Booklet: E-Banking Section: Risk Management of E-Banking Activities

Previous Subsection Table of Contents Next Subsection

As noted in the prior section, e-banking has unique characteristics that may increase an institution’s overall risk profile and the level of risks associated with traditional financial services, particularly strategic, operational, legal, and reputation risks. These unique e-banking characteristics include:

Management should review each of the processes discussed in this section to adapt and expand the institution’s risk management practices as necessary to address the risks posed by e-banking activities. While these processes mirror those discussed in other booklets of the IT Handbook, they are discussed below from an e-banking perspective. For more detailed information on each of these processes, the reader should review the corresponding booklet of the IT Handbook.

BOARD AND MANAGEMENT OVERSIGHT

Action Summary

E-BANKING STRATEGY
Financial institution management should choose the level of e-banking services provided to various customer segments based on customer needs and the institution’s risk assessment considerations. Institutions should reach this decision through a board-approved, e-banking strategy that considers factors such as customer demand, competition, expertise, implementation expense, maintenance costs, and capital support. Some institutions may choose not to provide e-banking services or to limit e-banking services to an informational website. Financial institutions should periodically re-evaluate this decision to ensure it remains appropriate for the institution’s overall business strategy. Institutions may define success in many ways including growth in market share, expanding customer relationships, expense reduction, or new revenue generation. If the financial institution determines that a transactional website is appropriate, the next decision is the range of products and services to make available electronically to its customers. To deliver those products and services, the financial institution may have more than one website or multiple pages within a website for various business lines.

COST-BENEFIT ANALYSIS AND RISK ASSESSMENT
Financial institutions should base any decision to implement e-banking products and services on a thorough analysis of the costs and benefits associated with such action. Some of the reasons institutions offer e-banking services include:

The individuals conducting the cost-benefit analysis should clearly understand the risks associated with e-banking so that cost considerations fully incorporate appropriate risk mitigation controls. Without such expertise, the cost-benefit analysis will most likely underestimate the time and resources needed to properly oversee e-banking activities, particularly the level of technical expertise needed to provide competent oversight of in-house or outsourced activities. In addition to the obvious costs for personnel, hardware, software, and communications, the analysis should also consider:

MONITORING AND ACCOUNTABILITY
Once an institution implements its e-banking strategy, the board and management should periodically evaluate the strategy’s effectiveness. A key aspect of such an evaluation is the comparison of actual e-banking acceptance and performance to the institution’s goals and expectations. Some items that the institution might use to monitor the success and cost effectiveness of its e-banking strategy include:

Without clearly defined and measurable goals, management will be unable to determine if e-banking services are meeting the customers’ needs as well as the institution’s growth and profitability expectations.

In evaluating the effectiveness of the institution’s e-banking strategy, the board should also consider whether appropriate policies and procedures are in effect and whether risks are properly controlled. Unless the initial strategy establishes clear accountability for the development of policies and controls, the board will be unable to determine where and why breakdowns in the risk control process occurred.

AUDIT
An important component of monitoring is an appropriate independent audit function. Financial institutions offering e-banking products and services should expand their audit coverage commensurate with the increased complexity and risks inherent in e-banking activities. Financial institutions offering e-banking services should ensure the audit program expands to include:

MANAGING OUTSOURCING RELATIONSHIPS

Action Summary

DUE DILIGENCE FOR OUTSOURCING SOLUTIONS
A key consideration in preparing an e-banking cost-benefit analysis is whether the financial institution supports e-banking services in-house or outsources support to one or more third parties (i.e., a technology service provider or TSP). Transactional e-banking is typically a front-end system that relies on a programming link called an interface to transfer information and transactions between the e-banking system and the institution’s core processing applications (e.g., loans, deposits, asset management). Such interfaces can be between in-house systems, outsourced systems, or a combination of both. This flexibility allows institutions to select those products and services that best meet their e-banking needs, but it can also complicate the vendor oversight process when multiple vendors are involved. Choosing to use the services of one or more TSPs can help financial institutions manage costs, obtain necessary expertise, expand customer product offerings, and improve service quality. However, this choice does not absolve financial institutions from understanding and managing the risks associated with TSP services. In fact, service providers may introduce additional risks and interdependencies that financial institutions must understand and manage.

