Your bookkeeper needs to see what cleared, but that doesn't mean they need the power to move money. Bank account access can mean viewing deposits, downloading statements, changing payees, sending a wire, or changing account settings. Each carries a different risk, so grant or restrict each one individually.
Give access when the role is limited to reconciling accounts and categorizing transactions from statements. Keep payment approval, payee edits, credential changes, and account admin with you. Use named seats, test permissions before close, and document how you'll remove access later.
Give read-only access and keep payment authority separate
At month-end, give your bookkeeper the records behind the close and keep owner-level control with you. Before you send the invite, separate viewing access from payment access. Your bookkeeper should be able to see what cleared, identify which account it hit, and pull the statement without using your password.
Treat your bookkeeper's login as a work seat with its own limits, and choose business banking services that separate permissions through a defined user role. Relay is built this way, with named seats and Partner Portal access for accountants and bookkeepers so their visibility never overlaps with owner-level controls.
The stakes are higher for small businesses than the head count suggests. According to the ACFE's Occupational Fraud 2024: A Report to the Nations, organizations with fewer than 100 employees had a median fraud loss of $141,000 per case, and smaller businesses typically have fewer anti-fraud controls than larger organizations, which leaves them more exposed. A read-only bookkeeper seat is one of the simplest controls to put in place.
Match permissions to close tasks
For month-end close, translate that boundary into task permissions. Base the access boundary on the tasks your bookkeeper performs. Close, reconciliation, and reporting decide what they need. Start with the records behind deposits and charges, including statements, and then keep transaction authority outside the role.
Use the read-only boundary to make the role clear:
Give: View transactions across your accounts
Give: Connect the bank feed to your accounting software
Give: Download monthly statements
Give: Categorize transactions for clean books
Keep off-limits: Payment authority
Keep off-limits: Payee management
Keep off-limits: Credential changes
Keep off-limits: Account administration
In practice, your bookkeeper's role should cover normal close questions without another password handoff. They should be able to match deposits to customer payments and check which account a charge came from, and if a statement is missing, they should be able to pull it for reconciliation. If a task crosses into the transaction-authority group, keep it outside your bookkeeper's role.
Tie any later change to a specific new task.
Choose the right access workspace
When direct banking access is the right workspace, assign a defined role. Read-only user access is the default when your banking platform supports it.
Your bookkeeper should log in under their own seat. If they only need transaction data, a bank feed inside your accounting software can replace direct banking access. Your bookkeeper can connect bank data into the accounting software and work from the feed.
Relay connects with QuickBooks Online and Xero, so your bookkeeper can work from the accounting feed when they don't need direct banking access.
Before you send the invite, decide which system should be your bookkeeper's workspace. Direct banking access fits when the close checklist includes statement exports or transaction research that the accounting feed doesn't provide. A bank-feed-only setup works when the accounting software already gives your bookkeeper enough detail to categorize transactions and reconcile the account.
Relay lets you create a separate seat for delegated work, so the invite can match the accounts and tasks in scope without exposing owner-level controls.
Test and record permissions before close
Set up the role before the close deadline and test it with a recent statement month. Confirm your bookkeeper can see the accounts included in the engagement, download the correct statement period, and open transaction details needed for categorization. If they only need one operating account, don't add every account by default. If your bookkeeper needs temporary permission for a specific bill-pay project, assign an end date before you send the invite.
Before the invitation goes out, use a short checklist so permissions match the close work.
Confirm the bookkeeping scope: reconciling accounts, categorizing transactions, reviewing statements, bank-feed work, or all of the above.
Create a separate user for your bookkeeper so you don't have to share your owner login.
Identify who exports statements, who reviews pending payments, and who signs off on exceptions.
Run the access test before the close deadline.
Record who approves restricted changes and offboarding.
Keep the record simple by noting the grant date, included accounts, selected role, connected systems, and end dates for temporary access. Store it with the close checklist so the next review starts from the same facts and doesn't rely on memory. If your bookkeeper's contract changes, update the record before changing the role.
Add offboarding to the same record before access starts. List the banking seat, accounting-software login, shared close folder, and any payment-prep workspace tied to the engagement. When the work ends, that list becomes the shutdown checklist, so you're not searching through old invites and shared folders.
After your bookkeeper accepts the invite, ask them to confirm what they can and can't see, so any gaps or extra permissions get caught before the close starts.
