Your Business Banking Security Checklist

Change is one constant you can always count on when running a business. From staff and vendor changes to market shifts and new business goals, your business is always evolving. 

That makes it important to regularly check in on your banking structure and security permissions. Are they up to date, or should you make some changes? 

We’ve put together this checklist to help you get started. 

Do You Still Have the Right Banking Services? 

• Inventory all your current online banking and Treasury Management services.
• Confirm whether your business still uses and needs each service.
• Ask about removing services that no longer fit your business needs. 

Leaving unnecessary services active may create additional opportunities for fraud. 

Does Your Team Have the Right Access? 

• Make sure employees can access only the services they need for their roles.
• Review each user’s permissions and level of authority.
• Remove banking access for former employees and inactive users.
• Review access for accountants, payroll providers, consultants and other third parties. Remove access that is no longer needed.
• Confirm users are not sharing credentials, security tokens or devices. 

Are Your Transaction Controls Still Appropriate? 

• Review ACH, wire and other transaction limits.
• Lower transaction limits that exceed your business needs.
• Confirm who can initiate and approve transactions.
• Require separate users to initiate and approve ACH and wire transfer transactions when appropriate.
• Ensure no single user has more authority than necessary.
• Review who can create or change payment templates, beneficiaries and payees.
• Remove outdated ACH and wire transfer templates, beneficiaries and payees.
• Verify recurring payment instructions. 

Are Your Security Settings and Alerts Up to Date? 

• Confirm multifactor authentication is enabled for all users.
• Verify that security tokens, devices and phone numbers are assigned to the correct users.
• Ask your bank about additional authentication options for higher-risk transactions.
• Review transaction and security alert settings.
• Make sure alert thresholds are appropriate.
• Confirm alerts are sent to people who will review and act on them.
• Ensure the bank has proper contact information for everyone who will receive alerts, including cell phone numbers for one-time passcodes.
• Review available alerts, including:
  • New payees
  • Password changes
  • Unusual transactions
  • Wire activity
  • ACH activity 

Can Your Bank Reach the Right People? 

• Verify that all phone numbers and email addresses your bank has on file are correct.
• Verify that cell phone numbers used to receive one-time passcodes are current.
• Update contact information for online banking administrators and users.
• Confirm your bank knows who to contact if suspicious activity is detected. 

Does Your Team Know How to Respond? 

• Confirm that your employees know who they can contact at the bank and how to report suspected fraud.
• Create an internal process for reporting and escalating concerns.
• Remind your employees to act quickly if they notice suspicious activity, compromised credentials or an unusual payment request. 

Complete this checklist at least once a year and whenever staffing or business operations change. 

If you need any assistance completing this checklist for your business, our Treasury Managers are here to help!