Compliance - FFIEC

The Federal Financial Institutions Examination Council (FFIEC)’s Authentication in an Internet banking environment guidance, issued in October 2005 , outlined several authentication schemes identified the following components of a secure online banking implementation and made some recommendations. These are -

• Account Origination and Customer Verification - This is meant to know the identity of the customer prior to account origination. Moreover this is also required for compliance with Section 326 of the Patriot Act. The recommended method was to use Knowledge Based Authentication (KBA) to verify the identity of the user based on out-of-wallet (non-credit) data available from publicly available databases.
• Risk Assessment - This involves identifying risky transactions, such as logins and money transfers.
• Risk Mitigation - This involves using two factor authentication to mitigate transaction risk. No particular method was reported, however the guidance singled out two technologies – (1) Device Authentication using IP Address location and Geo location, and (2) Out-Of-Band Authentication.
• Audit - Monitoring and Reporting

StrikeForce Technologies helps financial institutions comply with the FFIEC Guidelines in the following ways -

• Risk Mitigation - ProtectID’s Out-Of-Band technology coupled with Oracle OAAM or RSA Adaptive Authentication Risk based authentication address this requirement