Exam Heads Up: Full Compliance Required for FFIEC Authentication Requirements

Examiners will be checking for compliance with the FFIEC Guidelines for Authentication in an Internet Banking Environment which were fully effective Dec. 31, 2006.  Each of the Federal Banking Agencies sent out their own announcements of these new requirements in Oct. 2005 -- plenty of lead-time to implement them, but now the compliance examiners will get serious.  These measures offer additional protection from identity theft for banks and their customers.

Key components of the new requirements:

• Risk assessment
• Customer education
• A statement that single-factor authentication will no longer be adequate for high-risk transactions involving access to customer information or funds transfers.

Link to FFIEC Announcement: http://www.ffiec.gov/press/pr101205.htm

FFIEC Guidance:  http://www.ffiec.gov/pdf/authentication_guidance.pdf

FDIC FIL:  http://www.ffiec.gov/ffiecinfobase/resources/info_sec/2006/fdi-fil-103-2005.pdf

OCC:  http://www.ffiec.gov/ffiecinfobase/resources/info_sec/2006/occ-bul_2005-35.pdf

FRB, OTS, and NCUA have similar announcements.

(ag) Jan. 4, 2007, in Examination, Federal Banking Agencies, Identity Theft, Internet Banking