Bank identity

What it means

Bank identity is identity verification through internet banking credentials. The bank checked the client in person when the account was opened and passes that result on to other services, state portals included.

What is verified is a person, not a company. A director signs in as himself and reaches the company’s official e-mailbox by virtue of his entry in the commercial register; anyone else has to be granted access first, or sees only their own mailbox.

The identity is tied to the relationship with one particular bank. Whoever closes the account or moves to another bank loses this way of signing in as well and has to set it up again or go back to the chip ID card. A company should therefore not build its access to the official e-mailbox on one bank of one director.

How it works in practice

Electronic identification rests on the eIDAS rules and replaces the card reader and chip ID card. Where the law calls for a qualified electronic signature, check whether the means produces one.

For an accountant nothing changes: the client’s agenda runs on a power of attorney filed with the tax administrator or on rights granted on the mailbox. Access goes to a named person and is withdrawn from that person.

When the director changes we sort out access as soon as the change is registered: the new director signs in with their own bank identity, reviews the rights on the mailbox and removes those of the person who left. Until the change is entered in the commercial register the new director cannot see the company mailbox, which has to be allowed for in deadlines.

What to watch out for

The worst arrangement is sending the accountant the internet banking credentials. Handing them over breaches the bank terms, so the bank will not cover an unauthorised payment and the company loses any trace of who did what.

The second risk is phishing. A fake page imitating the bank sign-in steals credentials that open internet banking and state portals in one go. Even two-factor authentication does not help if someone approves in the app what they did not read: when the app asks to approve a payment instead of a sign-in, it is fraud.