Banks have provided electronic banking services to customers for a number of years using such familiar access devices as telephones and automated teller machines. Corporate customers also have had access to on-line banking features by dialing into a bank’s system using proprietary software. More recently, retail customers have been able to access their bank accounts from computers in their homes or workplaces by connecting to on-line banking systems. Such systems offer services that enable individuals or businesses to verify their account balances, apply for loans, authorize bill payments, or transfer funds between their accounts and from other banks. Some on-line banking systems also let customers reorder checks, review their account histories, stop check payments, or facilitate wire transfers. Customers with computer modems can access their banks’ on-line banking computer systems in one of several ways. Some of them can use banking software installed on their personal computers, local area networks, or mainframe computers to connect to the banks’ on-line banking systems. Other customers may be able to access their banks’ on-line banking systems by dialing into an Internet service provider and accessing the banks’ World Wide Web sites. Banks may operate their on-line banking systems in-house or contract out the operation of these systems to third-party vendors. After connecting to an on-line banking system, a customer generally enters a personal identification number and a password. Typically, customers must go through this step to identify themselves every time they sign on to the on-line banking system. According to bank officials, once customers have confirmed that they are legitimate account holders, they can proceed to use their computers to initiate the desired transactions, and the on-line banking system processes and routes the transaction data as needed to carry it out. Our survey results indicated that the number of banks implementing on-line banking systems is planned to grow about fivefold by December 1998. We estimate that about 770 banks, or 7 percent (– 3 percent) of the approximately 10,520 banks active in the United States at the time of our survey, had implemented on-line banking as of June 1997. According to the responses to our survey results, an estimated 4,990 banks, or about 15 percent) of the banks in the United States, plan to offer some type of on-line banking service to their customers by the end of 1998. This estimate of 4,990 banks includes the 770 banks offering on-line services in June 1997 as well as 4,220 banks projected to begin offering such services by December 1998 (see fig. 1). Although U.S. banks offer a wide range of services on-line, reviews of account information and funds transfers between a customer’s accounts were the most common services reported to be available to bank customers at the time we conducted our survey in June 1997. Our analysis indicated that over 99 percent (– 1 percent) of the estimated 770 banks offering on-line banking allowed their customers to check their balances, and the same percentage allowed customers to transfer funds between their own accounts. In comparison, 54 percent (– 24 percent) of these banks reported allowing their customers to transfer funds to other banks (see table 1). As part of our survey, we asked officials from all 185 banks we surveyed that reported offering on-line banking for more detailed information on the channels they used to deliver on-line services. Their survey responses indicated that most banks used software that enables customers to directly connect to the banks’ own on-line systems or a vendor’s system. Of the 185 banks, 116 (63 percent) reported using software that provides for a direct connection to a vendor’s system, and 79 (43 percent) reported using software that allowed customers to directly connect to their banks’ on-line computer systems. More than half of the banks reported they offered on-line banking by allowing customers to connect with their on-line systems through the Internet (see table 2). We also asked officials who represented the 185 banks that reported offering on-line banking for their reasons for implementing their on-line banking systems. Key reasons bank officials cited for their banks’ decisions to offer on-line banking involved the intention to remain competitive with other banks, retain customers, attract new customers, reduce operating expenses, or generate fee income. Although 133 banks (72 percent) indicated they implemented on-line banking to retain customers, two other motivating factors—remaining competitive and attracting new customers—were cited almost as often. Other motivating factors, such as keeping up with banking technologies and the desire to offer customers alternative delivery channels, were cited by some banks (see fig. 2). Banks planning to offer on-line banking responded similarly to questions about motivating factors. Among the 36 banks planning to implement on-line banking by December 1998, the desires to remain competitive and to retain their customers were the most frequently cited motivating factors. Survey responses for 185 banks indicated that their on-line banking systems generally met or exceeded their expectations (see table 3). Half of the banks reported that their expectations were met, and another 77 banks (42 percent) said that their expectations were exceeded. Bank officials commonly