diff --git a/addons/account/security/account_security.xml b/addons/account/security/account_security.xml
index 0ea90c4dbe6..8e08ed1693e 100644
--- a/addons/account/security/account_security.xml
+++ b/addons/account/security/account_security.xml
@@ -299,5 +299,17 @@
         <field name="model_id" ref="model_account_report_external_value"/>
         <field name="domain_force">[('company_id', 'in', company_ids)]</field>
     </record>
+
+    <!--
+        Allow billing officers from accessing res.partner.bank
+        This right is restricted in HR to prevent accessing
+        employees bank account for non HR people.
+    -->
+    <record id="ir_rule_res_partner_bank_billing_officers" model="ir.rule">
+        <field name="name">Billing: Allow accessing employee bank accounts</field>
+        <field name="model_id" ref="base.model_res_partner_bank"/>
+        <field name="domain_force">[(1, '=', 1)]</field>
+        <field name="groups" eval="[(4, ref('account.group_account_invoice'))]"/>
+    </record>
 </data>
 </odoo>
diff --git a/addons/hr/security/hr_security.xml b/addons/hr/security/hr_security.xml
index 717928e00db..f9fccadd833 100644
--- a/addons/hr/security/hr_security.xml
+++ b/addons/hr/security/hr_security.xml
@@ -72,5 +72,19 @@
         <field name="model_id" ref="model_hr_plan_employee_activity"/>
         <field name="domain_force">['|', ('user_id', '=', user.id), ('activity_ids.user_id', '=', user.id)]</field>
     </record>
+
+    <record id="ir_rule_res_partner_bank_internal_users" model="ir.rule">
+        <field name="name">HR: Prevent non HR officers from accessing employee bank accounts</field>
+        <field name="model_id" ref="base.model_res_partner_bank"/>
+        <field name="domain_force">[('partner_id.employee_ids', '=', False)]</field>
+        <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+    </record>
+
+    <record id="ir_rule_res_partner_bank_employees" model="ir.rule">
+        <field name="name">HR: Allow HR officers from accessing employee bank accounts</field>
+        <field name="model_id" ref="base.model_res_partner_bank"/>
+        <field name="domain_force">[(1, '=', 1)]</field>
+        <field name="groups" eval="[(4, ref('hr.group_hr_user'))]"/>
+    </record>
 </data>
 </odoo>