Four Eyes Principle in Banking Without the Bottleneck

Four Eyes Principle Without the Bottleneck

Process errors caused 47% of op risk losses at five big UK banks. A four eyes principle set by risk catches errors without long approval queues.

Alexander Kiel

Business Analyst · Banking & Wealth Management

24.07.2025 · 8 MIN READ · PROCESS OPTIMISATION

ON THIS PAGE

1. Map Every Four Eyes Check

2. Set Checks by Risk and Amount

3. Give the Checker a Clear Task

4. Keep Maker and Checker Independent

5. Measure Waiting Time and Rejections

6. Automate the Routine Checks

Sample case: Citigroup

In short

FAQ

Process errors are among the costliest operational risks in banking. At five large UK banks, execution, delivery and process management failures caused 47% of operational risk losses on average in 2018. At Santander UK the share reached 91%. The four eyes principle is meant to stop such errors before they leave the bank.

Regulators build it into the rules. Germany's MaRisk states that a credit decision shall require two positive votes by the front office and back office. The Basel Committee warns that conflicting duties without dual controls may result in concealment of losses, errors or other inappropriate actions.

Yet a second signature can turn into a queue or a rubber stamp. Do the checkers in your bank know what they are checking and how long each approval waits?

Illustrative example of 10,000 daily payments sorted by risk: 8,500 pass automated validation rules, 1,300 get one check with sampling and only 200 high-value or new-beneficiary payments go to independent four eyes review

STEP 1

Map Every Four Eyes Check

Start with an inventory. List every four eyes check in your operations: payments, static data changes, trade bookings, credit decisions and reconciliation sign-offs. For each check, record the maker, the checker, the system, the daily volume and the risk it covers. Look for two things: checks nobody can explain any more and tasks one person can still start and finish alone.

Supervisors expect this overview. The Basel Committee states that an effective control environment also requires appropriate segregation of duties and that areas where conflicts of interest may arise should be identified, minimised and monitored independently. MaRisk requires that activities that are not compatible with each other are performed by different staff members.

✓

List every four eyes check with its maker, checker and system

✓

Record the daily volume and the risk each check covers

✓

Flag sensitive tasks one person can still complete alone

How many four eyes checks run in your operations today and who owns the list?

Keep in mind: An inventory built from procedures alone misses the checks people do by habit. Walk the process with the teams as well.

STEP 2

Set Checks by Risk and Amount

Not every action needs a second person. Rank each check by what an error would cost: amount, reversibility, client impact and regulatory exposure. Keep full four eyes review for high-value payments, new beneficiaries and master data changes. Use thresholds, sampling or automated rules for low-value tasks that are easy to reverse.

Regulation leaves room for this. For credit business that is not risk-relevant, MaRisk lets the bank decide that only one vote is necessary. Each institution draws that line itself. Patient safety research points the same way: the Institute for Safe Medication Practices does not recommend independent double checks for all high-alert medications and finds that fewer, well-placed checks are more effective than many routine ones.

✓

Score each check on amount, reversibility and client impact

✓

Set value thresholds above which a second approver is required

✓

Replace low-risk checks with sampling or automated rules

Which four eyes checks in your bank protect less value than the time they cost?

Keep in mind: Thresholds invite splitting. Watch for payments or changes just below the limit and treat a pattern as an alert.

STEP 3

Give the Checker a Clear Task

A checker asked only to review often confirms what the maker meant rather than what the system will do. Define what each check verifies: the critical fields, the source document to compare against and the screen that shows the final outcome. Where possible, let the checker re-enter key fields blind instead of reading them. In my experience, checkers who are not told what to check tend to check the format, not the substance.

Independence makes a second check work. Studies collected by the Institute for Safe Medication Practices show that independent double checks can detect up to 95% of errors. Without independence, people may see only what they expect to see, even if an error has occurred. The fields to check follow from the critical data elements in my article on the data quality framework.

✓

Write down the fields each checker must verify

✓

Show the checker the final outcome, not only the input

✓

Use blind re-entry for account numbers and amounts

Could the checkers in your team say exactly which fields they confirm on each approval?

Keep in mind: A longer checklist is not a better one. Five critical fields checked properly beat thirty fields scanned in a hurry.

STEP 4

Keep Maker and Checker Independent

A four eyes check fails when the two people decide together. If the maker talks the checker through the entry, the second view becomes a shared one. Separate the roles in the system, block self-approval and route approvals to a pool of checkers instead of a colleague the maker picks.

Joint decisions can weaken a control. In a laboratory experiment at the University of Munich, corrupt decisions rose from 25% with one decision-maker to 42% when two officials decided jointly. The author found that introducing the 4EP increases corrupt behaviour in that setting. MaRisk also requires appropriate cooling-off periods when staff move from trading or front office to back office or control units.

