When an employee leaves, most organizations have a well-established offboarding process. HR handles the paperwork, IT shuts down email and network access and equipment is returned. But one area can easily fall through the cracks: payment access.
An employee may no longer have access to their company email but could still have permissions tied to ACH origination, wire transfers, corporate cards, check signing, instant payments or a treasury management platform. In today's increasingly connected payments environment, removing a network login doesn't necessarily remove the ability to move money.
For financial institutions, helping business clients close those gaps is an important part of managing payment risk. Here are several steps to consider when offboarding a user.
1. Start with a complete inventory of payment access
The first step is knowing where the employee has access. Don't limit the review to the primary online banking platform. Look across every payment channel the employee may have used, including ACH, wires, checks, cards and instant payments.
For example, an employee who served as a company's controller might have been an ACH originator and wire approver, an authorized check signer and a corporate cardholder. Each of those permissions may be managed in a different system or by a different department.
Depending on the circumstances of the departure, the business should review recent transactions for unusual activity. Pay particular attention to large ACH transactions, wires, internal transfers, new payees, changes to vendor information or employee direct deposit information, newly linked external accounts, unusual check activity and transactions occurring immediately before termination.
A good offboarding process should identify what the employee could do, not simply which systems they could log into.
2. Review permissions, not just usernames
Once access has been identified, review the employee's actual entitlements. Could they initiate an ACH file? Approve a wire? Issue and/or approve checks? Create bill payments? Add a new beneficiary? Release an instant payment? Manage other users?
This distinction matters because payment permissions can be more granular than a basic login. In some cases, an employee may retain a specific approval or administrative capability even after other access has been removed.
It's also worth reviewing payment limits and approval roles. If a departing employee was one of two people required to approve wires or ACH transactions, for example, the organization needs to make sure the remaining workflow still works and still provides appropriate separation of duties.
If the employee has payment entitlements, you may also need to review pending and scheduled transactions. Consider whether any transactions should be canceled or reapproved by another authorized employee. These transactions could include pending ACH and wire transfers, vendor payments, payroll files, recurring payments, future-dated transactions or transactions awaiting approval.
3. Don't overlook cards, checks and other physical access
Digital payments tend to get most of the attention, but traditional payment methods deserve a place on the checklist.
Corporate cards should be deactivated or reassigned as appropriate, including virtual cards and access to expense-management systems. For checks, confirm whether the employee remains an authorized signer and whether any related Positive Pay or account permissions need to be updated.
These may seem like straightforward administrative tasks, but they are easy to miss when different payment channels are managed by different teams.
4. Pay particular attention to instant payments
Instant payments add another reason to make access reviews timely. With services such as the RTP® Network, the FedNow® Service and Zelle for business, payments can be initiated and settled around the clock, so an employee's payment authority shouldn't remain active simply because the departure occurred outside normal business hours.
As financial institutions and businesses expand their use of instant payments, they should make sure those permissions are incorporated into the same offboarding process used for ACH and wire access.
The goal isn't to create a separate process for every new payment rail. It's to have one comprehensive access-management process that includes every rail.
5. Review administrators and delegated access
Some of the most important access isn't tied to someone who routinely initiates payments. An employee may be a treasury management administrator, backup approver or delegated user with the ability to change other users' permissions.
These roles deserve particular attention. A departing employee who can add users, change limits or modify entitlements may represent a very different risk than someone who can only view account information.
The same principle applies to third parties. Payroll providers, accountants, bookkeepers and other service providers may have payment access that needs to be reviewed when responsibilities or relationships change.
6. Use offboarding as an opportunity to clean house
An employee departure can also be a useful trigger for a broader access review.
Maybe the company has grown since its treasury services were originally established. Maybe an employee who once needed broad access now only needs one payment channel. Or perhaps several people have administrator privileges even though only one actually needs them.
Rather than simply replacing the departing employee's access, take a few minutes to ask whether the overall structure still makes sense.
This is also a natural opportunity for financial institutions to have a broader conversation with business clients about dual control, approval limits, alerts and other payment controls.
Also review the employee’s access through other employees. For example, if Sally leaves but Joe remains an authorized user, Sally may have previously known Joe’s credentials, had access to a shared email inbox, or a shared token.
Business clients should ensure that each remaining user has their own credentials and authentication method and that shared credentials are eliminated where possible.
Make payment access part of the offboarding checklist
Offboarding shouldn't end when an employee's email account is disabled. For organizations that move money across multiple payment channels, it should include a review of every place that an employee could initiate, approve, modify or influence a payment.
ACH, wires, checks, cards, bill payments and instant payments may operate differently, but they share one important characteristic: they depend on the right people having the right access.
For financial institutions, helping clients establish a consistent, cross-channel offboarding process can do more than reduce risk. It can strengthen treasury management relationships by helping businesses take a more holistic view of how their money moves and who has the ability to move it.
|
|
New to payments regulations or looking to strengthen your foundation? Join us November 17 for Virtual Regulation E Day Camp to explore the fundamentals of Regulation E, including key terms and timeframes, stop payments, error resolution and real-world scenarios. Plus, EPCOR members who register three employees can get a fourth registration FREE!
|