This article shares practical branch cash-custody habits for educational purposes. It is not regulatory, legal, or financial advice, and it does not claim BSP certification or examiner outcomes. Adapt the log to your company policies and your compliance officer’s guidance.
When a BSP examiner walks into a branch and asks who opened the vault this morning, “the cashier” is not an answer. They want a dated dual-control cash vault log that names two people, records the count, and shows both signatures—or your custody story collapses under a simple question.
Small Philippine lenders often run tight desks: one officer, one cashier, one metal drawer. Dual control still matters. It is not corporate theater. It is the paper trail that proves cash did not sit under a single key overnight, and that the open and close counts match what your LMS and float sheet say.
This guide is for branch managers and ops leads who need an examiner-friendly open/close habit without inventing fancy software first. You will get a door-sticker checklist, a key-custody split, a worked demo with illustrative pesos, failure modes, a decision framework, a 10-minute monthly rehearsal, and a soft note on where a lending LMS such as PesoLend can supply the expected cash-position column—while the dual signatures stay on the log.
Why dual control beats “trust the senior cashier”
Trust is fine until someone is sick, resigns mid-week, or the count is short by a few thousand pesos. Dual control means two authorized people must be present when the vault or cash drawer is opened or closed, and both attest to the count on the same line.
BSP examiners typically ask who held keys, who counted, and whether those roles were separated—not for perfect software. They want to reconstruct yesterday morning in five minutes from a bound log or scanned sheet. If your only record is a chat message (“opened na, ₱485k”), you will scramble. Transaction dual control for disbursements is a cousin habit—see maker-checker dual control for disburse and repay—but today’s focus is physical vault keys and open/close counts.
Who this is for — and who should skip
Build this ritual now if: you run a Philippine microfinance or money-lending desk that keeps overnight cash in a vault, safe, or locked drawer; one person still opens alone “because they are senior”; keys live in the same drawer; variances get fixed silently to match the float sheet; or a prior spot check left you hunting for a photo of last Tuesday’s count.
Deprioritize if: every open and close already requires two named signatories on a numbered log, keys are split and logged on leave, same-day scans live in a branch folder, and you can produce any date from the last thirty days in under ten minutes. Your next problem is probably morning disposable cash before the batch—not vault theater. Pair those desks with a cash position board for branch managers. Field complaint readiness for BSP is a different log entirely; keep that in your field complaint log playbook, not on the vault sheet.
What goes on the dual-control vault log
Keep one log book (or dated PDF sheet) per branch. Number the pages. No erasures—strike through and initial if you correct a line. Capture at least:
- Date and session — open (AM) or close (EOD); note if you reopen after lunch or after a holiday reopen.
- Key holders — Person A (primary key) and Person B (second key or witness). Full names, not nicknames.
- Opening count — denomination breakdown or sealed bag tags plus loose cash total.
- Expected vs actual — expected from prior close (and optional LMS cash-position figure); variance in pesos and a short reason if any.
- Signatures — both people sign the same row before cash leaves the vault for the day.
- Close count — same structure at end of day; both present again.
Optional but useful: write the LMS cash-position total or morning float-board figure beside the physical count so reconciliation is visible on one page. That expected column is a habit aid—not a branded vault product.
Original element: open / close checklist (stick this on the vault door)
| Step | Open (AM) | Close (EOD) |
|---|---|---|
| 1 | Both key holders present; no solo unlock | Both present; stop disbursements first |
| 2 | Write date, names, expected opening amount | Write date, names, expected close from prior float / LMS cash position |
| 3 | Count together; bag tags + loose cash | Count together; bag tags + loose cash |
| 4 | Log actual vs expected; note variance | Log actual vs expected; note variance |
| 5 | Both sign open line; issue working float to desk | Both sign close line; seal vault; keys separated |
| 6 | Photo or scan log page into branch folder (same day) | Photo or scan; match LMS end-of-day cash position |
If only one authorized person is on site, do not open the vault alone. Escalate: call the branch manager or ops lead, delay disbursements, or use a pre-agreed emergency witness listed on your role sheet. Solo opens are exactly what examiners flag. After Sundays or holidays, reopen with the same two-person rule using your Sunday and holiday desk coverage ownership list—do not “catch up” with a solo unlock because the market day is busy.
Key custody: two people, two places
Dual control fails if both keys live in the same drawer. Split custody:
- Primary key with the cashier (or vault custodian) during business hours.
- Second key or combination half with the branch manager or designated officer—not stored beside the first.
- After close, keys leave the branch with different people or go into separate sealed envelopes logged by name.
Rotate who holds the second key when someone goes on leave. Record the handoff on the same vault log (“Key B transferred from X to Y, date, both signed”). If your staff-role sheet already names who may touch cash, keep the vault key list aligned with that sheet so a substitute cannot invent authority on the morning of a shortage.
Worked demo: one-desk vs multi-branch (illustrative pesos)
Figures below are demo / illustrative data only—rewrite with your live open counts. They show how the dual-control cash vault log behaves when expected and actual diverge.
