Federal Financial Institutions Examination Council (FFIEC) issued guidance in October 2005 requiring banks to reassess their login protocols consider single-factor authentication, when used as the only control mechanism, to be inadequate for high-risk transactions involving access or the movement of funds, and to enhance authentication based on the risk of their service. Beyond the mandate, financial institutions are also subjected to a high bar to gain their client’s trust.
Gramm-Leach-Bliley Act (GLBA) – U.S. financial institutions must ensure the security and confidentiality of their customer records.
Section 404 of the Sarbanes-Oxley Act (SOX) requires the CEO and CFO of publicly traded companies to certify the effectiveness of the organization's internal controls.
PCI DSS Requirement 8.2 defines authentication requirements which include MFA for remote access of the Cardholder Data Environment (CDE). It also recommends which methods should be used.