserve's own questions (item 26a), and the examination module asks for a bank representative to be present during ATM maintenance. In both cases, the register is only as good as the separate identities in it.
What ATM & Teller Balancing changes about the signatures
It changes what a signature is attached to. On paper, a recount is a sheet; in the solution, it is two counts by two people with two sign-ins, attached to the difference, the explanation the agents tested and the correction that followed. The agents prepare everything around the signatures: they tie the close, trace the cash movement, test each explanation against the records and draft the entry. They never count, never approve and never post a correction.
The bank's own policy sets the rules the screen enforces. At Tessaly, every recount of $50.00 or more takes two counters with separate sign-ins, and every correction to a customer's account, write-off, network adjustment and customer letter takes a maker and a different checker, with a reason code. The person who proposed an item cannot approve it. The ATM side runs the same way: the ATM Settlement Analyst proposes a network adjustment and the Cash Operations Manager approves it. How the agents divide the rest of the work is set out in which reconciliation steps move to agents, and the whole solution is on the ATM & Teller Balancing page.
Questions people ask
What happens if dual control is broken?
The item is treated as if one person had sole access to it, and the bank loses the ability to say who is responsible for a shortage found later. A sound policy requires the break to be reported to a responsible officer, the cash counted at once by two people and the reason recorded. The FDIC expects management to have "procedures for the prompt reporting and investigation of irregularities and identified shortages."
Is joint custody the same as dual control?
Yes, in the FDIC's examination manual, which defines joint custody as "a.k.a. dual control". A bank may use custody for holding keys or combinations and control for acts such as opening or counting, which is a convention, not a regulatory distinction.
Does dual control apply to ATMs?
Yes. The FDIC lists keys or combinations to automated teller machines among items that should be under joint custody, and the Federal Reserve's questionnaire asks whether daily access to the ATM is made under dual control. The same reasoning covers loading, emptying and counting a machine's cassettes.
Can the teller whose drawer is short be one of the two counters?
The examination manuals do not settle it, so it is a policy decision; excluding the teller keeps the recount independent of the person whose difference it is. Tessaly's policy in the sample data does exactly that: neither counter is the teller who closed the drawer.
Is dual control the same as maker-checker?
They are related but different. Dual control has two people act together on the same thing, such as counting cash or opening a vault; maker-checker has one person prepare an action and another approve it afterwards. A teller difference above the recount threshold needs both: a dual-control recount, then a correction with a maker and a different checker.