Entitlements in banking are the permissions a bank grants each user of a business client's online banking: which services the user may reach (ACH, wires, positive pay, remote deposit), on which accounts, with which functions (view, initiate, approve, release, administer), and up to what amount. They are the working definition of who may move a business's money. That makes every entitlement change a payment-risk decision dressed as an administrative one, and it is the core of the maintenance queue a treasury management client services team works. Botminds' Treasury Management Client Services reads each entitlement request against the client's own agreement and limits, cites what it found, and leaves the change to two people: one who makes it and one who approves it.
The examples come from a fictional credit union running the solution on sample data, and from one fictional business member, a millwork manufacturer with two administrators and seven users. The case law and guidance are real and linked.
One business client's entitlements: four users, four very different powers
| User and role | Services and functions | Approval limit | What the user can do alone |
|---|---|---|---|
| Marguerite Ellis · Controller | Administrator · ACH approve · wire approve | $150,000 | Add users and set entitlements, subject to the agreement; approve ACH files and wires up to the limit |
| Owen Shaw · Owner and Member-Manager | Administrator · ACH approve · wire release | $100,000 | Release wires up to the limit; countersign a wire release entitlement for someone else |
| Priscilla Hahn · Accounts payable | ACH initiate · remote deposit | $60,000 | Build ACH files and deposit checks; nothing leaves without an approver |
| Eli Brandeis · Accounts payable | ACH initiate | $60,000 | Build ACH files only |
What are entitlements in banking?
An entitlement is a grant with four parts: a user, a service, the accounts it covers and the functions allowed, usually with a dollar limit attached. "Wire release up to $100,000 on the operating account" is one entitlement; "ACH initiate on the payroll account" is another. A business client's setup is the set of all of them, and the bank's digital banking administration system is where they live.
The functions are where the risk sits. View-only is information. Initiate means a user can build a payment but not send it. Approve and release mean the user can send money, alone or as the second of two. Administer means the user can create other users and grant them entitlements, which makes an administrator's entitlement the one that governs all the others.
Limits ride on top. A per-approver approval limit caps what one user may approve; a daily ACH exposure limit, set by the bank's credit process, caps what the whole client may originate; a wire release ceiling caps a single release. An entitlement request often touches all three at once, which is why a request to raise an ACH limit is rarely as simple as it reads.
Entitlements banking definition: one line for the procedures manual
For a procedures manual, a usable definition is: an entitlement is the permission, granted by the bank on the authority of the client's own documents, for a named user to perform a named function on a named service and account, within a stated limit. Each clause of that sentence is a check a maintenance specialist can make.
"Granted by the bank" means the change happens in the bank's system and the bank owns the trail. "On the authority of the client's own documents" means the corporate resolution, the cash management agreement and the authorized-user forms decide who may ask, not a familiar name in an email. "A named user" means no shared logins. "Within a stated limit" means the limit is part of the entitlement, not a separate conversation.
Rejected by entitlement: what the message means
"Rejected by entitlement" and similar messages generally mean the system refused an action because the user lacks the entitlement for it: the service, the account, the function or the amount. A user who can initiate an ACH file but not approve it, or who is approving above their limit, sees exactly that. It is the control working, not a fault.
The fix is an entitlement change requested by someone authorized to request it, and that is where the risk enters. A business whose payment run has just been rejected is under time pressure, and an urgent email asking the bank to "just add approve rights for today" is the most natural-looking forged request there is. The same verification applies to a rushed change as to a planned one.
Who can change user entitlements in business online banking?
Two routes exist, and the client's agreement decides which applies. Under self-administration, the client's own administrators add users and set entitlements inside online banking, within the services and limits the bank has set up for the client. Under bank administration, the client asks the bank, and a specialist makes the change in the administration system after verifying the request.
Many commercial relationships use both: day-to-day user changes by their administrators, and anything that widens the envelope (a new service, a higher limit, wire release, a new administrator, a changed callback contact) by request to the bank. The sample agreement adds a further rule: a wire release entitlement is designated by one authorized administrator and countersigned by a second. A request that arrives with one name cannot be completed, whoever sent it.
