To All Depository Institutions and Others Concerned
in the Second Federal Reserve District:

The Federal Financial Institutions Examination Council (FFIEC) has issued the attached guidance titled Authentication in an Internet Banking Environment. This guidance updates and replaces the FFIEC's Authentication in an Electronic Banking Environment issued in 2001 and specifically addresses the need for risk-based assessments, customer awareness and security measures to reliably authenticate customers accessing financial institutions' Internet-based services.

The guidance also emphasizes that the agencies consider single-factor authentication, if it is the only control mechanism, to be inadequate for high-risk transactions involving access to customer information or the movement of funds to other parties.

This guidance applies to both retail and commercial customers and does not endorse any particular technology. Financial institutions should use this guidance when evaluating and implementing authentication systems and practices whether they are provided internally or by a technology service provider.

Although this guidance is focused on the risks and risk management techniques associated with the Internet delivery channel, the principles are applicable to all forms of electronic banking activities.

Consistent with the FFIEC's Information Security Booklet (December 2002), which is incorporated in the Information Technology Examination Handbook, financial institutions should periodically:

• Ensure that their information security programs:
  • Identify and assess the risks associated with the full range of Internet-based products and services,
  • Identify risk mitigation actions, including appropriate measures to verify and authenticate customers, and
  • Measure and evaluate customer awareness efforts;
• Establish, evaluate, and adjust, as appropriate, their information security programs in light of any relevant changes in technology, the sensitivity of their customer information and internal or external threats to information; and
• Implement appropriate risk mitigation strategies.

SR 05-19 
Authentication in an Internet Banking Environment  

Contact:
Lisa Joniaux
Supervising Examiner
Risk Management
(212) 720-2530
lisa.joniaux@ny.frb.org

Contact:
Public Affairs
(212) 720-6130
general.info@ny.frb.org