# Presentation: 301134

## Electronic Banking:  Industry Developments, Risks and OCC Regulatory Activities

**Prepared for ABA USBanking 2002 by the Bank Technology Division of the Office of the Comptroller of the Currency**
**  ****January 2002**
- The OCC is an independent bureau of the Department of Treasury and is the federal regulator of approximately 2,200 national banks.

**Notes:**
My name is John Carlson and I’m the OCC’s senior advisor and deputy director for bank technology.  

The American Bankers Association has asked me to talk for about 10 minutes on e-banking developments, risks, and OCC supervisory activities.  

## Technology Developments

- Advances in communications provide networked global access to information and delivery of products/services
- Internet has reached critical mass (60% of U.S. households)
- Some banks have 25 percent of customers banking online
- Increased competition from other industries and abroad
- Greater reliance on third party providers
- Advances in technology make the component functions of banking  more easily divisible

**Notes:**
Technology and banking are integral and integrated.  It wasn’t so long ago that the Internet was merely a high-tech communications mechanism for only the most sophisticated technophiles.  Today, its an integral part of our daily lives for most of us.  For many of us, its an accepted delivery channel for bankers to interact with customers.  
The internet has reached “critical mass” in that 60 percent of U.S. households have access.  
Some banks have signed up more than 25 percent  customers for Internet banking.  

## Growth in Number of National Banks that Have Transactional Websites

*Source: Office of the Comptroller of the Currency.  “Transactional web sites” are defined as bank web sites that allow customers to transact business.  This may include accessing accounts, transferring funds, applying for a loan, establishing an account, or performing more advanced activities.*

**Notes:**
Based on our examinations, we know that almost half of our 2,200 national banks have transactional websites, almost double the number of just 2 years ago.  

## Technology-based BankingProducts & Services

- Balance inquiry
- Transaction information
- Funds transfer
- Cash Management
- Bill payment
- Bill presentment
- Loan applications
- Stored Value

***	***
- Aggregation
- Electronic Finder
- Automated clearinghouse (ACH) transactions
- Internet Payments
- Wireless Banking
- Certification Authority
- Data Storage

**Notes:**
Banks can offer almost anything electronically that they offer thru branch networks.  Moreover, e-banking facilitates new products and services such as aggregation, certification authorities, and electronic data storage.

## Key Technology Risks

- Security, Data Integrity, and Confidentiality
- Authentication, Identity Verification, and Authorization
- Strategic and Business Risks
- Business Continuity Planning
- Permissibility, Compliance, Legal Issues, and Computer Crimes
- Cross Border and International Banking

**Key Technology Risks**

**Notes:**
I’m going to spend the next five minutes highlighting key e-banking risks.  I’ll discuss vendor management, security, strategic risks, business continuity, legal issues and international banking issues.    

## Outsourcing Trends

- TowerGroup estimates banks outsource over 85% of their information technology
- Rapid pace straining ability to oversee third parties
- Consolidation of tech. companies and core processors
- Weak or negative earnings of new tech providers
- Banks are postponing new technology investments, but still investing in *proven* technologies

**Notes:**
Due to a variety of factors, including cost advantages & advanced technical expertise, banks rely heavily on third party technology providers.
In light of current weak economic conditions and the fallout from the .com bubble burst, many technology service providers are suffering from weak earnings and many banks are only investing in proven technologies that offer near term returns.  
While reliance on third parties has many advantages, it also requires banks to actively manage these vendors. 

## Outsourcing Guidance

*FFIEC Guidance on Risk Management of Outsourced Technology Services (November 2000)*
- Key elements of the risk management process:
- Risk assessment
- Due diligence in selecting service provider
- Contract requirements
- Oversight of service provider

*Regardless of the decision to outsource, the bank remains ultimately responsible.*

**Notes:**
In November 2000, the OCC and the other federal banking regulators published guidance on IT outsourcing.  We outlined four key elements of the risk management process referenced on slide 7. These elements cover everything from risk assessment to ongoing monitoring after the due diligence process and focusing on contract requirements.  

We also wanted to underscore the point that bank management is ultimately responsible for the risks regardless of the decision to outsource.  This is why its so important for banks to establish and maintain an active and comprehensive vendor management program. 

## Security and Privacy

- Increases in security events and vulnerabilities
- According to 2001 FBI/CSI survey, 70% reported that the Internet is the point of cyber attacks, up from 59% in 2000
- Gramm-Leach-Bliley Act of 1999 requires banks to establish administrative, technical & physical safeguards to protect the privacy of customers’ nonpublic customer records and information

**Notes:**
Another serious risk is protecting privacy by establishing and maintaining a robust information security program.  

