The Debit Cards Nobody Told You About: A New Treasurer's Guide

If you're a new treasurer who has discovered your not-for-profit has debit cards with no receipts to match, the fix is a written card policy: every card on a register, an itemised receipt for every transaction, and a monthly bank statement check by someone who doesn't hold a card.

The Debit Cards Nobody Told You About: A New Treasurer's Guide

You've just become treasurer, you've opened the bank statement, and there they are — debit card transactions you knew nothing about, made by people you may never have met, with no receipts in sight. Here's the short answer: you're not in trouble, but the organisation has a control gap, and fixing it is simpler than you think. Cards on a register, receipts for every transaction, and a monthly check by someone who doesn't hold a card.

How this usually happens

Most new treasurers inherit the books at a handover meeting: a folder, some login details, and a warm "good luck." Nobody mentions the debit cards because, to everyone else, they're just how things have always been done. The coordinator buys the sausages, the maintenance volunteer buys the paint, and it all "comes out of the account."

Then you try to reconcile your first month and hit the problem. There are transactions on the statement with no paperwork behind them. You ask for receipts and get shrugs, a blurry photo of an eftpos slip, or "I think I threw it out."

None of this means anyone has done anything wrong. But right now, you can't prove that — and neither can they. That's the real problem.

Why a debit card is different

Almost every other payment your organisation makes needs two people. Two signatures on a cheque, two authorisations on an online transfer. A debit card needs one person, alone, at the checkout. No second approval, no delay, no questions.

That's exactly why cards are popular — and exactly why they need their own rules. Every control you put around a debit card is really doing one job: replacing the second signature the card skips.

There's a legal reason to care, too. If your organisation is incorporated in Queensland, committee members have personal duties under the Associations Incorporation Act 1981 (Qld), including a duty of care and diligence and a duty to keep financial records that correctly record and explain transactions. If it's a registered charity, the ACNC's Governance Standard 5 requires the committee to make sure the charity's financial affairs are managed responsibly. Cards with no rules and no receipts sit badly with both.

What to do in your first month

Start by finding out what actually exists. Ask the bank for a list of every card issued on the account, who holds each one, and what the limits are. You may be surprised — cards issued years ago to people long gone are more common than you'd think.

Then take it to the committee. Ask them to confirm, by resolution, which cards should exist, cancel the rest, and adopt a written debit card policy. A good policy covers a few essentials: one named person per card, no shared cards; sensible limits, applied by the bank where possible; no cash withdrawals; an itemised receipt and a stated purpose for every transaction, within a set number of days; and a monthly review of the bank statement by a committee member who doesn't hold a card. That last one matters for you personally — if the treasurer holds a card, someone else checks the treasurer's spending. Nobody ever reviews their own card.

For the missing receipts you've already inherited, don't turn it into an inquisition. Ask each cardholder to write and sign a short note of what each unreceipted purchase was for, present the list to the committee, minute it, and draw a line under it. From next month, the policy applies to everyone.

And keep debit cards separate in your head from gift cards. Gift cards are cash you've already spent that can walk out the door; debit cards are a live connection to your bank account. They need different controls — we've covered gift cards in a separate post.

A note for Queensland P&C Associations

If your organisation is a state school P&C, different rules apply — P&Cs aren't incorporated under the Associations Incorporation Act at all. They're formed under the Education (General Provisions) Act 2006 (Qld), and the Department of Education's P&C Accounting Manual sets the requirements. On debit cards, the manual is specific: cards may only be used for appropriately approved official purchases of $1,000 and under; they must not be used to withdraw cash; direct debit arrangements cannot be attached to the debit card account; and the debit card account must be set up as a separate account from the main bank account. Receipts must be retained for all transactions and the account reconciled monthly, with card transaction charges entered as an expense when the monthly bank statement is received. If your P&C is registered for GST, remember you also need a valid tax invoice for purchases over $82.50 (GST inclusive). If you're a P&C treasurer, download the current manual from the department and follow it — it overrides any general advice, including ours.

Discovering unexplained card spending in your first month doesn't make you a troublemaker for asking questions — it makes you a treasurer doing the job properly. Clear rules, applied to everyone, protect the honest volunteers who are the overwhelming majority. Once the policy is in place, nobody is ever under suspicion by default, including you.

If your committee would like a hand setting up card controls, or an independent review of how money moves in your organisation, we're always happy to talk.

Sample Volunteer Debit Card Policy

[Name of Association] Inc. — Volunteer Debit Card Policy

Version: [1.0] | Approved by: the Management Committee on [date], minute [number] | Next review: [date — no later than two years after approval] | Responsible officer: Treasurer

1. Purpose

This policy sets out when, how and by whom debit cards linked to the Association's bank account may be used. Its purpose is to make small, everyday purchases easier for volunteers while protecting the Association's money and protecting the volunteers who spend it.

Most association payments require two authorised people. A debit card lets one person spend the Association's money alone, at the point of sale, with no second approval. The controls in this policy replace the second signature that a card transaction skips.

2. Scope

This policy applies to every debit card issued on the Association's bank account, and to every person who holds or uses one — volunteers, management committee members and any staff (each a "cardholder"). It does not cover gift cards or prepaid cards, which are dealt with in the Association's Gift Card Policy, or credit cards, which the Association [does not use / covers in a separate policy].

