Capital Briefs: FDIC Sends an Internet Security Warning

Banks offering Internet banking services need to do more to safeguard their data and computer systems, the Federal Deposit Insurance Corp. said Wednesday.

In a letter to institutions it supervises, the FDIC said banks should have a comprehensive program in place to assess, prevent, detect, and resolve potential vulnerabilities, including customer privacy violations.

The FDIC said its advice applies to all banks offering Internet or other electronic banking services, whether rendered internally or through a third-party provider.

Banks using a third party should write security-related clauses into their contract, analyze the provider's security program, and review copies of "independent penetration tests" run against the firm's computer systems.

Failure to deal with the potential risks, such as break-ins by a computer hacker, could result in "financial loss and reputational harm" for a bank, the FDIC wrote.

The new guidelines supplement a letter FDIC issued in December 1997 and complement the agency's electronic banking examination procedures for safety-and-soundness. They do not, however, create new exam standards or regulatory requirements, the FDIC said.

For reprint and licensing requests for this article, click here.
MORE FROM AMERICAN BANKER