Dual control and maker-checker in banking are two methods for making sure no single employee can complete a sensitive transaction on their own. Dual control requires two authorized people to act at the same time on one function, like opening a vault that needs two keys. Maker-checker splits the work in two: one person creates the transaction, a different person approves it later. Both reduce fraud and error, and federal regulators expect banks to use one or the other wherever a critical task touches money, customer data, or system access.
How Dual Control Works
Dual control requires two authorized people to be present at the same time to complete a single action. The classic physical example is a vault that needs two separate keys or codes held by two different employees. Neither person can open it alone. In digital banking systems the concept works the same way: two distinct login credentials or authentication inputs must be entered during the same session before the system unlocks a sensitive function. The transaction will not proceed until both inputs occur.
That simultaneous requirement is what sets dual control apart from other oversight methods. It is not a review or an approval. Both participants act together, and neither one has independent authority over the protected function. Banks use dual control for accessing cash vaults, activating encryption keys, and opening secure storage areas, where having two people physically present is the strongest protection against theft or tampering.
How Maker-Checker Works
Maker-checker splits a transaction into two phases handled by different people at different times. The maker enters the data and submits the request. The checker reviews it later and either approves or rejects it. The two employees do not need to be in the same room or even online at the same time, which makes this model far more practical for high-volume digital workflows like wire transfers, ACH payments, and journal entries.
The key design constraint is that the checker cannot edit the transaction. If something is wrong, the checker rejects it and sends it back to the maker to fix. That separation keeps the audit trail clean. Every change traces back to the maker, every approval to the checker. If the checker could modify the data, the whole point of having two people involved would collapse.
Once both steps are complete, the system generates an authorization log recording the user IDs, timestamps, and actions of both participants. The log cannot be modified after the fact, and any gap in the sequence, such as a transaction showing only one user ID, flags an exception for review.
When Banks Use One Versus the Other
The two models answer different operational needs. Dual control fits moments where a physical or system boundary should only open under direct joint action: vault access, cryptographic key ceremonies, after-hours entry to secure areas. The protection comes from presence, so simultaneity is the point.
Maker-checker fits transactional work that moves through a queue. Wire transfers, ACH batches, general ledger adjustments, new account openings, and changes to standing payment instructions all run through maker-checker because volume makes real-time pairing impractical and because an independent second look at the entered data is what actually catches errors.
Why Banks Are Required to Use Them
FFIEC Segregation of Duties
The Federal Financial Institutions Examination Council’s Information Security Booklet requires banks to establish segregation of duties, defined as job designs that require more than one person to complete critical or sensitive tasks.1Federal Financial Institutions Examination Council. IT Examination Handbook – Information Security Booklet The handbook singles out system administrators, whose unlimited access to technology and data requires independent monitoring. Where duties cannot be segregated, the bank must put compensating controls in place, such as independent audits of the unsegregated activity.
Sarbanes-Oxley Internal Controls
Publicly traded financial institutions face an additional layer under Sarbanes-Oxley. Section 404 requires annual reports to include a management assessment of whether internal controls over financial reporting are effective, and for larger companies an independent auditor must attest to that assessment.2Office of the Law Revision Counsel. 15 USC 7262 – Management Assessment of Internal Controls Dual control and maker-checker workflows are the operational backbone of those internal controls. Without documented two-person authorization, a bank struggles to certify that its financial reporting controls work.
Bank Secrecy Act Wire Transfer Rules
The Bank Secrecy Act drives two-person controls toward anti-money-laundering compliance. For wire transfers of $3,000 or more, banks must record and transmit specific information about the sender and recipient under what is known as the Travel Rule.3eCFR. 31 CFR 1010.410 – Records to Be Made and Retained by Financial Institutions A maker-checker workflow helps keep that data accurate because a second person verifies what the first entered before the transfer goes through.
FDIC Audit Requirements
FDIC-insured institutions with $1 billion or more in consolidated assets must prepare annual management reports addressing their responsibility for internal controls over financial reporting. Institutions with $5 billion or more must include a formal assessment of whether those controls are effective, audited by an independent public accountant.4eCFR. 12 CFR Part 363 – Annual Independent Audits and Reporting That outside audit creates external accountability for the two-person controls the bank has in place.
Building the Authorization Structure
None of this works until the bank defines who can do what. It starts with an authority matrix mapping each employee’s job function to specific maker or checker permissions. A junior operations clerk might have maker authority for transactions up to a certain dollar amount, while a senior manager holds checker authority for larger transfers. The permissions are configured directly in the core banking software so they cannot be bypassed through informal workarounds.
Banks manage permissions through centralized identity and access management systems using role-based access control. Each employee’s credentials, multi-factor tokens, and transaction limits are tied to their assigned role. The system can enforce escalating requirements based on transaction size. A routine payment might need one checker, while a wire above a certain threshold might require two. Administrators can also restrict approvals to specific time windows and approved network locations to block after-hours or off-site activity that falls outside normal operations.