What to do if your bank doesn't support role-based access
If your current bank offers only full access or nothing at close, share monthly PDF statements manually or move to a banking platform with detailed user permissions. Manual statement sharing protects your login, but it makes each close depend on your statement exports, so put the export date on the close calendar and don't leave it to memory. Built-in user roles remove that owner-export dependency by giving your bookkeeper a limited seat. For a growing business where the close needs to happen on schedule, the limited seat pays off within the first close.
Share statements manually without scattered messages
If manual sharing is the only option, send a complete close package in one delivery. Include the statement, date range, and any deposit or payment details your bookkeeper can't see from accounting software. Keep the same delivery method each month so access doesn't depend on scattered messages.
Use a shared close folder for each month so you and your bookkeeper are looking at the same set of files. Name the folder by month, add the statements, and note any transactions that need your context. If you get a new request after the close starts, add the answer to the folder so it stays with the month's file. The folder gives you a record of what was shared and reduces repeat questions next month.
Pair bank access with internal controls
When your bookkeeper starts preparing bills, pair that work with your review and clear approval rules. The same ACFE study found that more than half of occupational fraud cases were correlated with either a lack of internal controls or a management override of the controls that existed. That's exactly why splitting who records a transaction from who approves it matters.
Use a recurring access review to confirm your bookkeeper's permissions still match the work they perform, especially after bill prep, advisory work, or new account access is added. In Relay, the accountant seat keeps your bookkeeper's visibility tied to a named login, which makes that review and the offboarding list easier to check. At the start of each month, confirm last month's reconciliations, save statement files, and flag user seats you don't recognize.
Assign yourself or another owner to approve access changes, and make those changes as visible as bill approvals so a temporary workaround doesn't become a permanent permission.
Keep payment prep separate from approval
For outgoing payments, set your approval threshold—for example, anything over $1,000. Your bookkeeper can prepare and categorize bills while you approve. Add a monthly reconciliation sign-off when the books close: review the account reconciliation yourself so you're not only trusting the finished output. Choose a dollar limit you can follow every month.
In the simplest workflow, your bookkeeper prepares the bill, attaches the invoice, assigns the category, and leaves the payment pending. You review the vendor, amount, due date, and cash impact, and then approve or reject it. After the payment clears, your bookkeeper matches it during reconciliation.
Set the boundary before you share access
Bank access affects more than the next close as your business adds vendors, bill-pay workflows, and outside advisors. The goal is to protect today's bank balance and keep the close repeatable when you're traveling, a controller joins, or an advisor needs temporary context. In Relay, delegated logins keep bookkeeper visibility separate from owner-level controls.
Decide ahead of time how exceptions move. If your bookkeeper finds an uncategorized $2,400 charge, the next step is a note in the close folder or accounting software. Broader bank access isn't the fix. If a vendor needs to be added, keep payee setup with the owner seat and let your bookkeeper attach the invoice or category note. These small rules keep normal bookkeeping questions from turning into permission changes, and keep the approval note, invoice, and bank record pointing to the same decision.
A clear boundary holds up better when each person has a named seat and a defined role. As your team grows, consider opening a Relay account. Relay gives your bookkeeper Partner Portal access and named seats, so you can review who had access and what they could see.
Frequently asked questions
Should I give my bookkeeper read-only or full access?
Choose read-only for day-to-day bookkeeping. It covers activity review, statements, and reconciliation. Reserve full access for rare cases where your engagement with them explicitly includes payment authority.
Can a bookkeeper initiate payments from my account?
They can if you grant it, but most bookkeeping engagements don't need it. If bill pay is in scope, use a prepare-and-approve flow: your bookkeeper queues the payment and you approve it before money moves.
What happens if I give my bookkeeper too much access?
Too much access weakens the check between recording a transaction and approving it. The same person can enter the bill, create the payee, and send the money. Keep those responsibilities split.
How do I add my bookkeeper to my business bank account?
Add your bookkeeper as a separate user with a limited role so you don't have to share your own login. Set the account boundaries in the invite, and then verify statement and transaction visibility before month-end.
Can I give my bookkeeper access without sharing my password?
Yes. A delegated user role gives your bookkeeper their own seat, lets you change or remove access later, and keeps your owner credentials private. It also gives you a clean offboarding path when the engagement ends. When the work ends, remove the banking seat, accounting-software access, and shared folders on the same day.
