Authorized user vs authorized signer: five myths about who may ask

An authorized signer is a person the business names on the signature card and in its corporate resolution as able to sign checks and give instructions on a deposit account; an authorized user is a person given access to the business's online banking, with entitlements that say what they may view, initiate, approve or release. The two lists overlap but are kept separately, and neither title alone decides who may ask the bank for a treasury change such as a new user, a higher limit or wire release. That is set by the business's cash management agreement and the administrators it names. Botminds' Treasury Management Client Services reads the resolution, the agreement and the users on file for every maintenance request and cites the clause that answers the only question that matters: may this person ask for this change?

The examples use a fictional credit union and a fictional business member, a millwork manufacturer, as they appear in the solution's sample data. The law quoted is real.

Authorized user vs authorized signer, in one table

Five different roles get called "authorized" on a business relationship, and each is named in a different document. Mixing them up is how a bank ends up taking an instruction from someone the client never empowered to give it.

What is an authorized signer?

An authorized signer is someone the business has authorized, usually by corporate resolution, to sign on its deposit account: to sign checks, endorse, and give the bank instructions about that account. The resolution is the business's own decision, adopted by its board or members, naming the people and often the limits; the signature card carries their specimen signatures. "Authorized signatory" means the same thing in banking use.

The resolution matters for treasury work because it is the root of authority. It is where the business says who may open accounts, sign agreements and appoint the administrators for online banking. A treasury maintenance desk reads it to answer "who may ask", but the answer usually lands one document further down, in the cash management agreement.

What can an authorized user do on a business bank account?

An authorized user can do exactly what their entitlements allow and nothing else: perhaps view balances, perhaps build ACH files, perhaps approve them up to a limit, perhaps release wires. The sample client has seven users; two of them, accounts payable staff, may initiate ACH up to $60,000 and one of them may also deposit checks remotely, but neither can approve or release anything. A user's entitlements are set by the business's administrators or by the bank on a verified request. How entitlements are built sets out the parts of each grant.

Myth 1: a signer can ask for any change on the account

A signer can instruct the bank on the deposit account; that does not make them authorized to change who may use the business's online banking. The sample client's agreement is explicit about how a maintenance instruction must arrive: through the secure message center, from the email address of an authorized administrator recorded with the credit union, on a signed service change form, or in person at a branch. A signer who is not an administrator, writing from any address, is outside that clause.

The distinction protects the client as much as the bank. A business may want its bookkeeper to sign checks without giving her the power to create a user with wire release, and the agreement is where it says so. A desk that treats every signer as an administrator overrides that choice without asking.

Myth 2: if the signature matches, the request is genuine

A matching signature proves that someone had a copy of the signature, which every cancelled check and signed contract provides. Article 4A writes that limit into its definition of a security procedure, the procedure a bank and a business agree on to verify payment instructions: checking a signature against the specimen on file does not, on its own, count as one (UCC § 4A-201). The commercially reasonable security procedure test quotes the section and shows how courts apply it.

A signed service change form is still an allowed channel in many agreements, including the sample one; what it is not is proof by itself. The form tells the desk who claims to have asked; the callback to the number already on file tells it whether they did. What the callback must prove covers that second step.

Myth 3: an online banking administrator must be a signer

Administrators are appointed under the online banking or cash management agreement, often on a separate form, and many are not signers at all. A controller who runs payments may administer the company's online banking without signing checks; an owner who signs everything may never log in. In the sample client both administrators happen to be senior: the controller, an administrator since March 4, 2021, and the owner, since June 2, 2019. The bank's file records each date because the date an administrator was added is evidence of authority on the day of a request; who signs each part of a treasury management agreement shows where those appointments sit in the document stack.

The FFIEC's 2021 authentication guidance treats a grant of new powers as a moment to re-verify:

"Identity verification also occurs periodically thereafter based on risk factors, such as the granting of new authorities or access rights to a user within an information system."

FFIEC, Authentication and Access to Financial Institution Services and Systems, 2021

Making someone an administrator is the largest new authority a business can grant in online banking, which is why the sample credit union verifies an administrator change by callback and requires a countersignature.

