Question:  Our community bank offers online banking services.  Do we have to be concerned with this "multi-factor" authentication bulletin (FIL 103-2005)?

 

Answer:  Yes!  First, you must perform a risk assessment.  We recommend that you get this done by June 30.  Then, for your high risk transactions (commercial bill pay, for example), implement multi-factor authentication no later than year end 2006.  Logon name and password are considered a single factor.  Remember that the FFIEC guidance identifies the various categories of authentication as (1) something the customer knows (e.g. password), (2) something the customer has (e.g. UBS token), and (3) something the customer is (e.g. fingerprint, retina scan).

 

If your service provider is conducting the risk assessment for you, be sure that your board reviews the assessment and makes a determination that it is reasonable, comports with your bank's activities, and is formally accepted.