3. Why the law requires these controls

The Association is incorporated under the Associations Incorporation Act 1981 (Qld) and is a registered charity regulated under the Australian Charities and Not-for-profits Commission Act 2012 (Cth). Management committee members owe statutory duties under Part 7 of the Queensland Act — including a duty of care and diligence (s 70E), a duty of good faith (s 70F), duties not to misuse their position or information (ss 70G–70H), a duty to disclose material personal interests (ss 70B–70C) and an obligation to keep financial records that correctly record and explain the Association's transactions (s 59). As a registered charity, the Association must also meet ACNC Governance Standard 5, which requires its Responsible People to ensure the charity's financial affairs are managed responsibly. This policy is practical evidence that the committee is meeting these duties.

4. Roles and responsibilities

Management Committee — approves the issue and cancellation of every card by resolution; sets and reviews card limits; receives a monthly card report; reviews this policy at least every two years.

Treasurer — maintains the Debit Card Register; reconciles card transactions to the bank statement monthly; follows up missing receipts; reports card spending to each committee meeting. The Treasurer never reviews their own card.

Cardholder — uses the card only as this policy allows; keeps the card and PIN secure; provides receipts and a stated purpose for every transaction; returns the card on request or on leaving the role.

Independent reviewer — a committee member who is not a cardholder (for example the President or Secretary) who sights the full bank statement each month and reviews the Treasurer's card, if the Treasurer holds one.

5. Issuing a card

• A card may only be issued after a resolution of the Management Committee, recorded in the minutes, naming the cardholder, the reason a card is needed, and the card's limits.

• Cards are issued to a named individual. Shared or "office" cards are not permitted, because they make it impossible to know who spent the money.

• Before receiving a card, the cardholder must sign a cardholder agreement and be given a copy of this policy.

• The Treasurer records every card in the Debit Card Register, including limits, issue date and return date.

• The committee keeps the number of cards to the minimum genuinely needed — every extra card is an extra door into the bank account.

6. Card limits

Unless the committee resolves otherwise, the default limits are: single transaction $[200]; daily $[500]; monthly per card $[1,000]; cash withdrawals (ATM or eftpos cash-out) not permitted — $0. The committee asks the bank to apply these limits at account level wherever the bank's products allow.

Purchases above the single transaction limit must be approved in advance in writing (email is fine) by [two committee members / the President and Treasurer], and the approval kept with the receipt. Splitting a purchase into smaller transactions to stay under a limit is a breach of this policy. Where the bank offers them, transaction alerts should be sent to the Treasurer and one other committee member.

7. Using the card

Permitted: purchases of goods and services for the Association's purposes only, within an approved budget or with prior committee approval. Online purchases only from reputable merchants, keeping the order confirmation as well as the receipt.

Prohibited:

• any personal expenditure, even if the cardholder intends to repay it — "borrowing" from the Association is never acceptable;

• ATM withdrawals and eftpos cash-out — cash needs are met through petty cash or reimbursement procedures;

• recurring payments, subscriptions or direct debits set up against the card without a committee resolution;

• gambling, alcohol [unless specifically approved for an Association event], fuel for private vehicles, and cash-like products such as gift cards or money transfers (gift cards are bought only under the Gift Card Policy); and

• letting any other person use the card or PIN, including other volunteers, family members and committee members.

Security: keep the card secure and the PIN secret — never written down with the card, never shared with anyone, including the Treasurer. Report a lost, stolen or compromised card to the bank immediately and to the Treasurer within 24 hours. Do not save card details in shared browsers or on merchant websites accessed by others.

8. Receipts, records and monthly checks

For every transaction the cardholder gives the Treasurer, within [7] days, the itemised receipt or tax invoice (not just the eftpos slip) and a short note of the purpose and, where relevant, the event or budget line it relates to. If a receipt is genuinely lost, the cardholder completes a signed missing-receipt declaration; more than [two] declarations in a year triggers a committee review of the card.

Each month the Treasurer matches every card transaction on the bank statement to a receipt and records it in the accounts. Card spending is reported at each committee meeting, showing each card, the month's total and any missing documentation, and the minutes note that the report was received.

Because a debit card removes the two-to-sign control, someone other than the cardholder must always check the spending. A committee member who is not a cardholder sights the full bank statement each month and signs or initials it as reviewed. If the Treasurer holds a card, the independent reviewer checks the Treasurer's transactions. No one ever reviews their own card.

9. Returning cards, breaches and review

A card must be returned, and the bank instructed to cancel it, when the cardholder leaves their role, when the committee resolves to withdraw it, or when it is no longer needed. Card cancellations are checked as part of the handover whenever committee positions change.

A breach of this policy is reported to the Management Committee. Depending on its seriousness the committee may require repayment, withdraw the card, remove the volunteer from their role, or — where dishonesty is involved — report the matter to the police and, if the breach materially affects the charity, notify the ACNC. Treating breaches consistently protects honest volunteers: clear rules, applied to everyone, mean no one is ever under suspicion by default.

10. Policy Review

The Management Committee reviews this policy at least every [two] years, when the bank changes its card products, or after any breach — whichever comes first.