Has a user posted a bank voucher even though "Post vouchers" is turned off in their access group? This usually happens because the user has registered a payment on an invoice. That creates and posts a voucher against the bank account (for example 1920) – and that action is controlled by a permission under Invoicing, not only under Accounting.
In short: which permission controls what?
Registering a payment on a supplier invoice (posted against the bank): requires both Register or remove invoice payments (Invoicing) and Post vouchers and edit posted vouchers (Accounting).
Registering a payment on a customer invoice: requires only Register or remove invoice payments (Invoicing).
Creating a bank payment for approval: requires Create new payments for approval (Bank). This doesn't post anything.
Approving and sending payments to the bank: requires Approve and process bank payments (Bank).
Attesting vouchers and payments: requires Respond to attestations on your behalf (Approvals). The attestant doesn't need "Post vouchers".
Posting vouchers and sending vouchers for attestation: requires Post vouchers and edit posted vouchers (Accounting).
Supplier invoices
When you click Register payment on a supplier invoice, you can either register a payment that is posted straight away, or create a bank payment to be approved and sent to the bank.
If the user doesn't have Post vouchers and edit posted vouchers, the option for a posted payment is greyed out and the user sees the message:
"Registering a posted payment requires the permission "Post vouchers and edit posted vouchers". You can still create a bank payment."
If the user has access to bank payments, they can still create a bank payment. It isn't posted until it has been paid in the bank.
[SCREENSHOT 1: Register payment on a supplier invoice – posted payment greyed out with the message]
Note: This applies from October 2026. Vouchers posted this way before then may need to be corrected by the accountant.
Customer invoices
Payments on customer invoices (outgoing invoices) are controlled only by Register or remove invoice payments under Invoicing. If the user shouldn't register incoming payments themselves, turn this off.
Attestation
Users who only approve vouchers and payments don't need "Post vouchers".
When the last attestant approves a voucher, the voucher is posted on behalf of the person who sent it for attestation. The person who sends a voucher for attestation must have Post vouchers and edit posted vouchers themselves. In other words, an attestant can't post anything on their own – they complete a posting that someone with posting access has started.
Read more in Setting up attestation of vouchers and payments.
How to stop a user from posting anything
Go to Administration → User access → Permissions and open the access group the user belongs to.
Go to the Access tab.
Under Accounting: turn off Post vouchers and edit posted vouchers.
Under Invoicing: turn off Register or remove invoice payments.
Save your changes.
The user can still attest vouchers that others have sent for approval and – if the group allows it – create bank payments that someone else approves.
[SCREENSHOT 2: Access group – the Access tab with Accounting and Invoicing]
Important: A Member who isn't in any access group gets broad default access to the company modules. If a user should have limited permissions, they must be in an access group. Read more in Access control and user permissions in Catacloud.
Example: a typical association
Chair who attests: Respond to attestations on your behalf. No posting access.
Treasurer who pays: Approve and process bank payments. No posting access if the accountant does the posting.
Accountant: Post vouchers and edit posted vouchers, and sends vouchers for attestation.
Avoid having the same person both attest and pay. See Approval and payment – what's the difference, and who should do what?
When should you contact us?
Get in touch if a user can still post vouchers after both permissions above have been turned off. Include the client, the user, the voucher number and where in Catacloud the voucher was created – ideally with a screenshot of the access group.