To elaborate on the findings in our report, I want to start by discussing growth in Internet banking and the kind of risks it presents. For the most part, regulators have taken steps to provide guidance to depository institutions on the need to mitigate risks. However, in some areas, more remains to be done. Internet banking services are offered by a fast growing number of depository institutions. When we concluded our fieldwork several months ago, about 3,600 federally insured depository institutions—or about 17 percent of all U.S. banks, thrifts, and credit unions—offered some form of Internet banking service. More recent data showed that over 5,100 federally insured depository institutions, or about 24 percent, offered some form of Internet banking. About a fourth of these institutions offered fully transactional Web sites. It’s important to differentiate these transactional sites - - which offer a range of interactive banking services, such as transferring of funds among customer accounts - - from Web sites that only give information about the bank and its services. As shown in figure 1, the most recent statistics showed that the number of banks, thrifts, and credit unions with Web sites has increased dramatically from 245 in December 1995 to over 5,100. Also, the number of banking Web sites that were transactional were growing as well from 1 in 1995 to over 1,200. regulators have provided to depository institutions, concerning various types of Internet banking risks, including security risk, transactional risk, and various types of strategic risk. Regulators are also concerned about risks associated with an institution’s reputation, such as a possible loss of public confidence in an institution or the banking system caused by, for example, an Internet banking systems failure that prevents customers from accessing their accounts. Our work assessing what regulators are doing to help ensure that institutions with on-line systems mitigate risks follows our earlier reportissued in 1998. In that report, we discussed information obtained from 93 banks about what they were doing to mitigate risks arising from their on- line and Internet banking services. An important step in ensuring the integrity of an on-line banking system is identifying vulnerabilities and threats potentially affecting individual on-line banking systems and establishing internal controls to mitigate these risks. Survey results discussed in our 1998 report indicated that 42 percent of the surveyed banks had not conducted formal risk assessments or did not know if they had performed one. Since our 1998 report, we have found that the regulators issued varying amounts of guidance on how institutions can prepare for and mitigate risks, and we found that the limited number of examinations done so far have shown that many, but not all, institutions followed this guidance. Before I go into what we found in looking at examinations, I need to point out that, we found too few examinations had been completed to identify the extent of any industrywide Internet banking-related problems.Reasons the regulators gave for the small number of examinations done to date included examiners being diverted to mitigation efforts concerning the Year 2000 computer problem and a shortage of trained examiners to carry out Internet banking examinations. I also want to point out that while examiners found deficiencies, none of the examinations we reviewed reported any financial losses or security breaches. implemented the on-line banking risk mitigation steps outlined by the regulator. These instances involved institutions’ failure to implement, among other things, (1) active board and senior management oversight, (2) effective internal controls, and (3) comprehensive and ongoing internal audit programs. As summarized in table 1, in 20 of the 81 examinations, or 25 percent of them, examiners discovered strategic planning deficiencies. For example, regulators found that some institutions had not prepared strategic plans or had not obtained board of directors’ approval before initiating on-line banking. In 26 of the examinations, or 32 percent, regulators found that the institution did not have policies and procedures in place to guide its on- line banking operations. Another weakness involved institutions’ audit coverage of their on-line banking operations. In 29 of the examinations, or 36 percent of them, regulators found that the institution lacked adequate audit coverage of its on-line banking operations. Fifteen examinations, or 18 percent of the ones we reviewed, disclosed that the institution had not taken steps to evaluate its third-party firm that was providing the on-line banking services or lacked a written contract with their firm. Examiners we interviewed expressed concerns about deficiencies that were similar to those we found in the examinations we reviewed. For example, examiners were concerned that some smaller institutions were implementing Internet banking systems before they had established operating policies and procedures and that bank management had to be reminded that operating policies and procedures were not optional. As I noted earlier, too few examinations had been done at the time of our review to draw conclusions about patterns of problems emerging in the industry, and we are not able to generalize from the results of our review of these examinations. At the same time, we believe that as they continue to examine Internet banking, the regulators can and should learn from these examinations; and we believe that they need to begin sharing the results of