By OptiVal Editorial Desk
Giving bank access to a remote bookkeeper is the part of hiring that makes most owners pause. The bookkeeper needs to see your transactions to do the work, but nobody wants a stranger with the power to move money. The good news: you do not have to choose between convenience and control. With the right setup, your bookkeeper sees everything they need and cannot touch a dollar without your approval. Here is exactly how to set that up.
Bank access for a remote bookkeeper: the one rule that matters
Never share your own login. That is the whole rule, and it covers nearly every access disaster you hear about.
Your banking login, your QuickBooks login, your CRA password: each of these belongs to one person, which is you. When your bookkeeper needs access, you create a separate user profile in their name, with only the permissions the job requires. This is called the principle of least privilege, and every Canadian business banking platform worth using supports it in some form. A separate profile means you can review exactly what the bookkeeper did, change their permissions in one place, and revoke everything instantly if the relationship ends.
It also keeps a clean paper trail. If two people share one login, the audit log cannot tell them apart. If something goes wrong, you will want that log to tell a clear story.
What your bookkeeper actually needs (and what they do not)
A bookkeeper needs information, not authority. To keep your books current, they need to see:
- Transaction history and running balances
- Monthly statements and deposit images
- Which transactions cleared and when
They do not need the ability to transfer funds, pay bills, add new payees, change direct deposit settings, or sign cheques. If your bank offers a choice of permission levels, pick the view-only or reporting option and leave payment functions switched off.
There is also a simpler path that avoids the bank portal entirely. Most bookkeepers can work inside your accounting software instead. If you connect a bank feed in QuickBooks Online or Xero, your bookkeeper sees fresh transaction data through the software and never needs a bank login at all. The accounting-software route is the recommended setup for most small businesses: data access lives in the books, payment authority stays with you.
How Canadian banks handle delegate access
Most Canadian business banking platforms let the account owner add sub-users or delegates with configurable permission levels. The exact labels vary by bank, but the pattern is consistent: create a separate profile for the bookkeeper, assign read-only or reporting permissions, and confirm the profile cannot initiate transfers, pay bills, or manage payees.
Some platforms go further. Certain business banking systems let a delegate prepare a payment that sits pending until you approve it, with an alert sent to you for review. Others support dual signers on accounts that require two people to approve a payment or transfer. If your bank supports either, turn them on: the bookkeeper does the legwork, you press the button that matters.
Two practical points that apply everywhere:
- Turn on multi-factor authentication for the bookkeeper’s login, the same as yours.
- Check that the activity log is visible to you as the account owner, so you can see who did what.
If your bank does not show an obvious delegate or additional-user option, call your business banking line and ask. Support staff can usually walk you through it or confirm whether a read-only workaround exists. Do not improvise by handing over your own credentials.
Who prepares, who approves: set up a payment workflow
This is where the separation-of-duties habit pays for itself. The strongest small-business setup is a simple two-step workflow:
- Your bookkeeper prepares payments: enters vendor bills, sets up the EFT batch, drafts the payroll run.
- You approve and release them: one look, one click, money moves.
The person who creates a payment should not be the person who releases it. That single rule blocks most fraud scenarios before they start, and it costs you about ten minutes a week. For more on structuring these checks with a small team, see our guide on separation of duties for small businesses.
Pay special attention to e-transfers and wires. Interac e-Transfer limits, autodeposit settings, and wire templates are exactly the controls an attacker (or a dishonest insider) would target. Review who can change those settings, and keep that permission with you.
CRA access: authorize through Represent a Client, never share your password
The CRA gives you a proper way to grant access, and it is not your password. Through Represent a Client, you authorize your bookkeeper or firm at a level that matches their job:
- Level 1 is view only. The representative can see correspondence, account balances, and addresses. This is enough for a bookkeeper who just needs to check filing status and read notices.
- Level 2 adds the ability to make changes: filing returns, submitting online requests, and communicating with the CRA on your behalf. Grant this only to the person who actively manages your CRA obligations.
- Level 3 exists only on business accounts and grants delegated authority, including signing authority on consent forms. It is reserved for specific situations and requires an individual RepID.
You authorize representatives through your CRA My Business Account, and the authorization stays active until you cancel it or set an expiry date. Two rules worth following: grant the lowest level that gets the job done, and set a reminder to review or revoke the authorization when the engagement ends. For the step-by-step on CRA and accounting-software permissions, our QuickBooks Online access guide covers the software side in detail.
Payroll and other tools: use the built-in roles
Payroll systems deserve the same treatment. Most payroll platforms, including the Canadian providers small businesses commonly use, support delegate or approver roles. Your bookkeeper can prepare the pay run while you approve it before money moves. Never give one person full administrator rights over payroll, banking, and the accounting system at the same time.
The same logic applies to your cloud document storage. Share the folders the bookkeeper needs, not your entire drive. Review the sharing settings twice a year, and remove access the day someone leaves. Our offboarding checklist walks through exactly what to revoke and in what order.
Your access checklist
Run through this list when you bring a remote bookkeeper on board:
- Separate login created for the bookkeeper at the bank, with view-only or reporting permissions
- Transfers, bill pay, and payee management switched off on that profile
- Multi-factor authentication enabled on the bookkeeper’s login
- Payment approval workflow in place: they prepare, you release
- CRA access granted through Represent a Client at Level 1 or 2, not by sharing your password
- Accounting software user role set to the bookkeeper role, never full admin
- Payroll set so the owner approves each run
- Review scheduled every quarter, with immediate revocation when the engagement ends
Security with a remote team goes beyond logins. How files are handled, what devices touch your data, and how privacy rules apply all matter too. We covered that side in our data security guide for remote finance teams.
The takeaway
Bank access for a remote bookkeeper is a solved problem. View-only logins, bank feeds inside your accounting software, a prepare-then-approve workflow, and proper CRA authorization give your bookkeeper everything they need while you keep the keys. Set it up once, review it quarterly, and you get the benefits of a remote finance team without the worry that keeps owners up at night.
Setting up secure access is exactly the kind of thing we handle when we take on a client’s bookkeeping. OptiVal is led by qualified professionals with more than 75 years of combined experience, PwC-trained, who have worked at world-leading multinationals in CFO-level positions. Bookkeeping plans start at $199 per month, payroll from $29 per employee per month plus a $149 setup, and cleanup work from $45 per hour (all CAD, HST extra). Book a free consultation and we will get your books, and your access controls, sorted.
