Treasury Authority and Bank Signer Controls: The Fraud Risk Buyers Notice Fast

Treasury authority is where finance controls become real. A company can have a polished <a href="/insights/management-package-buyers-trust" class="subtle-link">management package</a> and still expose itself to avoidable risk if former employees remain on bank portals, one person can both create and approve payments, or vendor bank changes are accepted without independent verification.

For adjacent context, compare this with Vendor Onboarding and Vendor Master Controls, Accounts Payable Discipline, and Merchant Processing Fees and Chargeback Economics. Those articles cover vendor setup, payment timing, and customer payment realization; this article focuses on treasury authority and cash-movement permissions.

For founder-owned businesses, the problem often starts for practical reasons. The founder is the only signer. The controller has broad access because someone had to get payments out. A backup user was created during a vacation and never removed. None of that feels material until a buyer, lender, insurer, or fraud event asks who had authority over cash.

The treasury authority map

The first step is to separate legal authority from system authority. A signer list shows who the bank recognizes. A bank portal export shows who can actually log in. Payment settings show whether that person can view balances, create payments, approve payments, release ACH files, edit templates, or change administrative rights.

A useful map covers every account and every payment rail. Include operating accounts, payroll accounts, sweep accounts, credit lines, lender portals, lockbox access, merchant settlement accounts, and any account used only occasionally. Dormant or low-activity accounts are often where outdated access survives.

What buyers test

Buyers usually care less about the bank relationship itself than the control evidence around it. They want to see whether access is current, whether payment authority is segregated, whether former employees have been removed, whether emergency overrides are documented, and whether someone other than the founder can operate treasury after closing.

A clean file is straightforward: current bank signer list, bank portal user export, payment approval matrix, positive pay or equivalent fraud controls, vendor bank change procedure, lender portal user list, and evidence that access is reviewed periodically. The absence of that file does not usually kill a deal, but it creates avoidable diligence friction.

Build the payment approval and segregation matrix

Payment control should separate vendor creation, bank-detail maintenance, invoice approval, payment preparation, bank release, and reconciliation wherever staffing allows. A lean finance team may not achieve perfect separation, but it can add compensating review by someone outside the transaction path and make every exception visible.

Thresholds should account for both individual and aggregate exposure. Ten payments just below an approval limit should not escape review. Define single-payment, daily batch, new-recipient, cross-border, related-party, payroll, tax, and manual-wire rules separately where the risk differs.

Defend against payment fraud and bank-change attacks

Payment fraud often begins outside the bank portal. An attacker compromises email, impersonates an executive or vendor, changes invoice instructions, or pressures an employee to bypass normal timing. Multi-factor authentication helps but does not validate that the recipient account is legitimate.

Employees should have a clear stop-work rule: unusual urgency, secrecy, changed instructions, new geography, mismatched sender domain, bypassed approver, or resistance to callback means pause and escalate. Management should reward the pause even when the request proves legitimate.

Run payment-fraud tabletop tests involving the bank, insurer, IT, finance, legal, and communications owners. The response plan should cover account freeze, bank notice, transaction recall, credential revocation, email preservation, insurer notice, law enforcement or regulator analysis, customer or vendor communication, reconciliation, and lessons learned.

Create the recurring treasury control file

Treasury evidence should be produced through the normal close and quarterly control cadence. Waiting for diligence to request portal screenshots creates a rushed exercise and may reveal that the legal signer list, portal access, and internal authority matrix disagree.

Day 1 transaction planning should identify which signers change, whether accounts remain open, who can fund payroll, how debt is repaid, when buyer users receive access, and how seller access is revoked without interrupting operations. The closing funds flow and ordinary operating treasury transition should be coordinated but separately controlled.