We are in the implementation phase of offering e-banking services to our customers for the first time.

In regards to the FFIEC guidance on authentication in internet banking environment how can we conduct a risk assessment on the type of customer, the customer transactional capabilities, etc. if we have no customer base to risk rate? Do we wait until the internet banking products have been offered for a specific period of time and then conduct a risk assessment based on those customers who participate in internet banking? Or do we complete a risk assessment now on the products we plan to offer and consider all products offered high risk? Just wondering how we should handle this with the recent guidance coming out the same time we are implementing internet banking.

Your suggestions please!!! Thanks!

I would ask your vendor for references and ask those references what their customer usage base is like (how many use bill pay versus just online banking, etc.) and guagemy risk assessment off of averages from these references. As long as you ask more than a couple, you should end up with a fairly accurate picture of what your projected customer base will eventually look like.

So are you thinking you will only require multi-factor where a customer can initiate bill pay or funds transfers on-line? If so, that would save us a lot of money. Our compliance officer thinks we should have multi-factor on any online account even if they can only transfer money between accounts, with no bill-pay or funds transfer capability.