Table 2 below summarizes some of the advantages and disadvantages of supporting technology-based products and services in-house versus contracting for support with a TSP. Regardless of whether an institution’s e-banking services are outsourced or processed in-house, the institution should periodically review whether this arrangement continues to meet current and anticipated future needs.

Table 2: Advantages and Disadvantages of Common Processing Alternatives

CONTRACTS FOR THIRD-PARTY SERVICES
As with all outsourced financial services, institutions must have a formal contract with the TSP that clearly addresses the duties and responsibilities of the parties involved. In the past, some institutions have had informal security expectations for software vendors or Internet access providers that had never been committed to writing. This lack of clear responsibilities and consensus has lead to breakdowns in internal controls and allowed security incidents to occur. The IT Handbook’s “Outsourcing Technology Services Booklet” lists detailed contract recommendations for TSPs. Institutions should tailor these recommendations to e-banking services as necessary. Specific examples of e-banking contract issues include:

	Restrictions on use of nonpublic customer information collected or stored by the TSP;
	Requirements for appropriate controls to protect the security of customer information held by the TSP;
	Service-level standards such as website “up-time,” hyperlink performance, customer service response times, etc.;
	Incident response plans, including notification responsibilities, to respond to website outage, defacement, unauthorized access, or malicious code;
	Business continuity plans for e-banking services including alternate processing lines, backup servers, emergency operating procedures, etc.;
	Performance of, and access to, vulnerability assessments, penetration tests, and financial and operations audits;
	Limitations on subcontracting of services, either domestically or internationally;
	Choice of law and jurisdiction for dispute resolution and access to information by the financial institution and its regulators; and
	For foreign-based vendors or service providers (i.e., country of residence is different from that of the institution), in addition to the above items, contract options triggered by increased risks due to adverse economic or political developments in the vendor’s or service provider’s home country.

OVERSIGHT AND MONITORING OF THIRD PARTIES
Financial institutions that outsource e-banking technical support must provide sufficient oversight of service providers’ activities to identify and control the resulting risks. The key to good oversight typically lies in effective MIS. However, for MIS to be effective the financial institution must first establish clear performance expectations. Wherever possible, these expectations should be clearly documented in the service contract or an addendum to the contract. Effective and timely MIS can alert the serviced institution to developing service, financial or security problems at the vendor — problems that might require execution of contingency plans supporting a change in vendor or in the existing service relationship.

The type and frequency of monitoring reports needed varies, depending on the complexity of the services provided and the division of responsibilities between the institution and its service provider(s). Service providers can build MIS capabilities into the administrative modules of their application, provide on-line reports, or they can provide periodic written reports. Some examples of items that might be tracked by e-banking monitoring reports are listed below:

E-banking service availability. Reports might include statistics regarding the frequency and duration of service disruptions, including the reasons for any service disruptions (maintenance, equipment/network problems, security incidents, etc.); “up time” and “down time” percentages for website and e-banking services; and volume and type of website access problems reported by e-banking customers.

Activity levels and service volumes. Reports might include number of accounts serviced, number and percentage of new, active, or inactive accounts; breakdown of intrabank transfers by number, dollar size, and account type; bill payment activity by number, average dollar, and recurring versus one-time payments; volume of associated ACH returns and rejects, fee breakdown by source and type; and activity on informational website usage by webpages viewed.

Performance efficiency. Reports might include average response times by time of day (including complaints about slow response); bill payment activity by check versus ACH; server capacity utilization; customer service contacts by type of inquiry and average time to resolution; and losses from errors, fraud, or repudiated items.
Security incidents. Reports might include volume of rejected log-on attempts, password resets, attempted and successful penetration attempts, number and type of trapped viruses or other malicious code, and any physical security breaches.

Vendor stability. Reports might include quarterly or annual financial reports, number of new or departing customers, changes in systems or equipment, and employee turnover statistics, including any changes in management positions.

