Question:  Our vendors have not offered a two-factor authentication for online banking services.  The regulatory guidance says that this should be in place by year end.  Are we toast?

 

Answer:  No.  The regulators are aware that there has been a lag in market development.  Still, you should timely complete your risk assessment (or if your third party vendor has performed this assessment, be sure that the board has reviewed and adopted it).  Typical "high risk" activities include bill pay and ability to wire funds to third parties electronically or via telephone.  Merely transferring funds between savings and checking accounts at the same bank should not be "high risk."

 

Also, you should at least put a multi-layered program in place.  This consists of several passwords, key phrases, photo selection, etc.  Vendors DO have multi-layering programs available!