Internet banking is one form of on-line banking; PC direct dial banking is another. Before Internet banking, customers using direct-dial PC banking needed to use specialized computer software provided and supported by their depository institution. More recently, these direct-dial connections are being replaced by Internet connections over which customers can use their computers and browser software to connect to their depository institution’s Web site. In general, regulators distinguish three types of Internet banking Web sites: Purely informational sites, which have information about the depository institution and its products and services but no interactive capability; Information-exchange sites, which provide information and allow customers to send information to the depository institution or make inquiries about their accounts; and Fully transactional sites, which offer the previously described capabilities as well as some additional services, such as real-time account queries, transfers of funds among accounts, bill payments, or other banking services. Internet banking services are offered by a rapidly growing number of depository institutions. According to recent data, at least 3,610 federally insured depository institutions—about 17 percent of all U.S. banks, savings associations, and credit unions—offered some form of Internet banking service as of February 1999. About 20 percent of these depository institutions offered fully transactional Web sites. Information available from the banking regulators and industry studies suggest that Internet banking is accelerating. According to FDIC and NCUA statistics, in the 11 months ending February 1999, the number of banks, thrifts, and credit unions with transactional sites almost tripled. According to projections reported by the Department of Commerce, the number of customers who went on-line to perform banking transactions increased by 22 percent, from 4.6 million to 5.6 million, in the 6 months ending April 1998. Five federal regulators—FDIC, FRS, NCUA, OCC, and OTS—supervise and examine all federally insured depository institutions. FDIC, a government corporation, is the primary federal regulator of state-chartered banks that are not members of FRS. FRS, another independent body, shares responsibility with state banking regulators for supervising and examining state-chartered banks that are members of FRS. In addition, FRS supervises bank holding companies and their nonbank subsidiaries. Banks under FRS’ supervision are supervised by 12 regional Reserve Banks that conduct examinations under delegated authority from the Board of Governors in Washington. NCUA is an independent body responsible for examining and supervising federally insured credit unions and works with state regulators to monitor the safety and soundness of state-chartered credit unions. OCC, an agency, that is a bureau of the Department of the Treasury, supervises all national banks. OTS, which is also a bureau of the Department of the Treasury, serves as the primary regulator for thrifts and thrift holding companies. The regulators oversee a mix of large, medium, and small depository institutions, as shown in table 1. Banking regulators also work together through FFIEC, an interagency forum Congress created in 1979 to promote consistency in the examination and supervision of depository institutions. In 1996, FFIEC updated its “Information Systems Handbook,” which provides regulators with general guidance on information systems and technology examinations. To help ensure the safety and soundness of federally insured banks, thrifts, and credit unions, banking regulators conduct various types of monitoring activities. They include the following: Off-site monitoring, which generally consists of reviews and analyses of depository institution-submitted data, including call reports, and discussions with bank management, is carried out to monitor compliance with requirements or enforcement actions; formulate supervisory strategies, especially plans for on-site examinations; and identify trends, areas of concern, and accounting questions. On-site safety-and-soundness examinations are conducted to assess the safety and soundness of a depository institution’s practices and operations. Specific objectives of these on-site examinations that are common to all the banking regulators include (1) determining the institution’s condition and the risks associated with its current and planned activities; (2) evaluating the institution’s overall integrity and the effectiveness of its risk management by testing the institution’s practices; and (3) determining the institution’s compliance with laws, regulations, and rulings. Information systems examinations are conducted to identify and correct information and technology-related risk exposures of significance that threaten the depository institution. These examinations focus on various components of an institution’s information system, such as the capabilities of its information technology management; the adequacy of its systems development and programming; and the quality, reliability, availability, and integrity of its information technology operations. Finally, special technical examinations of banking services by third parties are conducted to ensure that banking operations performed by third-party firms are consistent with the safety and soundness of the depository institutions using the services. These examinations, which often include a review of the management systems, operations, and financial condition of the service providers, can provide regulators with greater assurances of the reliability of services than can be obtained during normal safety and soundness examinations of a depository