Segregation of Duties Conflicts
The most common place this structure breaks down is when one person holds roles that should be separated. These are segregation of duties conflicts, and banks are expected to find and eliminate them. The incompatible pairings are intuitive once you see the pattern: the person who creates a purchase order should not approve it, the person who enters a journal entry should not approve it, the person who reconciles bank statements should not have custody of cash, and the person who adds system access rights should not approve those changes.
Banks run segregation of duties reports from their access management systems to flag these conflicts. Internal auditors review them at least quarterly and confirm that no employee has accumulated permissions that let them both initiate and approve their own work. When a small team makes perfect separation impossible, the bank implements compensating controls like supervisory review or post-transaction audits of the dual-role employee’s activity.1Federal Financial Institutions Examination Council. IT Examination Handbook – Information Security Booklet
Authentication Behind Each Login
Two-person controls are only as strong as the authentication behind each login. If a checker can log in with just a password and that password is taped to a monitor, the second approval is theater. NIST Special Publication 800-63 sets three authentication assurance levels that regulated industries use as a framework.5National Institute of Standards and Technology. Digital Identity Guidelines (SP 800-63-4)
- AAL1: Single-factor or basic multi-factor authentication, appropriate for low-impact actions like viewing account summaries.
- AAL2: Two distinct authentication factors using approved cryptographic techniques. This is the level most banks target for standard transaction approvals.
- AAL3: A hardware-based authenticator with a non-exportable private key and phishing resistance. Reserved for the highest-risk operations like releasing large wire transfers or modifying system access controls.
The practical effect is that both maker and checker must authenticate with hardware tokens or biometrics before the system will accept their input on sensitive transactions.
Liability Protection for Wire Transfers
Two-person authorization is not just a compliance checkbox. It directly affects who bears the loss when an unauthorized wire goes through. Under the Uniform Commercial Code, a bank that follows a “commercially reasonable” security procedure can hold the customer liable for unauthorized payment orders, even if the customer did not actually authorize them.6Legal Information Institute (Cornell Law School). UCC 4A-202 – Authorized and Verified Payment Orders
Whether a security procedure qualifies as commercially reasonable is a question of law. Courts look at the size and frequency of the customer’s typical transactions, what alternative procedures the bank offered, and what security measures other similarly situated banks and customers use. A bank that implements dual authorization for high-value wires and can prove it followed that procedure in good faith has a strong argument. A bank that lets a single employee approve a six-figure transfer without a second check has a much weaker one.
For business customers, this cuts both ways. If your bank offers dual authorization and you decline it, you may have agreed in writing to accept the risk of unauthorized orders processed under whatever lesser procedure you chose. That written agreement can shift liability entirely to you. Accepting the dual-authorization option when your bank offers it is one of the most straightforward ways to protect your business from wire fraud losses.
Where Two-Person Controls Fall Short
The obvious weakness is collusion. If the maker and checker are working together, dual authorization catches nothing. Banks address this through several layers: rotating checker assignments so the same two people do not consistently pair up, monitoring for patterns where certain pairs always approve each other’s work, and mandatory vacation policies that force employees away from their roles long enough for irregularities to surface during their absence.
Smaller institutions face a harder version of this problem. When a wire operations team has only a handful of people, the pool of checkers is small and the same pairs end up working together repeatedly. Post-transaction sampling audits and surprise reviews by internal audit become essential, but they catch problems after the fact rather than preventing them.
The other common failure point is rubber-stamping. A checker who approves every transaction without actually reviewing the source documents defeats the control even without any fraudulent intent. Banks track checker rejection rates for this reason. A checker who has never rejected a single transaction in months is either reviewing flawless work every time or not reviewing at all, and regulators tend to assume the latter.
Criminal Exposure for Bypassing the Controls
Employees who circumvent two-person authorization face serious federal criminal exposure, not just termination. Two statutes come up most often.
Under the bank fraud statute, anyone who executes a scheme to defraud a financial institution or obtain its assets through false pretenses faces up to $1 million in fines and 30 years in prison.7Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud Sharing login credentials to approve your own transaction, or creating a fictitious checker identity, falls within this statute’s reach.
The computer fraud statute covers a different angle: exceeding authorized access. An employee who uses legitimate credentials to access functions outside their assigned role, such as logging in as a checker when they are only authorized as a maker, faces up to one year in prison for a standard offense. If the violation was for financial gain or the value exceeded $5,000, the maximum rises to five years. Repeat offenders face up to ten years, and offenses involving intentional damage to banking systems can reach 20.8Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
These penalties sit on top of whatever the bank does internally. Most institutions require every employee to sign an acceptable use policy that spells out the consequences of circumventing controls, which typically includes immediate termination and referral to law enforcement.