their Internet banking examinations with each other. As more examinations are completed, information sharing among the regulators could help them better understand the extent of the risks posed by Internet banking, develop risk profiles that would allow them to target institutions requiring further attention, and help them allocate limited resources among competing priorities. Before discussing how regulators supervise Internet banking, I want to touch on a problem we found in how some regulators identify depository institutions planning new Internet banking services. We found that regulators used a variety of methods to identify institutions that were already offering Internet banking services, such as Internet Web site searches and examiners’ preexamination planning information gathering. However, we found that only two regulators were systematically obtaining information on institutions’ plans to provide such services and had a centralized database of this information at the time of our review. One of them, OTS, recently established a requirement that institutions notify it in advance of plans to establish a transactional Web site. The agency estimated that it would take an institution about 2 hours to prepare the notification, which in its judgment represented a minimal burden. OTS maintains this information in a centralized electronic database. The other institution, FDIC, similarly gathers information on institutions’ plans, but it relies on requirements it places on its examiners rather than placing them on the institutions it supervises. For instance, we found that during examinations of institutions not offering Internet banking, FDIC requires its examiners to find out whether the institution plans to establish Internet banking. Like OTS, FDIC collects this information in a central database. their systems. Methods, such as those used by OTS and FDIC, could be used by the other regulators to inform them about Internet banking plans and activities and better enable them to provide tailored risk-management guidance to individual depository institutions when needed. Regulators could also use this information to plan the scope and timing of future examinations and to determine the need for additional examiners who have information technology expertise. During our review, most regulators were developing, testing, or implementing new on-line banking examination procedures, including procedures for examinations of Internet banking. However, their approaches varied on whether (1) examinations of new Internet banking activities were required or discretionary and, (2) safety and soundness examiners or information system examiners conducted the examinations. The regulators also varied in their approaches to training. We found that regulators’ policies differed in the discretion examiners had to decide whether to examine an institution’s new Internet banking activity. FDIC and OTS expected their examiners to review an institution’s Internet banking activities during the first examination of the institution after it has gone on-line. FRS and OCC, in contrast, did not require that an institution’s new Internet banking activities be examined. They permitted their examiners to determine whether they should examine an institution’s new Internet banking activity. They reasoned that although Internet banking is an evolving activity that may warrant scrutiny, its small size, relative to an institution’s overall assets in most cases does not present a safety and soundness concern to the bank; and therefore, examinations of new Internet banking activities are considered optional for their examiners. the relatively low costs of providing such services through third-party firms and the desire to remain competitive. In other areas, we found differences in the types of examiners assigned to Internet banking examinations. While FRS and FDIC predominantly relied on their safety and soundness examiners for examinations of Internet banking, two other regulators relied entirely or primarily on information systems specialists. OCC relied entirely on specialized examiners because it believed the technology-related aspects of Internet banking required their expertise. OTS relied primarily on information systems specialists for examinations of Internet banking services offered by complex or large institutions. We also found that regulators were at different stages of training their examiners to carry out Internet banking examinations. At the time of our fieldwork, FDIC had largely completed its basic training for its safety and soundness examiners, but it planned additional training for subject matter experts. OTS told us that it would be finished training its examiners by the end of the year, and FRS said it also expected to complete an initial training program for its safety and soundness examiners by the end of this year. OCC had no plans for in-house training of its safety and soundness examiners in on-line banking examinations, because its on-line banking examinations are performed by information system specialists who receive specialized external training. At the time of our review, NCUA had not yet provided its examiners with special training on conducting examinations of Internet banking. The final area of our review involved regulatory oversight of third-party firms. These firms supply Internet banking support services under contract to many depository institutions which cannot or choose not to provide these services themselves. Each regulator has the authority to examine institutions’ banking services provided by third-party firms.