Should your bookkeeper have access to your bank accounts?

Yes, your bookkeeper should have access to your bank accounts. The access level matters enormously, though: read-only permission to view transactions and download statements is what the work requires, and the ability to move money, add payees, or change security settings is not part of the job.

What kind of access does a bookkeeper actually need?

Bank access splits into two distinct tiers. The first is data access: viewing posted transactions, checking balances, downloading statements, and pulling check images. The second is money-movement access: initiating transfers, paying bills, and adding payees. A bookkeeper needs the first tier only.

Read-only bookkeeper bank access lets someone see everything that has cleared your account without giving them any ability to act on it. They can see every payee, every balance, and every posted transaction. They cannot move a dollar.

One rule that applies regardless of how you set up access: a bookkeeper should never log in using the owner's username and password. They must have their own named credentials. Sharing login credentials removes the audit trail that protects you if something goes wrong.

What happens if you give a bookkeeper too much access?

Mixing view-and-reconcile permission with payment authority is a straightforward path to fraud. Small businesses are the most common victims of occupational fraud precisely because internal controls are loose and one person often handles both the books and the payments.

The principle that prevents this is called segregation of duties. The bookkeeper reconciles the accounts. The owner authorizes payments. Those two functions should never sit with the same person. Read-only access enforces that split automatically: the bookkeeper cannot authorize a payment even if they wanted to.

A bookkeeper should also never hold signature authority on any business account. Signature authority is a legal right to move money, and it belongs with the owner, not with the person keeping the records.

What does a bookkeeper actually do with your bank data?

The core task is bank reconciliation: comparing your accounting records to your bank statements to find timing differences and catch errors.

Your bank balance and your book balance will almost never match exactly, and that is normal. Timing differences explain most of the gap. Outstanding checks have been recorded in the books but have not yet cleared the bank. Deposits in transit have been recorded but not yet posted. Those differences wash out on their own once the transactions clear.

Permanent differences do not wash out. Bank fees, interest credits, NSF checks, and similar items appear on the bank statement but never in the books unless someone records them. These require a journal entry to bring the two sides into agreement.

Once the adjusted bank balance equals the adjusted book balance, the reconciliation is complete and the supporting entries are recorded. Bank fees become expense entries. Interest becomes income. Every item on the book side of the reconciliation gets a corresponding ledger entry.

One thing a bank statement cannot do on its own: explain why money moved. The statement shows a $1,400 payment to a vendor. It does not show whether that was a repair, a supply purchase, or a contractor payment. IRS Publication 583 is clear that the business checkbook is the basic source of information for recording business expenses, and every transaction needs documentation behind it. An invoice, a receipt, or a contract is what gives the transaction its meaning for tax purposes.

What if you do not want to create a bank login for anyone?

You have three options for giving a bookkeeper what they need.

• Bank-level user permissions. You add the bookkeeper as a user inside your bank's online portal with a read-only role. Most banks support this, and it typically takes 10 to 15 minutes per account to configure.
• Accounting software role-based access. The bookkeeper connects to your records through the accounting software rather than through the bank directly.
• Statement-only delivery. You download your own statements and send them to the bookkeeper. The bookkeeper gets zero login access to anything.

Statement-only delivery is the most conservative option. The bookkeeper works entirely from documents you provide, which means no credentials change hands at all. If you already run a low-tech recordkeeping workflow, this fits naturally. The post on running a short-term rental without accounting software walks through what that kind of document-based process looks like in practice.

Do bank permissions and accounting software permissions work the same way?

No, and this is a common gap. Bank access and accounting software access are completely separate permission systems. Setting up a narrow read-only role at your bank does not automatically limit what that same person can do inside QuickBooks Online or any other accounting platform.

Both systems need to be reviewed independently. A bookkeeper with read-only bank access could still have administrator-level access inside the accounting software, which is its own exposure. Role-based access controls in accounting software let you limit what the bookkeeper can see, edit, or export at the software level. That review is separate from anything your bank controls.

How often reconciliation happens affects how much of this matters on a day-to-day basis. If you are deciding between quarterly and monthly bookkeeping, the post on whether quarterly bookkeeping is enough covers that cadence question directly.

How long do the records your bookkeeper touches need to be kept?

Reconciliation reports, the bank statements that support them, and the ledger entries they produced are all tax records. The IRS recordkeeping guidance for small businesses requires that records supporting items on a tax return be kept until the period of limitations closes.

The retention periods vary by situation:

• Income tax records: 3 years
• Employment tax records: 4 years
• Substantial omission of income (more than 25 percent): 6 years
• Bad-debt deductions and worthless securities: 7 years
• Unfiled or fraudulent returns: no expiration

Many businesses default to 7 years because it covers the longest standard IRS scenario and satisfies most bank and creditor requirements at the same time. Receipts must be kept for all business expenses over $75. Meal receipts and vehicle records require documentation regardless of the amount under IRC 274(d), so there is no dollar floor for those categories.

If the business operates across more than one line of business or holds multiple LLCs, IRS Publication 583 requires a complete and separate set of records for each. That means separate reconciliations, separate statements, and separate retention for each entity. The common questions page on IRS recordkeeping covers the basics of what that documentation needs to include.

The short version: read-only access is the right answer, statement-only delivery is a valid alternative if you prefer it, and the records that flow from either approach need to be kept long enough to support whatever is on the return.