Maker checker process in banking: the checker re-keys, not re-reads

The maker checker process in banking splits one transaction between two people: the maker prepares or changes it, and the checker verifies it and approves it before it takes effect, so no single person can move money on their own judgement or their own mistake. In payments the control matters most when a fix changes who is paid or how much, because a wire sent to the wrong account is the bank's loss. Its common weakness is the form of the check: a checker shown the maker's answer on the same screen tends to confirm it. Botminds' Payment Repair, an agentic solution for repairing failed payments, runs the check differently. The checker sees the value as received and the evidence, and re-keys the changed value before the maker's proposal is revealed.

Examples on this page are from the solution's sample data, the fictional Corvane National Bank. The controls come from the FFIEC's examination handbook, the liability rules from Article 4A of the Uniform Commercial Code, and the evidence on double-checking from peer-reviewed research, each linked where it appears.

What is maker checker in banking?

Maker checker is a two-role control: the person who creates or changes a transaction cannot be the person who approves it. In a payments operation the maker keys or repairs the payment order and the checker verifies it for accuracy and authority before release. The FFIEC's examination handbook describes exactly this for the wire room: after the operator keys a payment order, "Before sending a payment order to the Federal Reserve Bank, a second staff member should verify it for accuracy and authorization" (FFIEC IT Examination Handbook, Funds Transfer Operations).

The handbook's examination procedures make the same point from the examiner's side. Among the things an examiner checks are that "Independent wire transfer personnel verify key fields before transmission" and that "Staff members independent of entering the messages release funds transfer messages" (FFIEC, Wholesale Payment Systems, Tier II examination procedures). Key fields, independent people, and release by someone other than the person who keyed it: those three phrases are most of the control.

Only after a second staff member reviews the payment order should a financial institution send it to the Federal Reserve Bank for processing.

FFIEC IT Examination Handbook, Wholesale Payment Systems

What is the four eyes principle, and how does it differ from dual control?

The four eyes principle is the general idea behind maker checker: two people must see a decision before it takes effect. Maker checker is its most common form in operations, with fixed roles and an order: one prepares, the other approves. Dual control is sometimes used for the same thing and sometimes, more strictly, for an action two people must perform together, such as opening a vault or releasing a password held in two halves.

The FFIEC uses dual control in the broader, separation sense. It asks whether a bank has dual control procedures that stop the people who receive transfer requests from also transmitting or accounting for them, and whether there are adequate dual controls over the review of payment orders (FFIEC, Tier II procedures). Whatever a bank calls it, the test an examiner applies is the same: could one person, alone, create and release a payment, or change one and release it?

Why do banks use dual control for payments?

Because the law puts the cost of a wrong payment on the bank that made it, and a second check is the cheapest insurance. Article 4A, which governs wire transfers, is direct about it. If a receiving bank executes its sender's payment order by sending it to a beneficiary different from the one in the order, and the transfer completes on that error, "the sender of the payment order that was erroneously executed and all previous senders in the funds transfer are not obliged to pay the payment orders they issued" (UCC 4A-303(c)). The bank keeps the loss and has to chase the money from the person who received it.

The same logic runs the other way when a bank has agreed a procedure with its client for catching errors. Under Article 4A, if a payment order sent under such a procedure was wrong in its beneficiary, its amount or as a duplicate, and the client shows it complied and "the error would have been detected if the receiving bank had also complied", the client does not have to pay for the error (UCC 4A-205). A control a bank promises and then skips moves the loss onto the bank.

Repair makes this sharper than ordinary wire entry. A repair desk is, by definition, changing a payment order the client sent, under time pressure, using evidence that the client did not supply in the order itself. A wrong format repair leads to another rejection. A wrong account repair leads to UCC 4A-303(c).

Why does a checker who re-reads tend to approve?

Because a value already on the screen changes what the checker is doing: instead of working out the answer, the checker is judging whether someone else's answer looks right, and a plausible account number almost always looks right. The research on double-checking in other safety-critical work points the same way, and it is more nuanced than "two people are better than one".

In a 2026 study of 198 people working in pairs on a simulated rail control task, "Independent double-checking was associated with greater response accuracy for identifying misrouted trains compared with collaborative double-checking", and accuracy was also greater for matching tasks than for critical analysis (McMullan et al., Applied Ergonomics, 2026). A misrouted train is a fair analogue of a misrouted payment, and comparing a re-keyed account with a proposed one is a matching task.

A randomised simulation trial with 82 nurses, published the same year, adds two warnings (Westbrook et al., BMJ Quality and Safety, 2026). Independent double-checking raised error detection only for experienced nurses, from 63.2% checking alone to 82.5%; early-career nurses gained nothing. And the trial found "social loafing": early-career nurses detected 26.0% more errors when they checked alone than when they acted as the first checker of a pair. Knowing a second person would look made the first person look less hard.

