Reviewed October 17, 2026. This practical guide replaces an earlier general overview. The original publication date and URL are retained.
The most consequential permission in a payment platform may be the ability to change a bank account or approve a payout. Review that authority separately from ordinary reporting access.
Create an action-based access register
List each person and integration that can edit bank details, issue refunds, create users, change authentication settings or export reports. Record the business reason and approving owner for each permission. Include service accounts and former contractors; an employee directory alone will miss credentials used by integrations. Keep secret values out of the register.
Challenge an unexpected bank change
A request may arrive through a familiar mailbox that has been compromised. Verify the proposed change through an established secondary channel before acting. IC3 recommends independent verification of account-information changes. Record the verifier, time and approved destination reference without putting full banking details into a loosely controlled discussion thread.
Rehearse an employee departure
Choose a fictional departing manager and walk through the account-disable checklist. Check the payment platform, recovery contact, shared inbox, connected application and device access separately. Assign a deadline and evidence field for each step. Removing someone from a scheduling tool does not demonstrate that their payment credentials have been revoked.
Review exceptions rather than rubber-stamping the list
Once a month, identify users who have not used elevated permissions, unexpected new administrators and access granted during an incident. Remove access through the provider’s supported process after confirming the business dependency. Preserve an authorized backup administrator and recovery procedure so a cleanup does not lock the business out of its own account.
Sources and next steps
Primary reference: IC3 account-change verification guidance. The worksheet and examples above are operational analysis, not reported customer results.
Continue through the AMS New York merchant reading path. For the broader framework, explore Eric Kuvykin’s fintech, payments, alternative financing and AI topic guides.