Congress recognized that protection of a customer’s privacy is not limited to providing customers with the ability to opt out of information sharing.  Passage of the Gramm-Leach-Bliley Act of 1999 provided the regulators with stronger enforcement tools to ensure that banks establish adequate administrative, technical, and physical safeguards to protect the privacy of customers’ nonpublic customer records and information. 
Banks are required to establish and maintain adequate information security programs.  The programs must be based on an assessment of the risks.  

## Reported Security Incidences & Vulnerabilities

*Source: CERT/CC -- statistics are not limited to the banking industry and include all reported incidents*

**Notes:**
Cyber security risks are growing.  According to Carnegie-Mellon University’s Computer Emergency Response Team, the number of unauthorized activity incidences for all entities, not just banks, has increased significantly in recent years.  [In fact, the numbers are even higher than the top graph on slide 9.  In early December, CERT reported a total of 52,658 incidences in 2001, more than double the amount in 2000.  (The slide shows an estimated number based on September 2001 year to date information).] 

The bottom graph shows the substantial rise in new system vulnerabilities.    

As cyber security threats and vulnerabilities grow, its incumbent on banks to raise the bar on their information security programs.

## Key Elements of Security Program

- Reviewing physical and logical security:
- Review intrusion detection and response capabilities to ensure that intrusions will be detected and controlled
- Seek necessary expertise and training, as needed, to protect physical locations and networks from unauthorized access
- Maintain knowledge of current threats facing the bank and the vulnerabilities to systems
- Assess firewalls and intrusion detection programs at both primary and back-up sites to make sure they are maintained at current industry best practice levels

**Notes:**
Slides 10 and 11 review some of the steps banks should address when reviewing physical and logical security.  

## Key Elements of Security Program

- Reviewing physical and logical security (cont’d):
- Verify the identity of new employees, contractors, or third parties accessing your systems or facilities.  If warranted, perform background checks.
- Evaluate whether physical access to all facilities is adequate.
- Work with service provider(s) and other relevant customers to ensure effective logical and physical security controls.

## Authentication

- Reliable customer authentication is imperative for E-banking
- Effective authentication can help banks reduce fraud, reputation risk, disclosure of customer information, and promote the legal enforceability of their electronic agreements
- Methods to authenticate customers:
- Passwords & PINS
- Digital certificates & PKI
- Physical devices such as tokens
- Biometric identifiers

**Notes:**
An important component of a robust information security program is authentication.  

Effective authentication helps banks reduce fraud (including identity theft) and promote the legal enforceability of electronic agreements.  

In July 2001, the OCC and the other banking regulators published guidance on “Authentication in an Electronic Banking Environment”.  We outlined the risk management expectations for banks that use a variety of authentication methods, including passwords/PINS, digital certificates & PKI, tokens, and biometric identifiers.  
The OCC strongly encourages banks to review their authentication methods to ensure that they are effective, in response to increased or changing risks. 

## Strategic and Reputation Risks

- Uncertain pace of change and evolving standards (e.g., “bricks and clicks” more successful than internet-only model)
- First mover (“bleeding edge”) vs. wait and see (permanently lose market share)
- Struggle to retain customers in face of intense competition
- Inadequate oversight of third party providers

**Notes:**
E-banking also exposes banks to strategic and reputation risks.  As the industry continues to evolve, bank management is faced with decisions as to whether, when, and how to provide e-banking products and services.  Each of these decisions may, among other things, affect whether a bank’s particular customer base will embrace this relatively new delivery channel or whether the service will contribute to the bank’s long-term profitability. 

## Business Continuity Planning

- The 9/11 events, anthrax-laced mail, and NIMDA virus underscore the importance of robust business continuity planning.
- Steps to consider when reviewing business continuity plans:
- Identify primary and secondary facilities in high profile or vulnerable locations and develop plans to mitigate undue risk exposure.
- Ensure business continuity plans are coordinated and communicated on a corporate-wide basis with clear expectations.

**Notes:**
The September 11th events underscore the importance of business continuity planning as well as the previously mentioned need for security controls to maintain the accuracy, reliability, and availability of bank and customer records.  

Due in part to extensive Y2K preparations, all national banks affected by the September 11 events were able to successfully activate business continuity plans. 
Slides 14 and 15 provide a brief overview of key steps banks should consider when reviewing business continuity plans.  
The OCC, in conjunction with the other banking agencies as well as government-wide efforts, is focusing on business continuity issues and should  have more to say on this important topic in 2002. 