Quality Assurance. Reports on performance, audit results, penetration tests, and vulnerability assessments, including servicer actions to address any identified deficiencies.

INFORMATION SECURITY PROGRAM

Action Summary

Information security is essential to a financial institution’s ability to deliver e-banking services, protect the confidentiality and integrity of customer information, and ensure that accountability exists for changes to the information and the processing and communications systems. Depending on the extent of in-house technology, a financial institution’s e-banking systems can make information security complex with numerous networking and control issues. The IT Handbook’s “Information Security Booklet” addresses security in much greater detail. Refer to that booklet for additional information on security and to supplement the examination coverage in this booklet.

SECURITY GUIDELINES
Financial institutions must comply with the “Guidelines Establishing Standards for Safeguarding Customer Information” (guidelines) as issued pursuant to the Gramm–Leach–Bliley Act of 1999 (GLBA). When financial institutions introduce e-banking or related support services, management must re-assess the impact to customer information under the GLBA. The guidelines require financial institutions to:

The guidelines outline specific measures institutions should consider in implementing a security program. These measures include:

	Identifying and assessing the risks that may threaten consumer information;
	Developing a written plan containing policies and procedures to manage and control these risks;
	Implementing and testing the plan; and
	Adjusting the plan on a continuing basis to account for changes in technology, the sensitivity of customer information, and internal or external threats to information security.

The guidelines also outline the responsibilities of management to oversee the protection of customer information including the security of customer information maintained or processed by service providers. Oversight of third-party service providers and vendors is discussed in this booklet under the headings “Board and Management Oversight” and “Managing Outsourcing Relationships.” Additional information on the guidelines can be found in the IT Handbook’s “Management Booklet.” The IT Handbook’s “Information Security Booklet” presents additional information on the risk assessment process and information processing controls.

The guidelines required by the GLBA apply to customer information stored in electronic form as well as paper-based records. Examination procedures specifically addressing compliance with the GLBA guidelines can be accessed through the agency websites listed in the reference section of this booklet. Although the guidelines supporting GLBA define customer as “a consumer who has a customer relationship with the institution,” management should consider expanding the written information security program to cover the institution’s own confidential records as well as confidential information about its commercial customers.

INFORMATION SECURITY CONTROLS
Security threats can affect a financial institution through numerous vulnerabilities. No single control or security device can adequately protect a system connected to a public network. Effective information security comes only from establishing layers of various control, monitoring, and testing methods. While the details of any control and the effectiveness of risk mitigation depend on many factors, in general, each financial institution with external connectivity should ensure the following controls exist internally or at their TSP.

AUTHENTICATING E-BANKING CUSTOMERS
E-banking introduces the customer as a direct user of the institution’s technology. Customers have to log on and use the institution’s systems. Accordingly, the financial institution must control their access and educate them in their security responsibilities. While authentication controls play a significant role in the internal security of an organization, this section of the booklet discusses authentication only as it relates to the e-banking customer.

Authenticating New Customers
Verifying a customer’s identity, especially that of a new customer, is an integral part of all financial services. Consistent with the USA PATRIOT Act, federal regulations require that by October 1, 2003, each financial institution must develop and implement a customer identification program (CIP) that is appropriate given the institution’s size, location and type of business. The CIP must be written, incorporated into the institution’s Bank Secrecy Act/Anti-Money Laundering program, and approved by the institution’s board of directors. The CIP must include risk-based procedures to verify the identity of customers (generally persons opening new accounts). Procedures in the program should describe how the bank will verify the identity of the customer using documents, nondocumentary methods, or a combination of both. The procedures should reflect the institution’s account opening processes – whether face-to-face or remotely as part of the institution’s e-banking services.

