[$250] Approver without business bank account sees “Pay X reports” To Do in New Expensify

[m-natarajan]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.3.16-9
Reproducible in staging?: Needs Reproduction (Unable to reproduce)
Reproducible in production?: Needs Reproduction
If this was caught during regression testing, add the test name, ID and link from BrowserStack:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Expensify/Expensify Issue URL:
Issue reported by: @AHowell14
Slack conversation (hyperlinked to channel name): #Expensify Bugs

Action Performed:

1. Log into New Expensify on Web as a report approver who does not have the business bank account connected in their Wallet
2. From the left-hand navigation, click on Home
3. Observe the To Do section: note the “Pay X reports” task
4. Click on Reports
5. Under the To Do tab/list, observe that “Pay X reports” is also displayed

Expected Result:

If the user does not have the relevant business bank account connected in their Wallet (and therefore cannot pay workspace reports), they should not see a “Pay X reports” task.

Actual Result:

The approver sees a “Pay X reports” task on both the Home page and the Reports To Do section, despite not having the business bank account in their Wallet.

Workaround:

Unknown

Platforms:

Select the officially supported platforms where the issue was reproduced:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

The screenshot for the issue is in Slack thread

View all open jobs on GitHub

Issue Owner

Current Issue Owner: @iwiznia

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022021719704673633288
• Upwork Job ID: 2021719704673633288
• Last Price Increase: 2026-02-11

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @dominictb (External)

[melvin-bot]

Triggered auto assignment to @kadiealexander (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~022021719704673633288

[MelvinBot]

This has been labelled "Needs Reproduction". Follow the steps here: https://stackoverflowteams.com/c/expensify/questions/16989

[dominictb]

@kadiealexander Please reassign this as I'm off-boarding

[mukhrr]

Proposal

Please re-state the problem that we are trying to solve in this issue.

When an approver (or admin) on a workspace does not have the business bank account connected in their Wallet, they still see a "Pay X reports" task on both the Home page's For You section and the Reports To Do section. This is misleading because the user cannot actually process the payments without access to the business bank account, creating a dead-end experience.

What is the root cause of that problem?

The root cause is in the isPayer() function in ReportUtils.ts, which determines whether the current user can pay a given report. This function has two code paths that return true without verifying the user has access to the workspace's business bank account:

1. REIMBURSEMENT_YES with no reimburser set (line 2775): Returns isAdmin directly — any workspace admin is treated as a payer without checking bank account access.
2. REIMBURSEMENT_YES with reimburser set (line 2787): Returns isReimburser || (isAdmin && hasAccessToBankAccount) — the reimburser bypasses the bank account access check entirely, while only non-reimburser admins are validated against the sharees list.

The bank account access variables (bankAccountID, bankAccount, hasAccessToBankAccount) are declared after the early return on line 2775, so they are never evaluated in the "no reimburser" path.