One-desk provincial branch (demo): Prior close ₱412,000. Cashier Ana (Key A) and Manager Ben (Key B) count sealed bags ₱360,000 + loose ₱51,500 = ₱411,500. Variance −₱500—“miscounted ₱500 note at close; recount confirmed.” Both sign open, issue ₱80,000 working float, scan before 9 a.m. At EOD they count ₱398,200 against LMS expected ₱398,200, sign close, separate keys. No silent fix.
Multi-branch area (demo): Branch North opens clean. Branch South’s Key B is on leave; Key A cannot open with an unauthorized co-officer. Delay South releases until the listed emergency witness arrives or Key B handoff is signed—do not borrow North’s second key without a logged transfer. Network open-time pressure does not override the two-name rule.
After the vault is honest: morning disposable cash lives on the cash position board; nightfall proof pairs with end-of-day float reconciliation.
Variances: write the story the same day
Short counts happen—miscounted bills, a receipt not posted, a field bag returned late. The control is not “never have a variance.” The control is: variance amount, who investigated, and how it was cleared, all on the open/close line or an attached exception slip the same day.
Carry unresolved variances into the next open as a visible expected adjustment. Do not “fix” the opening count to match the LMS without a signed note. Examiners read patterns; repeated silent fixes look worse than one explained shortage. If the gap came from a late field bag, tighten the visit-to-post habit with collection receipt discipline so tomorrow’s expected column is not fiction.
Failure modes (and quick fixes)
Solo open “just this once.” Block it. Use the emergency witness list or delay releases. One solo open teaches the branch that the log is optional.
Both keys in one drawer. Split custody and log handoffs. Dual signatures mean little if one person could have opened alone overnight.
Nicknames on the log. Full legal or payroll names only. Examiners match roster; “Ate Mel” does not.
Silent variance fixes. Write the pesos and the reason. Fixing the count to match the float sheet without a note creates a pattern examiners distrust.
Log lives in someone’s bag. Same-day scan or photo into a shared branch folder. The 10-minute rehearsal fails on filing, not on counting skill.
Chat-only open (“opened na”). Chat is not a dual-control cash vault log. Move the numbers onto the numbered page before cash leaves the vault.
Holiday catch-up unlock. Reopen with two authorized people after coverage days; do not compress two sessions onto one unsigned line.
Decision framework: open, delay, or escalate
- Two authorized key holders present, expected known, count matches. Sign open, issue working float, scan the page.
- Two present, variance found. Log amount and reason on the same line (or exception slip); escalate if above your policy threshold; do not erase.
- Only one authorized person on site. Do not open. Call ops, use listed emergency witness, or delay disbursements.
- Key B on leave without handoff. Complete a signed transfer before unlock—or treat as one-person case above.
- LMS / float expected missing. Still count with two people; write “expected from prior close only,” then post the system figure when available and note any gap—do not invent an expected number.
- Spot-check date requested. Produce open + close lines, roster proof for both signatories, expected match, and the scan within ten minutes.
Spot-check rehearsal (ten minutes, monthly)
Once a month, ops picks a random date from the last thirty days and asks the branch:
- Show the open and close lines for that date.
- Name the two signatories and confirm they were on the roster that day.
- Match the close amount to the LMS cash position or float board for the same date.
- Produce the scan or photo of that log page.
If the branch cannot do this in ten minutes, fix filing—not the LMS first. A clean dual-control log is worthless if it lives only in someone’s bag. Time the drill with a phone stopwatch; note which of the four steps failed and assign an owner before the next market week.
Where the LMS helps (and where paper still wins)
Your loan system can store end-of-day cash position and timestamps—use that as the “expected” column. The log still carries dual signatures and denomination count that software alone rarely captures at small-branch scale.
Stay inside Day-20 Must: multi-branch, staff roles, maker-checker, repayments, reports/PAR, reminder stubs, ops dashboard shell. The dual-control cash vault log is a paper/PDF habit—not a Dual-Control Vault Module SKU, float/treasury module, offline field app, AI score, native mobile rail, e-sign pack, or collections BI suite. Soft CTA: teams on PesoLend can walk cash-position views and mark which expected figures still need a sticky beside the vault sheet.
FAQs
Is a dual-control cash vault log the same as maker-checker on disbursements?
No. Maker-checker governs who approves money movement on the loan book. The vault log governs who held physical keys and attested to the open/close count. Run both; do not treat one as a substitute for the other.
Do we need denomination breakdown every time?
At minimum: sealed bag tags plus loose total, with both people watching. Full denomination sheets help when variances appear—use them when your policy or shortage size calls for it.
What if the examiner asks for software proof only?
Offer the LMS cash-position timestamp and the signed vault page for the same date. Software without dual signatures still leaves the “who held the key” question open.
Can the branch manager sign alone if the cashier is late?
No. Delay open or use the pre-listed emergency witness. A manager-only open is still single control.
How long should we keep the log?
Follow the retention period your compliance lead sets for cash records. Whatever the period, same-day scans make the monthly rehearsal survivable.
What to do next
Print one dual-control sheet, assign Key A and Key B by name, and run the open checklist once with both people present. This week: no solo unlocks, no same-drawer keys, no silent variance fixes, same-day scan every session. Schedule the first 10-minute rehearsal on a random date from last month.
When someone asks who held the key, you will have a dated line—not a shrug. Ready to check whether your cash-position view can feed the expected column? Log in to PesoLend and walk those numbers against tomorrow’s open line.