As part of its nondocumentary verification methods, a financial institutions may rely on third parties to verify the identity of an applicant or assist in the verification. The financial institution is responsible for ensuring that the third party uses the appropriate level of verification procedures to confirm the customer’s identity. New account applications submitted on-line increase the difficulty of verifying the application information. Many institutions choose to require the customer to come into an office or branch to complete the account opening process. Institutions conducting the entire account opening process through the mail or on-line should consider using third-party databases to provide:

Authenticating Existing Customers
In addition to the initial verification of customer identities, the financial institution must also authenticate its customers’ identities each time they attempt to access their confidential on-line information. The authentication method a financial institution chooses to use in a specific e-banking application should be appropriate and “commercially reasonable” in light of the risks in that application. Whether a method is a commercially reasonable system depends on an evaluation of the circumstances. Financial institutions should weigh the cost of the authentication method, including technology and procedures, against the level of protection it affords and the value or sensitivity of the transaction or data to both the institution and the customer. What constitutes a commercially reasonable system may change over time as technology and standards evolve.
Authentication methods involve confirming one or more of three factors:

Authentication methods that depend on more than one factor are typically more difficult to compromise than single-factor systems therefore suggesting a higher reliability of authentication. For example, the use of a customer ID and password is considered single-factor authentication since both items are something the user knows. A common example of two-factor authentication is found in most ATM transactions where the customer is required to provide something the user possesses (i.e., the card) and something the user knows (i.e., the PIN). Single factor authentication alone may not be adequate for sensitive communications, high dollar value transactions, or privileged user access (i.e., network administrators). Multi-factor techniques may be necessary in those cases. Institutions should recognize that a single factor system may be “tiered” (e.g., require multiple passwords) to enhance security without the implementation of a true two-factor system.

Password Administration
Despite the concerns regarding single-factor authentication, many e-banking services still rely on a customer ID and password to authenticate an existing customer. Some security professionals criticize passwords for a number of reasons including the need for passwords whose strength places the password beyond the user’s ability to comply with other password policies such as not writing the password down. Password-cracking software and log-on scripts can frequently guess passwords regardless of the use of encryption. Popular acceptance of this form of authentication rests on its ease of use and its adaptability within existing infrastructures.

Financial institutions that allow customers to use passwords with short character length, readily identifiable words or dates, or widely used customer information (e.g., Social Security numbers) may be exposed to excessive risks in light of the security threats from hackers and fraudulent insider abuse. Stronger security in password structure and implementation can help mitigate these risks. Another way to mitigate the risk of scripted attacks is to make the user ID more random and not based on any easily determined format or commonly available information. There are three aspects of passwords that contribute to the security they provide: password secrecy, password length and composition, and administrative controls.

Password secrecy. The security provided by password-only systems depends on the secrecy of the password. If another party obtains the password, he or she can perform the same transactions as the intended user. Passwords can be compromised because of customer behavior or techniques that capture passwords as they travel over the Internet. Attackers can also use well-known weaknesses to gain access to a financial institution's (or its service provider’s) Internet-connected systems and obtain password files. Because of these vulnerabilities, passwords and password files should be encrypted when stored or transmitted over open networks such as the Internet. The system should prohibit any user, including the system or security administrator, from printing or viewing unencrypted passwords. In addition, security administrators should ensure password files are protected and closely monitored for compromise because if stolen an attacker may be able to decrypt an encrypted password file.

Financial institutions need to emphasize to customers the importance of protecting the password's confidentiality. Customers should be encouraged to log off unattended computers that have been used to access on-line banking systems especially if they used public access terminals such as in a library, institution lobby, or Internet cafe.

Password length and composition. The appropriate password length and composition depends on the value or sensitivity of the data protected by the password and the ability of the user to maintain the password as a shared secret. Common identification items — for example, dictionary words, proper names, or social security numbers — should not be used as passwords. Password composition standards that require numbers or symbols in the sequence of a password, in conjunction with both upper and lower case alphabetic characters, provide a stronger defense against password-cracking programs. Selecting letters that do not create a common word but do create a mnemonic — for example the first letter of each word in a favorite phrase, poem, or song — can create a memorable password that is difficult to crack.

Systems linked to open networks, like the Internet, are subject to a greater number of individuals who may attempt to compromise the system. Attackers may use automated programs to systematically generate millions of alphanumeric combinations to learn a customer's password (i.e., “brute force” attack). A financial institution can reduce the risk of password compromise by communicating and enforcing prudent password selection, providing guidance to customers and employees, and careful protection of the password file.