App/src/libs/ReportUtils.ts

Lines 2737 to 2791 in e2df51a

	function isPayer(
	currentAccountID: number | undefined,
	currentUserEmailParam: string | undefined,
	iouReport: OnyxEntry<Report>,
	bankAccountList: OnyxEntry<BankAccountList>,
	reportPolicy?: OnyxInputOrEntry<Policy>,
	onlyShowPayElsewhere = false,
	) {
	const policy = reportPolicy ?? allPolicies?.[`${ONYXKEYS.COLLECTION.POLICY}${iouReport?.policyID}`];
	// If the report belongs to a workspace, verify the user is still a member
	// When a user leaves a workspace, they may no longer have access to the policy data,
	// or the policy.role/employeeList may be stale
	// Skip this check for IOU reports (personal 1:1 expenses) since they can inherit a policyID
	// from the chat report but the payer may not be a member of that workspace
	if (!isIOUReport(iouReport) && iouReport?.policyID && iouReport.policyID !== CONST.POLICY.ID_FAKE) {
	// No policy data means user likely left the workspace
	if (!policy) {
	return false;
	}
	// For paid group policies, verify membership via employeeList (only when loaded)
	// employeeList may be lazily loaded/partial, so only check if it's present
	if (isPaidGroupPolicy(iouReport) && !isEmptyObject(policy?.employeeList) && !isPolicyMemberWithoutPendingDelete(currentUserEmailParam, policy)) {
	return false;
	}
	}
	const policyType = policy?.type;
	const isAdmin = policyType !== CONST.POLICY.TYPE.PERSONAL && policy?.role === CONST.POLICY.ROLE.ADMIN;
	const isManager = iouReport?.managerID === currentAccountID;
	const reimbursementChoice = policy?.reimbursementChoice;
	if (isPaidGroupPolicy(iouReport)) {
	if (reimbursementChoice === CONST.POLICY.REIMBURSEMENT_CHOICES.REIMBURSEMENT_YES) {
	if (!policy?.achAccount?.reimburser) {
	return isAdmin;
	}
	// If user is the reimburser, or a policy admin with access to the business bank account via sharees, they can pay.
	const isReimburser = currentUserEmailParam === policy?.achAccount?.reimburser;
	// Check if the current user has access to the bank account via sharees
	const bankAccountID = policy?.achAccount?.bankAccountID;
	const bankAccount = bankAccountID ? bankAccountList?.[bankAccountID] : null;
	const hasAccessToBankAccount = currentUserEmailParam && bankAccount?.accountData?.sharees ? bankAccount.accountData.sharees.includes(currentUserEmailParam) : false;
	return isReimburser || (isAdmin && hasAccessToBankAccount);
	}
	if (reimbursementChoice === CONST.POLICY.REIMBURSEMENT_CHOICES.REIMBURSEMENT_MANUAL || onlyShowPayElsewhere) {
	return isAdmin;
	}
	return false;
	}
	return isAdmin || (isMoneyRequestReport(iouReport) && isManager);
	}

This isPayer function is called by isPrimaryPayAction() in the todos derived state computation, which populates reportsToPay. The count of reportsToPay drives the "Pay X reports" widget on both the Home page (ForYouSection) and the badge count in the Reports To Do section.

App/src/libs/actions/OnyxDerived/configs/todos.ts

Lines 67 to 69 in e2df51a

	if (isPrimaryPayAction(report, currentUserAccountID, login, bankAccountList, policy, reportNameValuePair)) {
	reportsToPay.push(report);
	}

Additionally, isPolicyPayer() in PolicyUtils.ts (used by getSuggestedSearchesVisibility() to control whether the "Pay" row appears in the Reports To Do section) never considers bank account access at all — it only checks if the user is the designated reimburser or an admin.

App/src/libs/PolicyUtils.ts

Lines 426 to 443 in e2df51a

	function isPolicyPayer(policy: OnyxEntry<Policy>, currentUserLogin: string | undefined): boolean {
	if (!policy) {
	return false;
	}
	const isAdmin = policy.role === CONST.POLICY.ROLE.ADMIN;
	const isReimburser = policy.reimburser === currentUserLogin;
	if (policy.reimbursementChoice === CONST.POLICY.REIMBURSEMENT_CHOICES.REIMBURSEMENT_YES) {
	return policy.reimburser ? isReimburser : isAdmin;
	}
	if (policy.reimbursementChoice === CONST.POLICY.REIMBURSEMENT_CHOICES.REIMBURSEMENT_MANUAL) {
	return isAdmin;
	}
	return false;
	}

What changes do you think we should make in order to solve the problem?

1. Fix isPayer() in src/libs/ReportUtils.ts: Move the bank account access check (bankAccountID, bankAccount, hasAccessToBankAccount) before the early return for the "no reimburser" path. Then require bank account access for both the reimburser and admin paths under REIMBURSEMENT_YES. Specifically:
   • When no reimburser is set: require isAdmin && hasAccessToBankAccount (instead of just isAdmin)
   • When reimburser is set: require (isReimburser && !!bankAccount) || (isAdmin && hasAccessToBankAccount) — the reimburser must have the bank account in their bankAccountList, and admins must be in the sharees list

