Does anyone allow shared access for online banking purposes? For example, our business banking system allows a business owner to "share" online access with individuals of their choice, such as a CPA. This individual is not required to have a role on the business account, but will have the capability to perform wire transfers and move funds via ACH through the online banking system. The business assigns certain authorizations to this individual and provides a password and username for the CPA to use. I am concerned with CIP and OFAC compliance since this "shared user" is not known to us. I am interested to know if others are using this feature and how you became comfortable with the process. Thank you!!

The CPA is not your customer though so why would CIP and OFAC be involved?

We have our customers sign a document stating that they are giving the individual access and they take full responsibility for any transactions and also for deleting the access once its no longer necessary. But we only do this on a case by case basis, this is not a normal service we allow.

Tracey is correct, this should already be handled in your on-line banking agreement if you are allowing customer's to assign access to non-owners or non-authorized signers. If you don't have that sort of system in place that places the entire burden on the customer, I would not touch it.

We will be updating our online banking agreement to place the burden on the customer.

Maybe I'm overanalyzing this. With all of the CDD beneficial owner changes that have recently taken place, it seems odd that we must positively identify all individuals who could possibly benefit from the business, even when they aren't our customer. But we don't have to identify those that are allowed to conduct transactions on our online banking system?

Sort of apples and oranges. If I am employed in the bookkeeping department of a business, I may be granted access to do my job. That has nothing to due with beneficial ownership. I don't own anything, not even the chair I sit in at work. The only thing you are concerned with is that the individual that has access to conduct transactions has the proper authority to do so.

Sorry to bring this back up, but what if the person provided "shared access" can initiate transfers or make bill payments? I would think if the person could make bill payments, the bank would have a duty to verify the identity of the person. Thoughts? Your help is greatly appreciated.

That was my initial concern, as well. The shared user will have access to bill pay, wire transfers, ACH transactions, etc. Granting access to your CPA is great in theory, but we all have those customers who will inevitably share access with their new love interest they met online, and all of a sudden the customer realizes they are actually a money mule whose account has been drained. It seems like the bank would have more responsibility here.

Strongly recommend that your OLB agreement be reviewed by legal counsel if you offer this service. You want to put the responsibility on the customer for granting and setting up the access.

I certainly wouldn't be granting this service to everyone. I would limit it to those customer that have a demonstrated need for it.

most businesses that utilizes our cash management services, and sign all the respective agreements, can give anyone in its company authority to access their online banking platform and they are given tokens to give to those authorized persons. within the agreement(s) they are required to note who will be given the authority to access and conduct transactions on their behalf.