Bank Mandate

A bank mandate is a company's instruction to its bank about who may operate an account and under what conditions, and it can name signatories, signing combinations, limits and powers to request services. The bank relies on its accepted version when processing instructions, so a company's internal approval chart may be stricter but does not automatically update the bank's records.

The mandate begins with legal identity, so check that the account holder, registration documents and people empowered to authorise a change all match. A director is not always entitled to act alone merely because of a job title, as the bank may require a board resolution, identity documents and its own form before recognising a new person or a revised signing rule.

Define separate permissions for viewing, preparing and approving transactions, since online banking often has administrator, maker and checker roles that do not map neatly to handwritten cheque signatories. State who can add beneficiaries, change user access and release payments, because a person who controls both user administration and final approval may bypass an otherwise sensible dual-control policy.

Signing limits should reflect how the business actually spends, for example one authorised person approving routine payments below a threshold and two above it. Check whether the limit applies per transaction, per day or to cumulative related payments, because if a purchase is split into several smaller transfers, a per-transaction threshold alone may not catch the total exposure.

A maker-checker process reduces the chance that one mistake or unauthorised instruction goes through unnoticed, though it does not eliminate collusion, account takeover or weak verification of a new beneficiary, so device credentials should be protected and payment details reviewed independently. Consider a monthly control report in which 196 of 200 payments above the policy threshold had two approvals, giving a dual-approval share of 98%.

That percentage is a prompt for investigation, not evidence that the four remaining payments were fraudulent, so find whether they were valid exceptions, processed through another channel or approved by a role that the report failed to capture. Keep the corporate policy and the bank mandate in sync, because if a board decides that the finance director can approve up to a new amount, the bank must accept the matching change before payments will pass.

Conversely, a bank mandate may still permit a former executive even after the internal policy removed them, so review both documents and retain written confirmation from the bank of when the change took effect. Staff departures are a critical trigger, so disable company system access, revoke online banking credentials and submit mandate changes promptly, and verify the completed change through the bank's official channel, since submitting a form is not the same as the bank accepting it.

If an urgent payment is due during the transition, plan a temporary authorised route instead of sharing credentials, and remember that changes in ownership, directors or company structure can also affect the mandate, so a new board resolution for the parent does not automatically change a subsidiary account. Map accounts to legal owners and maintain an inventory of mandate versions, limits and signatories.

UAE bank practices reflect both account terms and customer-due-diligence requirements, with Central Bank guidance considering authority for natural persons acting for customers and an individual bank possibly requiring its own supporting papers, so use the bank's current forms and ask it to confirm the authorised route for the particular account, because generic advice that a board resolution is always enough can be wrong. The best mandate is specific enough to stop a wrong payment without stopping legitimate work, and its value comes from keeping those permissions current and verifying that the bank has implemented each change, so treat it as a live financial control, not a form completed only when an account opens.