Since you're designing the product to act like your internet banking site, start by assuming the same risks that you assessed in connect with the internet product. In fact, it may be appropriate for you to combine internet and mobile banking products under a single set of risk assessments, with minor tweaks here and there to account for whatever is unique about one product or the other.
_________________________
John S. Burnett
BankersOnline.com
Fighting for Compliance since 1976
Bankers' Threads User #8