Password administration controls. When evaluating password-based e-banking systems, management should consider whether the authentication system’s control capabilities are consistent with the financial institution's security policy. This includes evaluating such areas as password length and composition requirements, incorrect log-on lockout, password expiration, repeat password usage, and encryption requirements, as well as the types of activity monitoring and exception reports in use.

Each financial institution must evaluate the risks associated with its authentication methods given the nature of the transactions and information accessed. Financial institutions that assess the risk and decide to rely on passwords, should implement strong password administration standards.

ADMINISTRATIVE CONTROLS

Action Summary

E-banking activities are subject to the same risks as other banking processes. However, the processes used to monitor and control these risks may vary because of e-banking’s heavy reliance on automated systems and the customer’s direct access to the institution’s computer network. Some of the controls that help assure the integrity and availability of e-banking systems are discussed below.

INTERNAL CONTROLS
Segregation of duties. E-banking support relies on staff in the service provider’s operations or staff in the institution’s bookkeeping, customer service, network administration, or information security areas. However, no one employee should be able to process a transaction from start to finish. Institution management must identify and mitigate areas where conflicting duties create the opportunity for insiders to commit fraud. For example, network administrators responsible for configuring servers and firewalls should not be the only ones responsible for checking compliance with security policies related to network access. Customer service employees with access to confidential customer account information should not be responsible for daily reconcilements of e-banking transactions.

Dual controls. Some sensitive transactions necessitate making more than one employee approve the transaction before authorizing the transaction. Large electronic funds transfers or access to encryption keys are examples of two e-banking activities that would typically warrant dual controls.

Reconcilements. E-banking systems should provide sufficient accounting reports to allow employees to reconcile individual transactions to daily transaction totals.

Suspicious activity. Financial institutions should establish fraud detection controls that could prompt additional review and reporting of suspicious activity. Some potential concerns to consider include false or erroneous application information, large check deposits on new e-banking accounts, unusual volume or size of funds transfers, multiple new accounts with similar account information or originating from the same Internet address, and unusual account activity initiated from a foreign Internet address. Security- and fraud-related events may require the filing of a SAR with the Financial Crimes Enforcement Network (FinCEN).

Similar website names. Financial institutions should exercise care in selecting their website name(s) in order to reduce possible confusion with those of other Internet sites. Institutions should periodically scan the Internet to identify sites with similar names and investigate any that appear to be posing as the institution. Suspicious sites should be reported to appropriate criminal and regulatory authorities.

Error checks. E-banking activities provide limited opportunities for customers to ask questions or clarify their intentions regarding a specific transaction. Institutions can reduce customer confusion and the potential for unintended transactions by requiring written contracts explaining rights and responsibilities, by providing clear disclosures and on-line instructions or help functions, and by incorporating proactive confirmations into the transaction initiation process.

On-line instructions, help features, and proactive confirmations are typically part of the basic design of an e-banking system and should be evaluated as part of the initial due diligence process. On-line forms can include error checks to identify common mistakes in various fields. Proactive confirmations can require customers to confirm their actions before the transaction is accepted for processing. For example, a bill payment customer would enter the amount and date of payment and specify the intended recipient. But, before accepting the customer’s instructions for processing, the system might require the customer to review the instructions entered and then confirm the instruction’s accuracy by clicking on a specific box or link.

Alternate channel confirmations. Financial institutions should consider the need to have customers confirm sensitive transactions like enrollment in a new on-line service, large funds transfers, account maintenance changes, or suspicious account activity. Positive confirmations for sensitive on-line transactions provide the customer with the opportunity to help catch fraudulent activity. Financial institutions can encourage customer participation in fraud detection and increase customer confidence by sending confirmations of certain high-risk activities through additional communication channels such as the telephone, e-mail, or traditional mail.

