Is it advisable to allow commercial customers to have bill pay. We just realized we have some that already have bill pay and or using it.

There is no reason they can't. Do a risk assessment though of commerical customers using bill pay so the auditors don't slight your assessment given what you already know is happening.

Include in that risk assessment the potential for user (the individual(s) at the business) fraud. If the business now has reasonable controls to prevent a bookkeeper, for example, from issuing checks to fraudulent payees including himself, where do those controls go if the bookkeeper has access to the bill pay system? Do you have dual control (separate user verification before commit) capabilities?