The clause that answers who may ask, opened from the check that relied on it

Myth 4: the owner can always tell the bank what to do

A business acts through the people its documents name, and ownership alone is not one of those documents. The customer due diligence rule defines beneficial owners for identification purposes: anyone holding a quarter or more of the equity, plus one person with significant responsibility for running the business (31 CFR 1010.230(d); the ownership test is worked through in how to calculate beneficial ownership percentage, the control person in the beneficial ownership certification). The bank identifies those people to know its customer; the rule does not make them authorized to instruct the bank.

An owner who wants to make changes does so by being named, as a signer in the resolution or as an administrator under the agreement, or by having the business change those documents. Until then, a request in the owner's name from outside the agreement's channels gets the same answer as anyone else's. Impersonating an owner or executive is a pattern FinCEN has warned banks about for exactly this reason: staff defer to the boss, and so do some desks.

Myth 5: removing a signer removes their online access

Signer lists and online banking users live in different systems and change through different requests. When a controller leaves, the business may update the signature card at the branch and never think about the online banking user that still has approval rights. The sample queue that Tuesday included a freight company removing a leaving controller and moving his ACH approval to the finance director, a request that only exists because someone at the client remembered both lists.

The reverse is also true: adding a signer does not create a user. Treating the two as one change in either direction leaves a gap, and the gap that matters is the departed person who still holds an entitlement. Signer changes on deposit accounts are a deposit-operations request; account maintenance requests covers that side of the work.

Corporate resolution bank account authorized signers: what the resolution decides

The resolution decides who may act for the business with the bank, and it is only as current as the business keeps it. It typically names the signers, any dollar limits or dual-signature rules, and who may enter into agreements such as the cash management agreement. When officers change and the resolution does not, the bank holds a document that authorizes people who have left.

For a treasury desk, the practical rule is to read the resolution and the agreement together, and to treat any request that relies on a person absent from both as unverified, however senior the title in the signature block.

Who can request changes to a business bank account?

The people the business's documents name for that kind of change, through a channel those documents allow, verified by the bank in the way its rules require. For deposit account changes, that is usually a signer under the resolution. For treasury changes (users, entitlements, limits, services, callback contacts), it is usually an administrator under the cash management agreement, sometimes two. FinCEN's business email compromise advisory describes what criminals exploit in exactly these terms: weak processes for confirming who is on the other end of a message, for authorizing payments, and for passing on changes to payment details (FinCEN Advisory FIN-2019-A005; how banks verify wire transfers quotes the advisory).

Reading those documents in the right order is most of the work, and it is the order the authority agent follows. The resolution says who acts for the business; the agreement says who may ask for treasury changes and how; the administrator forms and the users on file say what each person holds today. Only then does the question of this particular request make sense.

The agents check that list on every request; a specialist decides, and a second approves. Why the administrator is the role fraudsters most want to impersonate follows the same question from the attacker's side. To see the authority check on a live request, start from Treasury Management Client Services.

Questions people ask

What is the difference between an authorized signer and an authorized signatory?

In banking use, none: both mean a person authorized to sign on the account, usually named in a corporate resolution with a specimen signature on file. "Signatory" is more common in formal documents and outside the United States.

Can an authorized user add another user?

Only if their entitlements include administration. An ordinary user can act within their own rights but cannot grant rights to anyone else; administrators can, and some changes need two of them under the agreement.

Who can be a signer on a business account?

Whoever the business's governing body names in its resolution, subject to the bank's own identification requirements for those individuals. Owners, officers and employees are all common; the resolution, not the job title, is what gives the authority.

Is a signer the same as an online banking administrator?

No. A signer is named for the deposit account; an administrator is named under the online banking or cash management agreement. One person can be both, but each role is granted separately and should be removed separately.

Does a beneficial owner have to be a signer?

No. Beneficial owners are identified under the customer due diligence rule so the bank knows who owns and controls the business; they need not sign, use online banking or have any role on the account.