BUSINESS CONTINUITY CONTROLS
E-banking customers often expect 24-hour availability. Service interruptions can significantly affect customers if the institution offers more than the most basic services. For example, customer bill payment transactions may not be paid on time. Due to the potential impact on customers and customer service, financial institutions should analyze the impact of service outages and take steps to decrease the probability of outages and minimize the recovery time if one should occur. Some considerations include:

Based on activity volumes, number of customer effected, and the availability of alternate service channels (branches, checks, etc.), some institutions may not consider e-banking services as “mission critical“ warranting a high priority in its business continuity plan. Management should periodically reassess this decision to ensure the supporting rationale continues to reflect actual growth and expansion in e-banking services.

LEGAL AND COMPLIANCE ISSUES

Action Summary

Financial institutions should comply with all legal requirements relating to e-banking, including the responsibility to provide their e-banking customers with appropriate disclosures and to protect customer data. Failure to comply with these responsibilities could result in significant compliance, legal, or reputation risk for the financial institution.

TRADE NAMES ON THE INTERNET
Financial institutions may choose to use a name different from their legal name for their e-banking operations. Since these trade names are not the institution’s official corporate title, information on the website should clearly identify the institution’s legal name and physical location. This is particularly important for websites that solicit deposits since persons may inadvertently exceed deposit insurance limits. The risk management techniques financial institutions should use are based on an “Interagency Statement for Branch Names” issued May 1, 1998.

Financial institutions that use trade names for e-banking operations should:

Disclosures must be clear, prominent, and easy to understand. Examples of how Internet disclosures may be made conspicuous include using large font or type that is easily viewable when a page is first opened; inserting a dialog page that appears whenever a customer accesses a webpage; or placing a simple graphic near the top of the page or in close proximity to the financial institution’s logo. These examples are only some of the possibilities for conspicuous disclosures given the available technology. Front-line employees (e.g., call center staff) should be trained to ensure that customers understand these disclosures and mitigate confusion associated with multiple trade names.

WEBSITE CONTENT
Financial institutions can take a number of steps to avoid customer confusion associated with their website content. Some examples of information a financial institution might provide to its customers on its website include:

CUSTOMER PRIVACY AND CONFIDENTIALITY
Maintaining the privacy of a customer’s information is one of the cornerstones upon which trust in the U.S. banking system is based. Misuse or unauthorized disclosure of confidential customer data may expose a financial institution to customer litigation or action by regulatory agencies. To meet expectations regarding the privacy of customer information, financial institutions should ensure that their privacy policies and standards comply with applicable privacy laws and regulations, particularly the privacy requirements established by GLBA. The regulation implementing GLBA’s requirements also describes standards on electronic disclosures that apply if an institution elects to display its privacy policy on its website.

TRANSACTION MONITORING AND CONSUMER DISCLOSURES
The general requirements and controls that apply to paper-based transactions also apply to electronic financial services. Consumer financial services regulations generally require that institutions send, provide, or deliver disclosures to consumers as opposed to merely making the disclosures available. Financial institutions are permitted to provide such disclosures electronically if they obtain consumers’ consent in a manner consistent with the requirements of the federal Electronic Signatures in Global and National Commerce Act (the E-Sign Act). The Federal Reserve Board has issued interim rules providing guidance on how the E-Sign Act applies to the consumer financial services and fair lending laws and regulations administered by the Board. However mandatory compliance with the interim rules was not required at the time of this booklet’s publication. Financial institutions may provide electronic disclosures under their existing policies or practices, or may follow the interim rules, until the Board issues permanent rules.

When disclosures are required to be in writing, the E-Sign Act requires that financial institutions generally must obtain a consumer’s affirmative consent to provide disclosures electronically. Under the E-Sign Act, a consumer must among other things provide such consent electronically and in a manner that reasonably demonstrates that he or she can access the electronic record in the format used by the institution. In addition, the institution must advise customers of their right to withdraw their consent for electronic disclosures and explain any conditions, consequences, or fees triggered by withdrawing such consent.

Additional information on consumer regulatory requirements can be found in this booklet’s “Compliance/Legal Risk” section and on each agency’s website.

Previous Subsection Table of Contents Next Subsection           Home IT Booklets Glossary Resources Presentations