App/src/libs/ReportUtils.ts

Lines 2769 to 2788 in e2df51a

	if (isPaidGroupPolicy(iouReport)) {
	if (reimbursementChoice === CONST.POLICY.REIMBURSEMENT_CHOICES.REIMBURSEMENT_YES) {
	if (!policy?.achAccount?.reimburser) {
	return isAdmin;
	}
	// If user is the reimburser, or a policy admin with access to the business bank account via sharees, they can pay.
	const isReimburser = currentUserEmailParam === policy?.achAccount?.reimburser;
	// Check if the current user has access to the bank account via sharees
	const bankAccountID = policy?.achAccount?.bankAccountID;
	const bankAccount = bankAccountID ? bankAccountList?.[bankAccountID] : null;
	const hasAccessToBankAccount = currentUserEmailParam && bankAccount?.accountData?.sharees ? bankAccount.accountData.sharees.includes(currentUserEmailParam) : false;
	return isReimburser || (isAdmin && hasAccessToBankAccount);
	}
	if (reimbursementChoice === CONST.POLICY.REIMBURSEMENT_CHOICES.REIMBURSEMENT_MANUAL || onlyShowPayElsewhere) {
	return isAdmin;
	}
	return false;

--- a/src/libs/ReportUtils.ts
+++ b/src/libs/ReportUtils.ts
@@ -2773,16 +2773,18 @@
     if (isPaidGroupPolicy(iouReport)) {
         if (reimbursementChoice === CONST.POLICY.REIMBURSEMENT_CHOICES.REIMBURSEMENT_YES) {
+            // Check if the current user has access to the business bank account
+            const bankAccountID = policy?.achAccount?.bankAccountID;
+            const bankAccount = bankAccountID ? bankAccountList?.[bankAccountID] : null;
+            const hasAccessToBankAccount = currentUserEmailParam && bankAccount?.accountData?.sharees ? bankAccount.accountData.sharees.includes(currentUserEmailParam) : false;
+
             if (!policy?.achAccount?.reimburser) {
-                return isAdmin;
+                return isAdmin && hasAccessToBankAccount;
             }

-            // If user is the reimburser, or a policy admin with access to the business bank account via sharees, they can pay.
             const isReimburser = currentUserEmailParam === policy?.achAccount?.reimburser;
-
-            // Check if the current user has access to the bank account via sharees
-            const bankAccountID = policy?.achAccount?.bankAccountID;
-            const bankAccount = bankAccountID ? bankAccountList?.[bankAccountID] : null;
-            const hasAccessToBankAccount = currentUserEmailParam && bankAccount?.accountData?.sharees ? bankAccount.accountData.sharees.includes(currentUserEmailParam) : false;
-
-            return isReimburser || (isAdmin && hasAccessToBankAccount);
+            return (isReimburser && !!bankAccount) || (isAdmin && hasAccessToBankAccount);
         }

2. Fix isPolicyPayer() in src/libs/PolicyUtils.ts: Add a check that the workspace has a verified business bank account (VBBA) before returning true. If policy.achAccount?.bankAccountID is missing or policy.achAccount?.state is not OPEN, the user cannot pay, so isPolicyPayer should return false. This prevents the "Pay" row from appearing in the Reports To Do section when there's no usable bank account on the workspace.

App/src/libs/PolicyUtils.ts

Lines 426 to 443 in e2df51a

	function isPolicyPayer(policy: OnyxEntry<Policy>, currentUserLogin: string | undefined): boolean {
	if (!policy) {
	return false;
	}
	const isAdmin = policy.role === CONST.POLICY.ROLE.ADMIN;
	const isReimburser = policy.reimburser === currentUserLogin;
	if (policy.reimbursementChoice === CONST.POLICY.REIMBURSEMENT_CHOICES.REIMBURSEMENT_YES) {
	return policy.reimburser ? isReimburser : isAdmin;
	}
	if (policy.reimbursementChoice === CONST.POLICY.REIMBURSEMENT_CHOICES.REIMBURSEMENT_MANUAL) {
	return isAdmin;
	}
	return false;
	}

--- a/src/libs/PolicyUtils.ts
+++ b/src/libs/PolicyUtils.ts
@@ -419,6 +419,9 @@
 function isPolicyPayer(policy: OnyxEntry<Policy>, currentUserLogin: string | undefined): boolean {
     ...
+    const hasVBBA = !!policy.achAccount?.bankAccountID && policy.achAccount?.state === CONST.BANK_ACCOUNT.STATE.OPEN;
+
     if (policy.reimbursementChoice === CONST.POLICY.REIMBURSEMENT_CHOICES.REIMBURSEMENT_YES) {
+        if (!hasVBBA) {
+            return false;
+        }
         return policy.reimburser ? isReimburser : isAdmin;
     }

What alternative solutions did you explore? (Optional)