The Mandate Register: Governing Overseas Bank Access Before Money Moves

Opening a bank account in a new market is usually treated as an administrative milestone on a country-entry plan: something between the lease and the payroll provider. In practice it is the point at which the authority to move the company's money leaves the boardroom. From that day forward, a payment instruction is valid because a bank's records say so — not because a director remembers approving it.

For UK mid-market groups expanding into Europe, the Gulf, North America or Asia-Pacific, the gap between what the board believes it has authorised and what the bank's mandate actually permits is where losses occur. The remedy is not more signatures. It is a documented authority framework that the bank, the auditor and the local team all read the same way.

The mandate is a governance instrument, not a form

A bank mandate is best understood as a delegated authority schedule that happens to sit with a financial institution. It names individuals, defines what each may do alone or in combination, sets limits where the bank supports them, and records how changes are instructed. Once signed, it becomes the operative rule set for every payment the entity makes.

Boards should therefore treat mandate design as a board reserved matter for new-market entities, at least until the operation has a track record. The authority to open, mandate, amend and close accounts should be expressly reserved in the group's schedule of matters reserved for the board, mirroring the way treasury limits are usually handled. Supporting evidence — a board minute identifying the signatories, their scope and any threshold — should travel with the mandate pack to the bank, because local relationship teams frequently ask for it and local counsel often require it.

Dual authorisation meets local reality

The instinctive control is a two-signature rule. It is a good default and a poor absolute. Several markets require at least one signatory who is resident, locally identified, or holds a particular visa or Emirates ID equivalent; others insist on a locally licensed authorised representative. The practical consequence is that the two people who can release funds are rarely the two the UK finance director would have chosen.

Where local requirements force a resident signatory, the design should compensate elsewhere. Options include pairing the resident signatory with a group signatory for anything above a low threshold, restricting the resident signatory to named beneficiary categories, and appointing a second resident signatory drawn from a different function — finance and operations, for instance — so that no single local manager can act unobserved.

Boards should also check what the bank's portal actually enforces. A mandate that specifies dual authorisation is of limited value if the online profile permits a single approver to release a payment below a system limit that nobody has reviewed. Ask for the portal's user rights report as a matter of routine and reconcile it to the mandate annually.

Setting thresholds that people respect

Thresholds fail when they are set so low that staff route around them, or so high that the control is decorative. A workable structure usually has three tiers: an operating band for routine local expenditure approved by a single authorised signatory; a middle band requiring dual authorisation; and an upper band reserved to group treasury or the board, regardless of what the local bank permits.

Each tier should be defined by role rather than by name, so that a change of personnel does not require a new mandate. Named individuals still appear on the bank's records, but the group's internal schedule should describe the position, the limit and the expiry of the authority. Fixed-term authority — twelve or twenty-four months, renewable on attestation — prevents the slow accretion of access that characterises long-established overseas subsidiaries.

Emergency payments need a written exception, not an improvisation

Every overseas operation eventually faces a payment that cannot wait for the second signature: a customs release, a payroll run, a deposit deadline. If no exception exists, staff will find one, and it will be undocumented.

A controlled exception typically involves a pre-agreed window, a designated emergency approver, a value ceiling, and a requirement that the payment be ratified by the second signatory within a defined period — commonly one to two business days — with the ratification recorded and reported to the next finance committee. The bank mandate should support the arrangement where local rules allow; where they do not, the exception should be handled through pre-funded local floats or a corporate card facility rather than through informal single-signatory releases.

The test is simple: could the board reconstruct, from documents alone, who authorised a given payment, under which exception, and who subsequently confirmed it?

Account proliferation is the quiet risk

New-market entry generates accounts faster than expected: an operating account, a payroll account, a foreign-currency account, a customs or duty account, sometimes a separate entity for a project. Each carries its own mandate, its own signatories and its own drift.

Groups should maintain a single register of bank accounts and mandates covering entity, jurisdiction, bank, account number, currency, purpose, signatory set, portal administrators, and date of last mandate review. The register should be owned by treasury and attested annually by the local finance lead and the group finance director. Accounts with no transaction history for two consecutive quarters should be closed or formally justified; dormant accounts with live mandates are a standing invitation.

Reconciliation as evidence

Control is only proven by reconciliation. Overseas accounts should be reconciled to the group ledger at least monthly, with intercompany movements supported by loan or service documentation and appropriate transfer pricing records. Dual-authorisation logs, exception approvals and ratification notes should be retained alongside the reconciliation pack, so that the audit trail is a by-product of normal operation rather than a reconstruction exercise.

Two further points deserve board attention. First, personnel change: secondments end, local managers resign, powers of attorney are revoked. Banks update their records slowly, so revocation should be instructed in writing on the day of departure, with confirmation obtained and filed. Second, the UK's failure to prevent fraud offence under the Economic Crime and Corporate Transparency Act 2023, in force since September 2025, gives boards a direct interest in demonstrating that reasonable fraud prevention procedures were in place across their overseas operations — a documented mandate framework is precisely that kind of evidence.

A pre-first-payment checklist

• Board minute recording the authority to open the account, the named signatories and the threshold tiers.
• Schedule of matters reserved updated to include mandate changes and account closures.
• Written confirmation of local signatory requirements from in-country counsel.
• Portal user rights report obtained and reconciled to the mandate.
• Dual authorisation evidenced for all payments above the operating band.
• Emergency payment exception documented, with approver, ceiling and ratification window.
• Single register of accounts and mandates established and owned by treasury.
• Written revocation procedure for leavers, with bank acknowledgement filed.
• Monthly reconciliation timetable agreed with the local finance lead.
• Annual attestation date diarised for the board.

None of this requires the group to smother its local team. It requires the board to decide, in advance and in writing, who may commit the company's money, in what combination, up to what value, and on what evidence. The first overseas payment is a poor moment to discover the answer.