Neither study is about payments, and neither proves that a blind re-key will lift a bank's detection rate by a given amount; a bank should measure that on its own repairs, as the seeded-error test for payment validation explains. What they do show is that independence is the active ingredient, that experience matters, and that a second check can weaken the first. A check designed so the checker cannot simply agree addresses all three.

Maker checker in Payment Repair: maker, evidence, blind re-key, release

In Payment Repair the maker's role is split between agents and a person, and the checker's role is never given to an agent. The agents draft; the repairer owns the proposal; a different person checks and releases.

The hero case on the sample desk shows the timing. The repairer approved an IBAN correction at 2:44 p.m.; the checker opened it, saw the account as received and the client's six earlier payments to the same supplier, and typed the account herself. It matched, the proposal was revealed with the corrected digits marked, and she released the payment at 2:46 p.m.

The checker re-keys the changed value before she sees the proposal

A match, character for character, unlocks release

What should a checker verify?

A checker should verify the changed value against evidence the maker did not create, plus the few things that make a correct value dangerous. Reading the whole message again is less useful than verifying the key fields hard.

Can an AI be the maker in a maker checker process?

An AI agent can draft the maker's work, but a named person should own it and a different person should check it. That is the line Payment Repair draws: the repair agent proposes, the repairer is accountable for approving the proposal, and only people check and release. The agents may never release a payment, never change an amount and never clear a sanctions hit, and below a confidence threshold, 0.90 on the sample bank, they offer candidates instead of a proposal.

We found no U.S. rule written specifically for AI in payment operations, and a page that claims one should be read with care. What they have said about their own use of AI points the same way. Financial regulators told the GAO in 2025 that they used AI outputs alongside other supervisory information, and that AI neither made their decisions on its own nor served as their only input (GAO-25-107197, May 2025), the arrangement the guide to where AI agents stop under the remittance rule quotes in their words. An agent that drafts and a person who decides is the same arrangement inside a bank.

There is a second reason to keep the checker human: the evidence on double-checking says the check works when the checker is independent and experienced. An agent checking another agent's output from the same data is neither. A person re-keying from the client's own history is both.

Does maker checker slow payments down?

It adds minutes to some payments, and it should add them only where the risk is. Two design choices keep the cost down. The first is tiering: format and route repairs, which cannot send money to the wrong person, take one approval; the second person is reserved for changes to who is paid or how much. On the sample bank's month, account and bank-identifier repairs, which always go to a checker, were 9,635 of 28,904, about a third; format repairs such as structuring an address or adding a purpose code take one approval.

The second is making the check fast without making it shallow. Botminds estimates the second person's part of one account repair at about two minutes by hand and about a minute and a half with the evidence laid out beside the masked value; the saving is small because the re-key is real work. Most of the time in a manual repair goes earlier, on reading the rejection and finding the client's history, and that is where agents help. A blind check that takes ninety seconds is a better trade than a glance that takes ten and catches nothing. For the dollars behind those minutes, see what each repair costs; for where the rest of the desk's time goes, the specialist's day by the clock.

Separation of duties beyond the pair

A maker checker pair is one control in a wider separation of duties, and the gaps usually appear at its edges. The sample bank's settings show where to look. The same person is never repairer and checker on one repair, drafter and approver of a client message, or the administrator who changes a setting and the manager who approves it. Settings that change who needs a checker, such as the confidence threshold or the amount above which the manager checks too, are themselves maker checker changes, and the audit trail shows each with its change request.

Internal audit sits outside all of it, reading everything and changing nothing. That is the FFIEC's other expectation: that people not involved in the receipt, preparation or transmittal of funds review the reject and exception reports. A control a bank can show from its own trail, without reassembling it from four systems each quarter, is one an examiner can test.

Questions people ask

Is maker checker required by regulation?

We know of no U.S. regulation that uses the phrase, but examiners expect the control. The FFIEC's handbook expects a second staff member to verify a payment order before it is sent and independent staff to verify key fields and release messages, and Article 4A puts the loss from a wrongly executed payment on the bank.

Can the maker and the checker be in the same team?

Yes, if they are different people with different roles on that payment. What matters is that the checker did not prepare the change and cannot release their own work. In small banks where full separation is hard, the FFIEC points to compensating controls such as rotation of duties and officer review.

What is a blind re-key?

A blind re-key is a check in which the second person types the critical value from the source evidence without seeing the first person's value, and the system compares the two. It turns the check from agreeing with an answer into producing one, which is what independent double-checking means in the safety research.

Should a checker re-check format repairs too?

Usually not, if the format repair cannot change who is paid or how much and the repaired message is validated and screened again. Sending every repair to a checker spreads the checker's attention thin and slows the payments that carry no beneficiary risk.

What happens when the re-key does not match?

The payment does not move. In Payment Repair the checker rejects it with a reason code and it goes back to the repairer, who looks at the evidence again or returns the payment to the client. A mismatch is the control working, not a failure of the process.

To see the masked proposal, the re-key and the release on the sample bank, start from Payment Repair.