My bank is preparing to go online with internet banking through Fiserv - Fiserv maintains the internet banking site, manages security, etc. My question relates to insurance coverage, e.g. since Fiserv maintains the product (Internet Banking), what level of insurance should be considered by the customer bank? Of course, hacking would be the big issue, but hackers will not get anywhere on our site, but may get somewhere on Fiserv's (ITI's) site, so Fiserv (It seems to me) needs to maintain coverage, correct? What coverage needs to be maintained by the customer bank?

I don't know who your regulator is, but ours is very concerned that we have our own insurance to cover internet banking products. Unfortunately, as the occurrences of hacking increase, the level of coverage insurance companies are willing to extend is decreasing. And this lower level of coverage is costing more. And finally, I would be very careful about assuming that your provider is the only one who needs to worry about a possible hacking.

Your response is way too general to be helpful. Perhaps its the framing of the question, but the fact that a third party furnishes the entire package, including security, has got to be taken into account when looking at insurance coverage. Yes, I know that hacking is a problem for everyone.

I don't believe that there is a clear cut answer to your question. Regulators are looking to make sure that banks have completed adequate risk assessments on thier internet banking operations and insurance is only one way to mitigate those risks. The riskier the operation, the more insurance is an important factor. Relying on FiServe to take any hit may be based on the contractual relationship that you have, thier financial status, the amount of insurance that they carry, etc. These are all factors that have to go into the risk analyses to determine the amount of insurance that may be appropriate for you institution.

Sorry, I had edited my post to include more information but it didn't "take". My comments basically mimicked rlcarey's in that you should do a risk assessment and look at things like the amount and type of coverage Fiserv has, expected activity within the product, cost to you to purchase insurance, potential losses, etc. Even if you decide to rely on Fiserv's insurance coverage alone, at least the risk assessment would show that you did review the entire process.