> This is the Markdown of a Backed Help Centre page, https://admin.backed.giving/help/administrator/payments/permissions-and-separation.md. Every page is listed at https://admin.backed.giving/help/llms.txt.

> This page uses Backed's default terms, such as Funding Round and Application Template. An organisation may rename them, so read each as your organisation's own term if you've renamed it.

Payments are split between the people who prepare them and the people who approve them. Each step
needs its own permission, and every payment is also limited by the data access your admin group
has to the round it belongs to.

This appears only when Payments is turned on for your organisation. Labels that name `Payment`,
`Payment Batch`, `Milestone`, `Application` and `Applicant` use your organisation's own term if
you've renamed it.

## The two permissions

- `Can access Payments` opens the `Payments` menu. With it you can create a payment batch, add and
  edit payments, send a batch for review, mark an approved batch as paid, export it, make a bank
  file and send payment letters.
- `Can approve Payment Batches` lets you approve or decline the payment fields on a batch's
  `Review` step, approve a batch, return it to draft and choose a different reviewer.

Recording a refund, asking for a repayment, holding or releasing a tranche and voiding a payment
also need `Can access Payments`. See
[Refunds, repayments, holds and void and reissue](refunds-and-corrections.md).

Exporting a batch or making its bank file also needs `Can generate reports` or `Can generate
document reports`, so someone who can only view payments can't take a copy of them.

Without `Can access Payments` you don't see the menu or `Add Payment`, and asking for a payment
page directly is refused, whatever data access you have. Without `Can approve Payment Batches` the
approval controls are shown but can't be used.

Someone who prepared a batch can also approve it if they hold both permissions. To keep the two
apart, give `Can approve Payment Batches` only to the people who should approve.

## Data access

Your admin group's data access rules decide which payments you can reach, by round:

- `Full Access`: you can see and change the payment.
- `Read Only`: you can see the payment but not approve, change or delete it.
- `No Access`: the payment is hidden, and its page is not found.

Approving, marking paid, exporting and deleting a batch act on every payment in it, so they need
`Full Access` to every one of them. You can still see a batch where one payment is `Read Only` to
you, but those actions are refused until someone with full access to all of it takes them.

## Bank accounts

A payment is paid into the bank account on its contract, or on the applicant's profile when the
contract has none.

- Payment screens show only the last digits of the account. The whole number is shown, and
  exported, only to someone who can read the contract or applicant it comes from. Each time it is
  shown it is recorded.
- No payment screen can change a bank account. Accounts are changed on the contract or the
  applicant, by someone allowed to edit them. A finance administrator who can approve payments but
  only read contracts and applicants can see an account but never change it.
- Your organisation's own debit accounts, in `Settings > Profile and terms > Payments`,
  are saved sealed and only their last digits are ever shown again.

## What is recorded

Creating a batch, sending it for review, each finance decision, approving, marking paid, exporting,
making a bank file and sending letters are each recorded separately with who did it and when. The
entries can't be edited. They show on the batch's `History` tab and on each milestone's and
application's history.

## Payments on applications and contracts

An application's page and a contract's page show its tranches: "Total award <amount> · <n>
tranches", then each milestone with its amount and whether it is `Paid`, `Due` on a date, `Held` or
`Scheduled`. In-kind tranches sit apart under `In-kind support`, by declared value and by unit. See
[In-kind grants](in-kind.md). You see this with the permission to read the application or contract, while Payments
is turned on. An applicant's `Applications` tab links to the payment batches that pay them, when
you have `Can access Payments`.

## See also

- [Payments](index.md)
- [Reviewing and approving a payment batch](review-and-approval.md)
- [Exports and bank files](exports-and-bank-files.md)
- [Frequently asked questions about payments](faq-payments.md)