Security Hardening

How to Assign Binance Sub-Account Permissions? A Tutorial on Multi-Role Hierarchical Configuration

A complete configuration guide for the Binance Sub-Account system: differences between Main/Sub/Virtual accounts, separation of Spot/Futures permissions, internal transfer limits, independent API keys, and corporate multi-role approval workflows, with a team responsibility matrix included.

The Binance Sub-Account system allows you to create multiple independent identities under a single main account. Assets, APIs, and trading histories are completely isolated, making it an essential tool for institutions, funds, and high-net-worth individuals. Its core value lies in permission minimization, risk isolation, and independent auditing. The configuration entry can be found on the Binance Official Website under Account → Sub-Account; you can also create them via the app—first download the Binance Official App. This article covers the 8 sections: sub-account types, creation process, permission granularity, internal transfer rules, API isolation, corporate multi-roles, risk isolation testing, and common errors.

1. The Three Types of Sub-Accounts

Comparison of Types

Type Identifier Creation Threshold Use Case
Standard Sub-Account Sub Account Main account has completed KYC L2 Personal multi-strategies, family member sub-accounts
Virtual Sub-Account Virtual Sub No KYC needed (shares main account KYC) Internal institutional strategies, market-making teams
Managed Sub-Account Managed Sub Corporate VIP 9/Institutional application Funds disclosing independently to LPs

Virtual sub-accounts are the most common: they don't require a new email or separate KYC, but assets and APIs remain fully independent.

Limits Comparison

Item Main Account VIP 0 Virtual Sub-Account
Creation Limit Initially 20 Increases with VIP level
Daily Internal Transfers Unlimited Unlimited
Max Single Transfer Based on asset type Based on asset type
Independent API Yes Yes
Independent 2FA Yes No (shares main account 2FA)
Independent Login Password Yes No (switch via main account)

2. Steps to Create a Sub-Account

Web Interface

  1. Log in to the main account on binance.com → Click the profile icon → Sub-Account.
  2. Click Create Sub-Account.
  3. Select Type:
    • Standard: Requires email + password; the sub-account logs in independently.
    • Virtual: Only requires an Alias; switch via the main account dropdown.
  4. Fill in the Alias (e.g., Quant-Strategy-Alpha, OTC-Desk).
  5. Select Account Type:
    • Unified Account (UA): Unified account mode, where Spot/Margin/Futures share collateral.
    • Classic Account: Classic mode, where Spot/Margin/Futures are independent.

Once completed, the sub-account appears in the list showing its Alias, UID, creation time, and status.

Mobile App

App → Account → Sub-Account → + → Fill in the form. Currently, the app only supports Virtual Sub-Accounts; Standard ones must be created on the web.

3. Permission Granularity Configuration

Configurable Dimensions for Sub-Accounts

Dimension Description Default
Spot Allow/Disable spot trading Enabled
Margin Allow/Disable Cross or Isolated Margin Disabled
Futures Allow/Disable USD-M or COIN-M Disabled
Options Allow/Disable Disabled
Withdraw Allow/Disable Disabled
Internal Transfer Sub-to-Main / Sub-to-Sub Enabled
Fiat Allow P2P/Quick Buy Disabled

These can be toggled under Sub-Account → Management → Settings. It is recommended to follow the "Disable by default, enable as needed" principle.

Typical Scenario Configurations

Role Spot Margin Futures Withdraw Internal
Quant Spot Strategy
Quant Futures Strategy
Risk Hedging Account
OTC Large Desk
Audit Read-Only Account

4. Internal Transfer Rules

Internal transfers between sub-accounts and between sub-accounts and the main account are fee-free and instant.

Transfer Entry

Main Account → Sub-Account → Select a sub-account → Asset ManagementTransfer.

  • Main → Sub: Allocate trading capital to a strategy.
  • Sub → Main: Collect profits from a strategy.
  • Sub → Sub: Rebalance across different strategies.

Limits and Risk Control

Scenario Limit Risk Control
Main → Sub Based on main account assets Instant
Sub → Main Based on sub-account assets Instant
Sub → Sub Based on source account assets Instant
Any → External Address Follows withdrawal process 24-hour whitelist rule

Transfers between sub-accounts do not appear in withdrawal records; they are logged only in the "Internal Transfer Logs" for independent auditing.

5. Independent API Management for Sub-Accounts

Each sub-account has its own independent API Management interface:

  1. Log in to the main account → Select the sub-account → API Management.
  2. Create an API Key (valid only for that sub-account; cannot access main account assets).
  3. Set Permissions: Read / Spot Trade / Margin / Futures / Withdraw.
  4. Bind IP Whitelist (Mandatory).
  5. Save API Key + Secret.

