Four-eyes principle

Control principle under which important transactions, such as payments, are checked and approved by a second authorised person.

In practice

In practice, the principle covers more than payments: changes to bank details, new beneficiaries, powers of attorney and access rights also need a second approval. Approval limits are defined by amount and type of transaction, and the system records who entered and who approved each step. Urgent requests by email or telephone – a typical pattern of CEO fraud – are verified through a separately known contact before approval.

Distinctions and common mistakes

The principle only works if the second person actually checks. Typical weaknesses are shared logins, approvals granted in bulk without looking at the details and exceptions for supposedly urgent cases that bypass the control altogether.

Related terms

Enhanced due diligence

Additional measures where the money-laundering risk is higher, for example for PEPs, high-risk countries or unusually complex structures.

Mentioned in these guides

• Setting up a single family office in SwitzerlandHow to set up a single family office in Switzerland: mandate, legal form, licensing under FinIA, governance, team and the systems to put in place first.
• The KYC process in a family office: from onboarding to periodic reviewThe full KYC process in a family office: pre-screening, identification, risk rating, approval, ongoing monitoring, event reviews, periodic review and exit.
• Building the risk profile of a business relationshipStep by step to a robust risk profile: business profile, risk factors, weighting, reasoning and the triggers for a reassessment in a family office.
• Internal directives on combating money launderingWhat internal anti-money laundering directives in a family office must cover: responsibilities, risk criteria, processes, reporting, training and controls.
• Building a family office's reporting frameworkHow a family office builds its reporting: recipients, frequency, contents, data flow through to approval, controls and a template for the monthly report.
• Access rights concept: who may see what in a family officeHow a family office governs access on a need-to-know basis: roles, segregation of duties, external advisers and regular reviews of every right.
• Preventing payment fraud: CEO fraud, invoice fraud, changed bank detailsHow family offices prevent CEO fraud, invoice fraud and fake bank details – with controls, a call-back rule, rules for the family and immediate steps.
• The internal control system (ICS) in a family officeHow a family office builds an appropriate internal control system: control objectives, risk-control matrix, key controls, weaknesses and testing.