In October 2005, the Federal Financial Institutions Examination Council agencies¹ issued guidance entitled Authentication in an Internet Banking Environment. Since the issuance of the guidance, Internet-based fraud incidents have increased, particularly with respect to commercial² accounts and the use of automated payment mechanisms (e.g., wire transfers and automated clearinghouse payments). The agencies are issuing the attached supplement to the guidance to reinforce the guidance’s risk management framework and to update their expectations regarding customer authentication, layered security, and other controls in the increasingly hostile online environment.

It is essential that national banks review their current controls against the principles outlined in the guidance and supplement and, if necessary, develop and implement appropriate action plans to strengthen and enhance their controls. National banks should perform periodic risk assessments considering new and evolving threats to online accounts and have effective controls to limit and mitigate the elevated risks that are generally present with transactions of retail/consumer and business/commercial accounts. These controls must be tailored to, and appropriate for, each bank’s operations and threat environment. Examiners will continue to assess the adequacy of banks’ controls, including any remediation plans, as part of their ongoing supervision and the enhanced expectations outlined in the supplement, beginning in January 2012.

You may direct questions or comments regarding this guidance to your supervisory office or to the Bank Information Technology Division at (202) 874-4740.

Timothy W. Long
Senior Deputy Comptroller for Bank Supervision Policy
and Chief National Bank Examiner

Related Link

• FFIEC Authentication Supplement (PDF)