Environment Variable Template

# ~/.zshrc or ~/.bash_profile
# Main Account
export BINANCE_MAIN_KEY="xxxx..."
export BINANCE_MAIN_SECRET="xxxx..."

# Virtual Sub-Account - Alpha Strategy
export BINANCE_SUB_ALPHA_KEY="xxxx..."
export BINANCE_SUB_ALPHA_SECRET="xxxx..."

# Virtual Sub-Account - Beta Futures Hedge
export BINANCE_SUB_BETA_KEY="xxxx..."
export BINANCE_SUB_BETA_SECRET="xxxx..."

Reference these in your quant code using os.getenv('BINANCE_SUB_ALPHA_KEY'), never hard-coding them. Add .env files to your .gitignore.

6. Corporate Multi-Role Approval

Corporate Accounts support multi-role permission splitting:

Role Permission Scope
Owner Full permissions; the only one who can create/delete accounts.
Admin Configures permissions, creates APIs, adds whitelists.
Trader Trading only; no withdrawals or transfers.
Withdrawal Officer Approval only for withdrawals.
Auditor Read-only; can view trades and capital flow.

Example Multi-Sig Withdrawal Process

1. Trader initiates withdrawal request → Status: Pending.
2. Withdrawal Officer #1 approves (requires 2FA).
3. Withdrawal Officer #2 approves (requires 2FA).
4. Owner provides final confirmation if above a threshold.
5. Executed after all approvals.

Tiered limits:

policy:
  tier_1: {amount: < $10000, approvals: 1}
  tier_2: {amount: $10000 - $100000, approvals: 2}
  tier_3: {amount: > $100000, approvals: 2 + Owner}

Configuration entry: Corporate → Permission Management → Policy.

7. Risk Isolation Testing

After creating a sub-account, it's crucial to perform an isolation test:

Test 1: API Unauthorized Access

Use the API Key for Sub-Account A to call /sapi/v1/capital/withdraw/apply to request a withdrawal to a whitelisted address for Sub-Account A. It should return Invalid API-key, IP, or permissions for action (if the Withdraw permission is not enabled).

Test 2: Cross-Account Transfer

Use the API for Sub-Account A to attempt to transfer funds to the main account. This should succeed, as internal transfers are enabled by default.

Test 3: Trading Limits

Use Sub-Account B (without Futures permission) to call /fapi/v1/order to place a futures order. It should return Feature not allowed on this account.

Passing these three tests confirms that your permission matrix is active.

8. Common Errors

Error Reason Action
Sub-account creation limit reached Hit quota limit Upgrade VIP level
Invalid account state Sub-account is frozen Contact customer support to unfreeze
Permission denied Permission not enabled or API Key lacks permission Check sub-account permissions + API permissions
Internal transfer blocked Triggered risk control Wait 10 mins and retry or contact support
KYC mismatch Standard sub-account KYC differs from main Use the same individual to complete KYC

FAQ

Q1: What is the core difference between a Virtual Sub-Account and a Standard Sub-Account?

A: A Virtual Sub-Account shares the main account's KYC, email, 2FA, and login; only assets and APIs are isolated. A Standard Sub-Account has its own independent email, password, and 2FA for completely separate logins. Choose Virtual for personal use; use Standard for team members.

Q2: Can the main account see the trading records of sub-accounts?

A: Yes. The main account has "view access" to sub-accounts and can see balances, trading histories, and API Key lists for every sub-account. This is for auditing and compliance; sub-accounts cannot hide data from the main account.

Q3: Can sub-accounts participate independently in Binance Earn or Launchpool?

A: Yes. A sub-account functions like an independent user and can participate in all products, including Simple Earn, Launchpad, Launchpool, and Copy Trading. However, KYC limits are calculated globally based on the main account's KYC level.

Q4: If a sub-account is frozen, does it affect the main account?

A: Usually not. Risk control issues (e.g., triggering AML rules) for a sub-account only freeze that specific account's assets and trades; the main account and other sub-accounts continue to operate normally. However, severe issues like KYC forgery might affect the main account as well.

Q5: Can I convert a corporate account to a personal one or vice-versa?

A: No, cross-conversion is not supported. Corporate and personal accounts are two independent types and must be created separately. If a company wants to transfer assets to an individual, it must be done via a withdrawal to the individual's address.

Keep reading: Return to the Category Navigation to enter the "Security Hardening" category for tutorials on API key protection, hardware wallets, and more.

Keep reading

Still have Binance questions? Head back to the category page for more tutorials on the same topic.

Categories

Related tutorials

Binance Account Security Essentials: Top Settings to Prevent Theft 2026-04-13 How to Bind Binance Google Authenticator? Detailed 2FA Activation Steps 2026-04-14 What is a Binance Anti-Phishing Code? Setup and Email Identification Guide 2026-04-14 How to Set Up Binance Withdrawal Address Whitelist? Complete Management Guide 2026-04-14