Sending issued statements to banks and lenders
How a firm sends a client's issued statements to a bank or lender with consent, a controlled link and a record of who opened them.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
The client's bank wants the annual financial statements for a facility review, and the relationship manager asks the firm to send them directly. It seems like a favour that costs nothing: attach the PDF, send, done. Then a month later the client asks which version the bank received, whether the bank also has the management accounts that were in the same e-mail thread, and whether the bank's credit analyst forwarded them to a valuer. The firm cannot answer any of it.
Sending statements to third parties is routine work with real professional and confidentiality risks. This article sets out a short procedure: get the client's consent, send only the issued version, control the link, watch what happens to it and close it when the job is done.
Client consent first
The statements are the client's, and so is the decision to give them to anyone else. Before sending anything to a bank, lender, investor, landlord or buyer, get the client's instruction in writing, naming:
- who the statements go to, by name and organisation;
- which statements, for which year;
- what for, such as a facility renewal or a lease application;
- anything else the client agrees may be sent, such as management accounts.
Confidentiality is one of the fundamental principles in the International Code of Ethics for Professional Accountants. IESBA's page on the International Code of Ethics for Professional Accountants introduces the Code, its five fundamental principles and its conceptual framework for addressing threats, and the firm's procedure for third-party requests should be read against it.
A short consent letter can be sent for e-signature. When everyone has signed, Achekam produces the signed PDF with a completion certificate listing each signer's e-mail, times, IP address and browser and the document's fingerprint, and files it in the client's 'Signed documents' folder. The consent is then on file next to everything else the firm holds for the client.
Sharing the issued version only
A bank should receive the statements the directors approved and the firm issued, not a draft that happens to look final. In Achekam, staff can download statements as an A4 PDF made on the server, but only issuing stores the final PDF with a fingerprint and locks that version. The issued, locked PDF is the only one to send.
Drafts and final versions can look identical at a glance. Before sharing, check that the copy is the issued one: the signatures, the date of approval and the practitioner's report should all be present. How issuing and locking work is described in issuing and locking the final PDF.
Some clients ask for the "board pack" or the "tax pack" instead. In Achekam those packs are the statutory set under another name, and their cards list what is not yet included, so check that what the recipient needs is actually in the pack before sending it.
Blocking downloads and requiring a code
Achekam lets staff share a vault document with a named person by an e-mailed link. The recipient needs no account. Three controls are available:
| Control | When to use it |
|---|---|
| Block downloading | The recipient only needs to read the statements, for example for a quick credit check |
| Require a code | Always for statements sent outside the client, so a forwarded link does not open |
| Revoke | When the purpose is complete, or if the client withdraws consent |
Share links last 7 days by default. That suits most lender requests; if the recipient needs longer, send a new link rather than leaving an old one open indefinitely.
Be realistic about blocking downloads. A bank usually needs a copy for its credit file, and blocking downloads will only produce a request for an attachment. Agree with the client whether the recipient may keep a copy, and set the link accordingly.
The shared document comes from the client's folder in the Document Centre, which keeps a folder per client, with versions, tags, and archive and restore with a reason. Keep the issued statements filed there under a clear name, so the shared document is easy to identify later.
Seeing views and downloads
Every view and download of a shared document is recorded. That record answers the questions in the opening paragraph: whether the bank opened the statements, when, and whether it downloaded them.
It also helps with a common problem: the relationship manager says the statements never arrived. If the record shows no view, the firm can resend before the facility deadline. If it shows several views, the conversation becomes about what the bank needs next. How this record fits with the firm's other communication records is covered in seeing everything sent to a client.
Revoking access
A share link should not outlive its purpose. Revoke it when the facility decision is made, when the client changes banks, or when the client withdraws consent. Revoking stops further views through that link; it cannot recall a copy the recipient already downloaded, which is another reason to decide about downloads before sending.
A worked example in words: a client's bank asks for the latest statements for a facility renewal. The manager sends the client a one-paragraph consent letter for e-signature, naming the bank's relationship manager and the purpose. Once it is signed, she shares the issued PDF from the client's folder with the relationship manager, with a code required and downloads allowed, since the bank needs a copy. The record shows the statements viewed and downloaded the next day. When the client confirms the facility is renewed, she revokes the link.
A procedure for every request
Write the steps into the firm's procedures: written consent naming recipient and purpose, issued version only, code required, downloads decided deliberately, record checked, link revoked when done. Then a bank's request becomes a ten-minute task with a complete record, not a favour the firm cannot account for.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