Who may ask, and what each user may do, on one screen
Dual control in business online banking, on the client's side
Dual control on the client's side means a payment, or a change to the client's own setup, needs two of the client's users: one to initiate and another to approve or release. The FFIEC's 2021 authentication guidance lists it among the controls banks make available to business customers: a setting that makes certain transactions need a second employee's approval (FFIEC, Authentication and Access to Financial Institution Services and Systems, 2021). A corporate account takeover policy quotes the control and builds it into the client's side of the agreement.
Entitlements are how dual control is built. If two users each have initiate and approve on wires, with a rule that the initiator cannot approve, the client has dual control. If one user has initiate and release with no second step, it does not, however many users exist. An entitlement change that quietly gives one person both halves can undo a client's dual control without anyone deciding to.
What happens if a business waives dual control?
If a business declines dual control in writing after the bank offers it, the loss from a fraudulent order can stay with the business. The Eighth Circuit's decision in Choice Escrow is the clearest example. The bank offered dual control; the escrow company declined it and signed a waiver. When the company later asked whether the bank could limit wires to foreign banks, the bank recommended dual control again, and the company declined again. A phishing attack then gave a fraudster an employee's credentials, and a $440,000 wire went to a bank in Cyprus.
"Choice declined the use of dual control and signed the requisite waiver."
Choice Escrow & Land Title, LLC v. BancorpSouth Bank, U.S. Court of Appeals for the Eighth Circuit, 2014
The court held the bank's procedures, "which included password protection, daily transfer limits, device authentication, and dual control, were commercially reasonable" (8th Cir. opinion). Article 4A provides the mechanism: a procedure the customer chose after turning down a commercially reasonable one the bank offered is deemed commercially reasonable, provided the customer agreed in writing to be bound by orders accepted under it (UCC § 4A-202(c); the commercially reasonable security procedure test walks through each factor). The opinion even quotes the bank officer's reply to the company: "We always recommend dual control on wires."
For a maintenance desk the lesson runs both ways. The waiver and the version of the entitlement setup in force on the day are evidence, so they must be on file and findable. And a request that would remove a second approver is a request to change the client's security procedure, which deserves the same verification as adding wire release. How a corporate account takeover policy allocates that loss follows the liability side in more detail.
Maker and checker on the bank's side
The bank's own staff need dual control too, because a specialist who can create a user with release rights holds the same power as the client's administrator. The FFIEC guidance describes the bank-side control in its section on privileged users: "More than one privileged user at the financial institution must approve access to certain critical systems or certain requests for administrative changes" (FFIEC, 2021). An entitlement change for a business client is an administrative change with direct payment consequences.
Two kinds of dual control around one entitlement: the client's and the bank's
On the client's side: Two of the client's users: an initiator and an approver, or two administrators
On the bank's side: Two bank staff: the specialist who makes the change and a second who approves it
On the client's side: Each payment the client sends, and changes the client's administrators make
On the bank's side: Each change to users, entitlements, limits and contacts the bank makes on request
On the client's side: An entitlement change that gives one user both halves, or a waiver
On the bank's side: A maker who can approve their own change, or a checker who sees only a summary
On the client's side: The client, under the agreement; the bank offers it
On the bank's side: The bank's own procedures, for every change type
On the client's side: The entitlements in force and any signed waiver
On the bank's side: Two names, two times, and what the approver saw
Maker and checker only works if the checker is checking something. A second specialist who approves a ticket reading "user added per client email" has added a name, not a control. The checker needs the original request, the authority found, how it arrived, the callback and its answer, and the before and after values. The maker checker process in a payments repair queue makes the same point for payment fixes: the checker must work from the source, not from the maker's summary.
Which entitlement changes carry the most risk?
