A board resolution is formal corporate approval that authorises a named person or action on behalf of the company. In KYC, it provides evidence that a representative has legitimate signing or operational authority. It is especially important when onboarding entities with delegated decision making or restricted corporate controls.
What a board resolution does
A board resolution is more than a record of agreement. It is the company’s formal statement that a board or equivalent governing body has authorised a specific person, transaction, mandate, or filing, so third parties can rely on that authority without treating it as informal delegation.
In practice, the resolution creates a documented decision trail: who approved the action, what was approved, and any limits attached to that approval. That makes it a governance artefact as much as a legal one, because it converts internal consent into externally recognisable authority.
Why board resolutions matter in KYC and corporate onboarding
In KYC, board resolutions help establish that the person dealing with the onboarding process is genuinely empowered to represent the entity. They are often used when a company has multiple directors, restricted signing rules, or delegated operational authority that is not obvious from the company name alone.
This matters because onboarding controls are designed to prevent impersonation, unauthorised account opening, and false authority claims. A resolution does not replace due diligence, but it provides a higher-confidence anchor for verifying that the applicant has corporate backing for the requested action.
Where authority is distributed across directors, committees, or signatories, the resolution also reduces ambiguity. It can show whether authority is joint, sole, conditional, or limited to a particular account, product, jurisdiction, or threshold.
What a board resolution should evidence
A useful resolution is specific enough that a reviewer can understand the decision without guessing. It should normally identify the company, the approved action, the authorised person or persons, and the scope of authority being granted.
- It should name the entity making the decision and the date of approval.
- It should identify the exact person or role being authorised.
- It should describe the action, facility, account, or relationship covered.
- It should state any limits, such as monetary thresholds, signing conditions, or duration.
The stronger the specificity, the easier it is for compliance, banking, procurement, or platform teams to check that the authority presented matches the authority actually granted. Vague wording can leave room for dispute later, especially when the request involves payments, account changes, legal commitments, or privileged access to company systems.
How organisations should assess and use it
Board resolutions work best when they are treated as one piece of evidence inside a broader authority-checking process. Reviewers should compare the resolution with the company’s constitutional documents, director register, mandate records, and any identity evidence for the person who is acting on the company’s behalf.
That comparison is especially important when the resolution is old, unusually broad, or inconsistent with other corporate records. A valid-looking document can still be stale, incomplete, or out of step with current board membership and delegated powers.
Where electronic submission is accepted, organisations should also verify provenance and integrity, not just the wording. A resolution that cannot be tied back to the right entity, approval date, or authorised signatories is weak evidence, even if it appears professionally formatted.
Risk and Threat Considerations
Board resolutions are attractive to fraudsters because they can be used to create the appearance of legitimate corporate authority. If a false, altered, or outdated resolution is accepted, an attacker may be able to open accounts, redirect funds, change mandates, or obtain access under the company’s name.
Failure mechanism: Weak document verification, poor record reconciliation, or over-reliance on a single artefact can allow a forged or stale resolution to substitute for genuine corporate approval.
Impact: The result can be unauthorised onboarding, fraudulent instruction acceptance, loss of funds, or exposure of corporate systems and records to an unapproved representative.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-8 — Identification and Authentication (Non-Organizational Users) | Covers verifying external representatives acting for a company. |
| IA-5 — Authenticator Management | Supports lifecycle control over evidence used to prove authority or access. | |
| AC-2 — Account Management | Applies where resolutions authorize account creation or changes on behalf of an entity. | |
| Recommendation — Verify external users’ authority before granting access or onboarding actions. Manage credentials and related authenticators so stale authority cannot be reused. Tie account changes to documented approval and review authority. | ||
| NIST CSF 2.0 | GV.RR-01 — Roles, Responsibilities, and Authorities | Board resolutions define who may act and under what authority. |
| ID.AM-01 — Asset Inventory | Corporate authority checks depend on knowing the entity and related records in scope. | |
| Recommendation — Assign and document decision authority before acting on behalf of an organisation. Maintain accurate inventories of entities, records, and authorised relationships. | ||
Practitioner Guidance
Why practitioners should care: A board resolution is only useful when it clearly maps to the authority being relied on. Reviewers should confirm that the named person, action, and scope match the actual request, rather than assuming any resolution is sufficient for any corporate act.
What to watch for: Pay close attention to broad wording, missing dates, unsigned copies, and resolutions that do not align with current director or signatory records. Those are common signals that the document may be insufficient for the decision being made.
Practitioner takeaway: Treat the resolution as an evidence item, not a blanket permission slip, and verify it against the company’s current authority structure before relying on it.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org