Ask who can release a payment alone, and most offices answer from the policy. The answer that moves money is in two documents the bank holds: the signature mandate, which lists who may sign and how many signatures a payment needs, and the entitlement report from online banking, which lists who can create a payee, enter a wire, and approve it. Read them, bank by bank, and compare them with the policy.
Why the policy and the bank drift apart
The policy is written once. The bank’s set-up changes every time someone touches it.
Banks are added. A new entity opens an account at a new bank, and its mandate is signed on the day, with whoever is in the room. A third of family offices manage 50 or more bank accounts (BofA Private Bank, 2025). Each one carries its own mandate.
Signers change. A controller leaves, a family member joins the board, a trustee is replaced. The policy is updated. The mandate at each bank is updated only if someone sends the bank a new form.
Entitlements are set by one person. Online banking has an administrator. That person decides who can approve, at what limit, and whether one approval is enough. Often the administrator also sends wires. Unless someone asks, nobody reviews the settings again.
The test: six questions for each bank
Ask each bank for its current signature mandate and its online-banking entitlement report. Then put six questions to them.
- Signers. Who is on the mandate today, and does every name still work for the office?
- Approvals. How many approvals does the bank enforce on a wire, and at what amount? Does that match the policy?
- Payees. Who can add or change a payee’s bank details? Can that same person approve a payment to the payee?
- Former staff. Does anyone who has left still hold a login, a token, or a place on the mandate?
- Callback. Before a new or changed payment instruction is used, does someone call the payee back on a number already on file, not the number in the email?
- Cards and checks. What are the card limits, and who can sign a check alone, up to what amount?
Write the answer to each question beside what the policy says. Where the two differ, the bank’s answer is the one that moves money.
What the federal standards say
NIST’s guide for small organisations is direct: “do not allow a single individual to both initiate and approve a transaction,” and it applies the rule to executives too. It also asks for a call back on a known number (NIST IR 7621 Rev. 1, 2016).
The FDIC’s examination procedures for funds transfer ask whether originating, testing and approving a transfer are held by different people, whether each person’s amount is limited, whether authorised signers are kept few, and whether callbacks go beyond a signature check (FDIC, funds-transfer procedures). Those are the questions examiners put to banks. They work as well on an office.
FinCEN’s 2019 notice on business email compromise reports that filings about it rose from about 500 a month in 2016 to more than 1,100 a month in 2018, and points to multi-step verification over separate channels: a call to a known number, not a reply to the same email (FinCEN FIN-2019-A005, 2019).
The numbers, and what each one asks of you
- More than a third of family offices send 100 or more wires or payments a month, and 14% send more than 500 (BofA Private Bank, 2025 Family Office Study, n=335). At that volume nobody reviews each one by eye. The bank’s approval setting is the review. Check that it is on.
- 39% of offices have experienced fraud (BofA Private Bank, 2025). Two controls are cheap: a second person on every payee change, and a callback to a number already on file.
- The FBI’s Internet Crime Complaint Center recorded $3,046,598,558 in business email compromise losses across 24,768 complaints in 2025 (FBI IC3, 2025). In the same year its Recovery Asset Team froze $679 million of the $1.164 billion it attempted to recover. If a wire goes wrong, call the bank and file with IC3 the same day.
A worked example
The office below is fictitious. It is the office used in the Controls Check specimen, and every bank, name and setting is invented. Its payments policy requires two approvals on any payment over $25,000.
| Bank (fictitious) | Signers on mandate | Approvals the bank enforces | Approvals the policy requires | Also found |
|---|---|---|---|---|
| Bank A | 3 | 2 | 2 | The person who adds a payee can also approve the payment |
| Bank C | 4 | 1 | 2 | A former employee still has view access |
| Bank E | 3 | 1 | 2 | – |
Banks B and D enforce the policy and are left out.
At Bank C, any one of four people can release a wire alone. At Bank E, any one of three. The policy is the same at both, and neither bank enforces it. At Bank A, a single person can enter new bank details for a payee and then approve the payment to them, which is a path an email compromise uses. The former employee at Bank C cannot move money, but can see every balance and payee, which is what a convincing fake instruction is built from.
None of this needs a new system to find. It needs two documents from each bank, read beside the policy.
What it would take
Settings, not systems. At each bank, in the bank’s own administration screen or on its own form:
- Set dual approval on wires and new payees, at an amount the policy names. At Bank C and Bank E, that is one setting each.
- Separate payee changes from payment approval. Whoever adds or edits a payee is not the one who approves the first payment to it.
- Remove former staff from the entitlement report and from the mandate, and ask the bank to confirm in writing.
- Write the callback into the policy: a new or changed instruction is confirmed on a number already on file, before the first payment.
- Ask each bank for the mandate and entitlement report once a year, and read them against the policy again.
The person who runs online banking does not have to be distrusted for any of this. The point of a second approver is that no one has to be trusted alone.