�౦��Ϸ����

• In 2005, the FFIEC issued guidance entitled Authentication in an Internet Banking Environment.
• This FFIEC guidance supplements the �౦��Ϸ����'s supervisory expectations regarding customer authentication, layered security, and other controls in an increasingly hostile online environment.
• The �౦��Ϸ���� expects institutions to upgrade their controls for high-risk online transactions through:
  • Yearly risk assessments;
  • For consumer accounts, layered security controls;
  • For business accounts, layered security controls consistent with the increased level of risk posed by business accounts; and
  • More active consumer awareness and education efforts.
• Layered security controls should include processes to detect and respond to suspicious or anomalous activity and, for business accounts, administrative controls.
• Certain types of device identification and challenge questions should no longer be considered effective controls.

Suggested Distribution:
�౦��Ϸ����-Supervised Banks (Commercial and Savings)

Suggested Routing:
Chief Executive Officer
Chief Information Security Officer

• FIL-103-2005 , Authentication in an Internet Banking Environment, October 12, 2005

Note:
�౦��Ϸ���� Financial Institution Letters (FILs) may be accessed from the �౦��Ϸ����'s Web site at www.fdic.gov/news/financial-institution-letters/2010/index.html .

To receive FILs electronically, please visit http://www.fdic.gov/about/subscriptions/fil.html .

Paper copies of �౦��Ϸ���� Financial Institution Letters may be obtained through the �౦��Ϸ����'s Public Information Center, 3501 Fairfax Drive, E-1002, Arlington, VA 22226 (1-877-275-3342 or 703-562-2200).