FFIEC authentication and access guidance addresses risk assessment, layered security, MFA and monitoring in US digital banking. Access controls respond to the assessed risk, with testing, anomaly review, incident records and remediation providing evidence of how protections operate.
TL;DR:
- 2021 guidance covers customer, staff, third-party and system access to digital banking.
- Uses risk assessment, layered security and stronger authentication where warranted.
- Replaces the 2005 and 2011 guidance while retaining controls proportionate to access risk.
Summary
Broader than consumer internet banking
The FFIEC's Authentication and Access to Financial Institution Services and Systems guidance was issued in August 2021 and replaces the 2005 guidance and its 2011 supplement. It addresses consumer and business customers, employees, third parties and other users of digital banking and information systems. The scope recognises that an institution's risk can arise from internal or supplier access as well as a customer's login to a payment account.
Risk assessment determines the access controls
The guidance emphasises assessing the users, systems, services and transactions involved before selecting authentication practices. Its principles can apply whether the institution or a third party supplies the relevant systems and controls. Financial institutions differ in operational complexity and risk, so the document supports a proportionate approach rather than one identical authentication configuration for every user or function. Higher-risk access can justify enhanced controls.
Layered security and stronger authentication
The FFIEC highlights weaknesses in single-factor authentication and discusses multi-factor authentication or controls of equivalent strength. Layered measures can combine authentication with other prevention, detection and response controls. The guidance also recognises threats involving compromised credentials and push-payment capabilities. Authenticating access is therefore connected to the authority and risk of the subsequent action, rather than being a standalone assurance that every requested transfer is legitimate.
Supervisory guidance and ongoing adaptation
The document provides examples and resources to inform authentication and access risk management. Federal Reserve supervisory material states that examiners take the guidance into account in risk-focused supervision. It is not intended as a complete identity-and-access-management framework or an endorsement of one external standard. Institutions need to keep their assessment and controls responsive to changes in technology, services, users and threats, including dependencies on third-party providers.
Keywords
- FFIEC authentication
- digital banking
- layered security
- risk assessment
- compromised credentials
- customer access
- employee permissions
- third-party connections
- push payments
- 2021 guidance