Not every entitlement change deserves the same treatment, and a desk that treats a view-only user like wire release will either slow to a crawl or start skipping steps. Ranking change types by what they let someone do with money gives each one a proportionate check, written down rather than left to the specialist on duty.
Entitlement changes ranked by what they let someone do with money
- A new administrator, or an administrator removed
Governs every other entitlement. The sample credit union verifies it by callback and requires a countersignature.
- Wire release, or a payment-release right of any kind
Lets one user send money. Always verified by callback; approved by the supervisor, not only a second specialist.
- A limit increase
Verified by callback and checked against the approved exposure; a rise above it goes to credit, not to maintenance.
- A change to a callback contact
Changes who answers every later verification. Verified on the number already held, never the new one.
- Removing a second approver
Undoes the client's dual control. Treat it as a change to the security procedure.
- A new initiator or a user removed
Lower risk, but removals matter: a departed user who keeps rights is the classic gap.
- A view-only user
Information only. The sample rules require no callback.
Seven agents check, two people decide
In Treasury Management Client Services the agents do the reading that a careful specialist would do and rarely has time for, and they stop short of the change. The authority agent reads the resolution, the agreement and the entitlements on file and reports the clause, down to the countersignature a wire release needs. The limits agent compares the requested limit with the approved exposure, wire ceiling and remote deposit limit. The change drafter prepares the exact entitlement change with before and after values. Then people take over.
An entitlement change in Treasury Management Client Services: agents propose, people decide
Agent
Authority agentReads the corporate resolution, the agreement and the entitlements on file; says whether this requester may ask for this change and cites the clause.
Never: treats a name it recognizes as authority without the document behind it
Agent
Limits agentChecks the requested limit against the approved ACH exposure, wire ceiling and remote deposit limit, with the last review date and the highest day used.
Never: raises a limit
Agent
Change drafterPrepares the exact change for digital banking administration, before and after side by side.
Never: submits a change
A person decides
Specialist (maker)Decides with a reason code and submits the change.
A person decides
Second specialist or supervisor (checker)Reads the same checks and values, then approves; payment-release entitlements go to the supervisor.
Never: approves a change they made
The routine case shows the value as clearly as the fraud case. A freight client asked to remove its leaving controller and move his ACH approval to the finance director. The drafted change showed the controller removed with access ending that day, the second-approver role moving to the finance director, the approval limit for that role staying at $250,000, and the daily ACH debit exposure unchanged at $600,000. Nothing in it widened the client's envelope, and the screen said so before anyone submitted it.
An entitlement change drafted with before and after, waiting for a second name
The design rule underneath is that an entitlement change never takes effect on one person's action, and the agents never take it at all. Where agents belong in banking operations, and where they do not, sets out why that line is drawn where it is.
Questions people ask
What is the difference between an entitlement and a limit?
An entitlement says what a user may do; a limit says how much. In most systems the limit is attached to the entitlement, so "approve ACH up to $150,000" is one grant. Separate client-level limits, such as a daily ACH exposure limit set by credit, cap the whole client regardless of any one user's entitlement.
Can one person approve their own entitlement change?
They should not be able to, on either side. On the client's side, an administrator who grants themselves a release right defeats dual control; on the bank's side, a specialist who approves their own change defeats maker and checker. Both should be prevented by the system, not only by policy.
Are entitlements the same as authorized signers?
No. Signers are named on the signature card and the resolution for the account; entitlements are online banking permissions for users. A signer may have no online access at all, and a user with release rights may not be a signer. Authorized user vs authorized signer works through the differences.
Who should be able to grant wire release?
Whoever the client's agreement names, in the way it names them. In the sample agreement it takes one authorized administrator to designate and a second to countersign, and on the bank's side a supervisor approves any payment-release entitlement. A single email from one administrator is not enough under that agreement.
How often should business banking entitlements be reviewed?
No regulation sets a single interval for a client's users; banks set their own, often annually and on events such as a departure or a reorganization. What matters is that each review compares the users and rights in the system with the client's current authorized-user list, and that removals get the same verification as additions.