reported that customer usage of on-line banking systems met or surpassed initial targets. One bank official told us that about 400 new employees were hired to meet the customer demand for on-line banking. In a few instances, banks’ experiences fell short of expectations. In one case, a bank official told us that customer use was much lower than expected. The official said that the rural location of the bank may have been a contributing factor. On-line banking presents a wide range of potential risks, according to information security experts and banking regulators. On-line banking can expose bank and customer information and transactions to risks from electronic interception, data corruption, or fraud because of the widespread access characterizing these systems. An important step in ensuring the integrity of an on-line system is ascertaining the vulnerabilities and threats potentially affecting individual on-line systems and establishing compensating internal controls to mitigate risks. Accordingly, information security experts and federal banking regulators suggest that banks analyze risks associated with their on-line banking systems and evaluate whether their security policies protect the integrity, confidentiality, and availability of their on-line operations and are capable of limiting or mitigating identified risks. Information security experts and federal regulators stated that although risk assessments specific to on-line banking are not a federal banking requirement, such assessments are a useful tool for identifying, measuring, monitoring, and managing potential risks. Assessments can help banks evaluate the seriousness of such potential problems as viruses, unauthorized access into banking systems, and lost transactions. Our survey results indicated that 54 of the 93 banks (58 percent) that reported having on-line systems had conducted formal risk assessments of their on-line banking systems. However, 12 banks (13 percent) said they had not performed such assessments. Another 16 banks (17 percent) did not know if they had performed risk assessments of their on-line banking systems. The remaining 11 banks (12 percent) reported holding limited or informal discussions about potential risks of on-line banking. Two bank officials we interviewed explained that their banks did not perform a risk assessment because the latest industry information their banks had obtained on the security of on-line banking systems suggested that such systems were secure. To help prevent unauthorized access to on-line banking systems, information security experts and regulatory officials emphasize the importance of banks’ implementing mitigating controls, such as restrictions on access, secure firewalls that restrict access between computer networks, intrusion detection software, and tests of on-line banking system vulnerability. The risk mitigation process can be used to not only identify controls necessary to protect an on-line system, but also to weigh the cost of implementing controls against their benefits. The Federal Reserve Bank of New York notes that the level of protection of an Internet site should be commensurate with the degree of risk associated with the level of services offered and the value of assets at risk. For example, the cost of implementing strong authentication controls, through techniques such as digital signatures, would tend to be more appropriate for a bank that offers extensive on-line banking services, such as bill payment and funds transfers to other banks, than for a bank that limits its on-line banking services to the review of account balances. For the 93 banks that they directly represented, we asked bank officials for information on the types of problems they had experienced with their systems, whether other banking systems were connected to their systems, and the types of controls they had in place to mitigate risks. Many of the 93 reported that they had experienced service availability lapses (38 percent), security problems (30 percent), or operational problems (36 percent) with their systems (see table 4). We could not assess the significance or underlying causes of these apparent problems because we did not examine individual banks’ systems and processes. Moreover, we did not determine the appropriateness of a bank’s mitigating features, which could vary depending on the complexity of the on-line banking system as well as the types of services offered. One category of on-line banking problems reported by banks involved lapses in the availability of services. Thirty-three of the 93 banks (35 percent) reported that their on-line banking systems had experienced service availability problems involving the denial or disruption of service (see table 4). Such problems frequently can be caused by a breakdown in the hardware or software supporting the system, which in turn may be the result of a design defect, insufficient system capacity, or a mechanical breakdown. Almost half of the 33 banks that reported experiencing denial or disruption of service indicated that some type of damage resulted, such as loss of customer confidence or customers closing their accounts. Banks should be able to prevent or at least partly mitigate service availability problems by monitoring vendor systems and by adopting emergency or contingency plans, which are designed to allow banks to continue their on-line banking operations after a system failure.