Dormant signatories: the quiet risk on Hong Kong bank mandates
Leavers and role changes often leave names on bank forms long after access should have ended. How we spot them during payment authority work.
Bank mandates are easy to file and hard to love. Once the forms are stamped and returned, they sit in a folder while people change jobs, leave the group, or move from treasury into FP&A. The bank still lists them as authorised. Your internal matrix may not.
During payment authority audits, we compare three lists: the bank’s current mandate, your HR leavers for the past two years, and the names who actually release payments today. The mismatches are rarely dramatic fraud stories. More often they are forgotten secondary signatories on HKD current accounts opened a decade ago, or a former treasurer still named “for continuity” after a handover that never updated the bank.
Why it matters: an unused name is still a control path. If a token, cheque book, or portal credential can be associated with that person — or if the bank will accept instructions bearing that signature — you have a door nobody is watching.
What to do before our visit
Pull every mandate, not only the accounts you use weekly. Include standby facilities and accounts kept “for the subsidiary that barely trades.” Ask HR for a simple leaver extract; you do not need a full personnel file.
What we typically recommend
Prioritise accounts by balance and payment volume. Retire dormant names in batches so relationship managers are not flooded. Document who owns mandate upkeep after each organisational change — preferably someone outside the daily payment rush.
If you already suspect mandate drift, a focused payment authority engagement is usually enough; a full treasury control review is warranted when reconciliations and cash reporting look shaky too.