✓

Block self-approval and approvals from a shared team login

✓

Route approvals to a pool of checkers, not a chosen colleague

✓

Review access rights after every role change

Can a maker in your bank choose their own checker or approve their own entry?

Keep in mind: Independence does not mean silence. A checker should still ask the maker questions once their own review is done.

STEP 5

Measure Waiting Time and Rejections

A bottleneck stays invisible until someone measures it. Track for each check how long items wait for approval, how many are approved before the cut-off and how many are rejected or returned. A checker who has rejected nothing for months is either reviewing perfect work or no longer reviewing.

The Basel Committee expects an appropriate control monitoring and assurance framework and notes that metrics provide early warning information. ISMP links failed checks to auto-processing, where the checker works by habit with little real appraisal. My article on as-is process mapping shows how to measure where work waits between handoffs.

✓

Measure the waiting time of each check against the cut-off

✓

Report rejection and return rates by checker every month

✓

Investigate checks with no rejections over a full quarter

How long does a payment in your bank wait for its second approval at month-end?

Keep in mind: A rejection target quickly becomes a quota. Use rejection rates to start a conversation, not to rate checkers.

STEP 6

Automate the Routine Checks

Many four eyes checks compare two values a system could compare faster: an amount against an instruction, an IBAN against a register or a booking against a confirmation. Automate these comparisons, send only the exceptions to a person and keep human checkers for judgement calls such as unusual counterparties, new beneficiaries and overrides.

The Basel Committee states that automated processes are less prone to error than manual processes, but warns that they introduce risks that must be addressed through sound technology governance. Its principles also call for regular verification and reconciliation of transactions and accounts. My article on how to automate reports in Excel shows how to build checks into a routine process.

✓

List checks that compare two values a system already holds

✓

Automate the comparison and route only exceptions to people

✓

Test every automated control after each system change

Which of your bank's daily four eyes checks could a validation rule perform instead?

Keep in mind: Automation removes the queue, not the responsibility. Someone must still own each rule and review its exceptions.

On Being Wrong | Kathryn Schulz (Staff Writer @ The New Yorker)

SAMPLE CASE

Citigroup

On 11 August 2020 Citibank, agent on a Revlon loan, intended to wire approximately $7.8 million in interest payments to the lenders. US District Judge Jesse Furman later called what happened instead one of the biggest blunders in banking history.

The payment had passed Citibank's six-eye approval procedure, which requires three people to review and approve a transaction. The maker, the checker and a senior manager all believed that setting one field in the Flexcube loan system would hold back the principal. The manual required the FRONT and FUND fields to be set as well. The approver replied by email: Looks good, please proceed. Principal is going to wash.

Lenders refused to return about $500 million. In February 2021 the district court ruled that the lenders were entitled to keep the money. In September 2022 the Second Circuit reversed and held that the funds are not shielded from Citibank's claims for restitution.

Key takeaway: Three approvals missed a $900 million error because all three shared the same wrong assumption. A four eyes check works only when each checker independently verifies the outcome, not the intent.

"It mistakenly wired, in addition to Revlon's $7.8 million, almost $900 million of its own money as well."

Jesse M. Furman (US District Judge @ US District Court for the Southern District of New York)

In Short

A four eyes principle without the bottleneck rests on six habits: a full inventory of checks, review levels set by risk and amount, a clear task for every checker, real independence between maker and checker, measured waiting times and automation for routine comparisons.

The result is fewer and stronger checks, shorter approval queues, checkers who catch real errors and a control set that the bank can explain to auditors and supervisors.

Frequently Asked Questions

What is the four eyes principle?

The four eyes principle is an internal control in which a second, independent person reviews and approves a transaction or change before it takes effect. Banks apply it to payments, credit decisions, trade bookings, static data changes and access rights. Its purpose is to catch errors and prevent fraud, because no single employee can complete a sensitive task alone.

What is the difference between maker checker and four eyes principle?

Maker checker is the most common way to apply the four eyes principle in bank operations. The maker enters a transaction and the checker verifies and releases it in the system. The four eyes principle is the wider rule that two people must be involved, which also covers joint signatures, dual votes on credit and approvals outside a system.

Is the four eyes principle a legal requirement for banks?

EU banking law requires robust governance and adequate internal controls, but rarely prescribes four eyes for a specific task. In Germany, MaRisk requires segregation of incompatible duties and two votes for risk-relevant credit decisions. Beyond such rules, each bank sets its own checks by risk. Requirements differ by country, so confirm the details for each market with Compliance and Legal.