institution. The banking regulators also conduct reviews of on-line banking systems for compliance with consumer protection laws and regulations. These include examinations of an institution’s obligation to provide required notices and disclosures on Internet banking products and services. To address our four objectives, we interviewed officials and reviewed available documents from the five banking regulators. This included obtaining information on Internet banking risks and each regulator’s strategy for overseeing Internet banking activities, the methods used to identify depository institutions that offer Internet banking, the existence of safety and soundness and information systems examination procedures for reviewing Internet banking, and the extent of examinations of third- party firms. We did not independently verify the accuracy of data that banking regulators provided. We also interviewed representatives from selected depository institutions and third-party firms to obtain their views on the scope and frequency of examinations by bank regulators and their assessment of risks posed by Internet banking systems. In addition, we developed a data collection instrument to document our review of 81 safety and soundness and information systems examinations that included on-line banking and we also used a structured questionnaire to interview 43 selected examiners who had conducted these on-line banking examinations. (See app. I for a more detailed description of our scope and methodology.) We did our work from April 1998 to May 1999 in Washington, D.C.; Los Angeles, CA; San Francisco, CA; Atlanta, GA; Kansas City, KS; and New York, NY, in accordance with generally accepted government auditing standards. We requested comments on a draft of this report from the five banking regulators and FFIEC, and these comments are discussed near the end of this letter and are reprinted in appendixes III through VIII. Internet banking services heighten various types of risks that are of concern to banking regulators, and the regulators have advised institutions to mitigate these risks through the implementation of risk management systems that emphasize, among other things, (1) active board of directors’ oversight, (2) effective internal controls, and (3) comprehensive internal audits. Too few examinations that included a review of Internet banking had been conducted at the time of our review for the extent of Internet banking-related problems industrywide to have been identified. However, our review of 81 such examinations revealed that some depository institutions had not always adhered to risk mitigation guidance provided by the regulators. Few examinations had been conducted because, according to the regulators, Internet banking was a relatively new activity, and examination procedures were still being developed. Other reasons reported by regulators were that the number of examiners with expertise in information systems was limited and that some examiners who might otherwise have examined on-line banking during our study period were diverted by higher priority efforts to address the Year 2000 computer problem. As more examinations are completed, sharing of information among the regulators could help them better understand the extent of risks posed by Internet banking, develop risk characteristics allowing them to target institutions requiring further attention, and help make decisions on how best to allocate information technology expertise among competing priorities. Internet banking heightens various types of traditional banking risks that are of concern to banking regulators. These risks, which are discussed in regulatory guidance provided to depository institutions, include the following: Security risk is the risk of potential unauthorized access to a depository institution’s networks, systems, and databases that could compromise internal systems and customer data and result in financial losses. The use of an electronic channel, such as the Internet, to deliver products and services introduces unique risks for a depository institution due to the speed at which systems operate and the broad access in terms of geography, users, applications, databases, and peripheral systems. Transactional risk is the risk of financial losses arising from problems with service or product delivery. Transactional risk often results from deficiencies in computer system design, implementation, or ongoing maintenance. Strategic risk is the risk to earnings or capital arising from adverse business decisions or adverse implementation of those decisions. Depository institutions face strategic risk whenever they introduce a new product or service, such as Internet banking. Reputation risk is the risk of significant negative public opinion that results in a critical loss of funding or customers. This risk can also expose the depository institution to costly litigation. Failure of Internet banking products to perform as promised, such as a communication failure that prevents customers from accessing their accounts, could expose a depository institution to reputation risk. Lastly, compliance risk is the risk arising from violations of, or nonconformance with, laws, rules, regulations, required practices, or ethical standards. This risk may arise if a depository institution fails to comply with regulatory guidance or an enforcement action. Banking regulators have provided depository institutions with advisory guidance on how to mitigate risks posed by Internet banking, including risks related to services provided by third-party firms. In their guidance, regulators describe how depository institutions in general should plan for, manage, and monitor risks associated with the use of technology.