Electronic document management in banking: efficiency and security

For a bank, the value of an EDMS lies in a controlled document workflow: the responsible employee sees the required version, task, and deadline according to the rules agreed upon by the institution.

Responsibilities of EDMS, Core Banking, and Payment Services

During design, it is determined which actions are performed by the electronic document management system (EDMS), which by the core banking system (CBS), and which by payment services. An EDMS can also work with financial documents, but their approval should be separated from accounting entries and payment execution. The connection between systems must transfer agreed data while maintaining proper checks and authority.

To illustrate the boundaries of responsibility, one can consider a hypothetical scenario of processing a lease agreement for premises for a new bank branch. In such a scenario, a legal department specialist verifies the contract wording, a security service representative analyzes the counterparty's title documents, and a financial department employee reconciles calculations with the estimate. Verification of signatories' authority and the application of qualified electronic signatures are carried out by authorized employees using appropriate software tools. Upon completion of approval, the responsible accountant enters the payment schedule into the CBS manually or via a configured API gateway in accordance with the institution's regulations.

Approval Routing and Segregation of Duties

Segregation of duties helps organize internal control. For example, an employee initiating a procurement should not unilaterally approve all its terms. The ability to implement this limitation is checked in a specific EDMS, including substitution of absent employees. The route for a contract may cover the following steps:

• Initiation: the responsible manager prepares the draft document, fills out the card, and attaches supporting materials.
• Legal review: the lawyer checks the terms of the agreement for compliance with legislation and standard bank forms.
• Compliance control: the analyst checks the counterparty against internal lists and assesses legal risks.
• Financial approval: the economist verifies the availability of the allocated budget under the relevant expenditure item.
• Signing by management: the authorized person verifies the presence of all prior approvals and applies an electronic signature.
• Registration and archiving: the clerk records the final document number and transfers the card to archival storage.

To control the process, it is necessary to determine the composition of the event log: which actions are recorded, who has access to the log, how long it is stored, and how it is protected against unauthorized changes. During system testing, it is worth reproducing text changes, return for revision, and re-approval. Version history should make it possible to establish precisely which text each participant reviewed. These capabilities depend on the chosen solution and settings.

Data Protection, Electronic Signature, and Banking Secrecy

Law of Ukraine No. 851-IV as in force on early 2024 establishes requirements for electronic documents and their originals. Legal conditions for using signatures are also set forth by Law of Ukraine No. 2155-VIII “On Electronic Identification and Electronic Trust Services”. A qualified electronic signature has the legal force of a handwritten signature. Verification of the signature and the integrity of signed data does not substitute confidentiality protection: restricting document reading requires appropriate access rights and data protection tools.

The access matrix should reflect official authority. For sensitive materials, restriction at the level of an individual file or document may be required, rather than just at the department level. Access should be verified through search, attachments, export, and notifications, as well as timely revocation of rights upon job change or dismissal. Channel encryption protects data transmission; backup solves another task — helping restore information after loss or failure.

NBU Regulatory Requirements and Work with Electronic Signatures

In a banking institution, EDMS requirements must be aligned with the information security policy and regulations of the National Bank of Ukraine. Resolution of the NBU Board No. 95 establishes requirements for organizing information security measures. Resolution of the NBU Board No. 172 “On Approval of the Regulation on the Use of Electronic Signatures and Electronic Seals” entered into force on December 23, 2023, so it should be taken into account as of the date of this publication. The implementation of an EDMS itself does not confirm compliance with all requirements: the bank determines applicable rules, configures procedures, and verifies their operation.

For a bank, this is an opportunity to reduce material search times, see overdue tasks, and prepare documents for internal audit from a single reconciled source. For a client, the benefit may manifest in fewer repeated requests for already submitted documents — provided employees have legal grounds and appropriate access to them within the relevant process. The decision regarding a loan or other service remains with the bank's authorized persons.

Process Configuration and Verification During a Pilot Project

It is advisable to begin implementation with a limited process, such as approving a lease agreement or an internal order. The pilot tests the standard route, return for revision, absence of an approver, change of amount after approval, and revocation of access. Employees must understand who is responsible for each stage and where to reach out in case of an error. The technical team verifies integration, backup restoration, and operation under expected load.

Before the start, approval duration, document set search time, number of returns, and repeated requests are measured. Comparison with pilot results shows where settings already help and where the route remains complex. Thus, the customer receives grounds for a decision on expanding the system to other departments.

For long-term storage, it is necessary to establish retention periods, access procedure, preservation of required document details, and the capability for subsequent reproduction of electronic documents. The presence of a file in storage does not in itself solve all archival tasks. Search, signature verification, and restoration should be included in acceptance testing according to the institution's requirements.

Questions and answers

Does document approval mean payment execution?

No. Approval, accounting entry, and payment are distinct stages, the authority and connection between which are defined by the bank.

Does an electronic signature conceal document content?

A signature does not replace confidentiality protection. Restricting reading requires access rights and appropriate data protection tools.

How can an EDMS help a bank client?

In a configured process, it is easier for employees to find already submitted materials and identify who is responsible for processing them. This may reduce repeated requests for documents.

Sources

• Law of Ukraine No. 851-IV “On Electronic Documents and Electronic Document Management” (as in force on 01.01.2024)
• Law of Ukraine No. 2155-VIII “On Electronic Identification and Electronic Trust Services” (as in force on 01.01.2024)
• Resolution of the NBU Board No. 95 “On Approval of the Regulation on Organizing Information Security Measures in the Banking System of Ukraine” (as in force on 01.01.2024)
• Resolution of the NBU Board No. 172 “On Approval of the Regulation on the Use of Electronic Signatures and Electronic Seals”