## Business Continuity Planning (cont’d)

- Strengthen data backup and recovery site arrangements, as warranted, to ensure adequate off-site storage of back-up records and sufficient distance from primary operations.
- Review succession plans for key employees and delegations of authority in the event of a crisis.
- Review community’s incident response plans and work with local governments to identify enhancements
- Analyze key customers and service providers for exposure to terrorist activities including high profile industries or facilities (e.g., power companies, refineries, airlines, telecommunications providers), then assess the adequacy of their business continuity planning process.
- Test plans on a regular basis, evaluate results and update plans.

## Permissibility, Legal, and Compliance Issues

- Technology raises legal issues
- Permissible?
- Applicability of state and foreign laws?
- Validity of electronic agreements?
- Technology creates consumer compliance issues
- Electronic disclosures delivery
- Weblinking, customer confusion, and liability
- RESPA and fee income from weblinking
- CRA and fair lending issues
- Reg. E application to aggregation services

**Notes:**
There are a host of legal and compliance issues bank management must consider when offering Internet banking.  This is due in part to the fact that our laws and regulations are based on geography and the Internet  makes geographic boundaries somewhat irrelevant.   

## Computer Crime

- Internet banking and payment systems  may allow for new ways to conduct illegal and fraudulent activities
- Unauthorized access to deny service or    re-direct a website
- Identity theft resulting in unauthorized or illegal use of account information
- Money laundering
- Phony Internet banks

**Notes:**
The Internet also provides a new means for criminals and terrorists to commit fraud and disrupt commerce. Banks must continue to work with law enforcement to deter computer crimes and maintain the high degree of trust by customers and the public.    

## Cross Border and International E-Banking

- Information revolution around the globe and borderless reach of the Internet
- Increase in global partnerships/alliances
- Risks to U.S banks from cross border E-banking without adequate due diligence
- Unlicensed activities?
- Understanding application of local prudential and customer protection laws & regulations?
- Expertise?
- Risks to U.S. consumers of dealing with foreign Internet banks

**Notes:**
E-banking is global, which raises issues for banks that operate on a international basis as well as bank supervisors charged with supervising these activities.  

## Cross Border and International E-Banking

- EBG sponsored by the Basel Committee’s Electronic Banking Group
- Chaired by Comptroller Hawke
- Published studies on e-banking risk and risk management issues 1998, 2000 & 2001
- available at _www.bis.org_*** ***or_ __www.occ.treas.gov_
- Developing guidance on cross border, e-banking risks and aggregation
- Coordinate international e-banking supervision efforts
- Information sharing and training
- OCC developing guidance on cross border Internet banking risks

**Notes:**
To address international e-banking issues, the Basel Committee established the Electronic Banking Group several years ago.  Comptroller of the Currency Jerry Hawke is the chairman of this group.  The EBG has published studies on e-banking risk and risk management issues, coordinated efforts, and facilitated training and information sharing. 

## Key Findings of Successful E-banking Exams

- Active vendor management
- Ongoing board involvement
- Sufficient technical expertise
- Proactive network security that effectively prevents, detects, and responds to intrusions
- Strong authentication practices
- Encrypted communications
- Periodic compliance and legal reviews
- Appropriate backup and recovery

**Notes:**
Slide 20 lists the common factors our examiners have found in banks that offer successful e-banking programs. 

## OCC Technology Risks Supervision Program

- Guidance -- Focus on risk analysis, measurement, controls, and monitoring
- Risk-based examinations of banks and third party service providers (as authorized by the Bank Service Company Act of 1962)
- On site and Quarterly reviews
- Focus on safety and soundness
- Reviews of banks with transactional web sites and E-banking service providers
- Training and Technology Integration Project
- External outreach and co-ordination
- Licensing process for Internet-primary banks and novel activities

**Notes:**
The OCC has a multi-faceted program for supervising e-banking activities.  
We have issued guidance. 
We conduct examinations of banks and many non-bank service providers and technology companies.
We train our examiners to monitor technology risks.
We engage in a comprehensive process for reviewing applications to establish Internet-primary banks and for established banks to engage in novel activities.  

## Questions?

**Please contact John Carlson, ****Senior Advisor for Bank Technology, OCC**
**E-mail:**** John.Carlson@occ.treas.gov**
**Telephone:  ****(202) 874-5013**
**Additional Information is available on the OCC Website:  www.occ.treas.gov**

**Notes:**
Information on our supervisory program as well as research and analysis, decisions on corporate applications, speeches, etc. is available on the OCC’s web site under the e-banking icon.  

If you would like more information, please view the OCC’s web page.  If you have questions please feel free to contact me directly via e-mail or telephone.  

Thank you. 

## Slide 23