Online Banking Application for New User

I just finished an IL State IT Exam and I received a repeat violation for not obtaining a signature to verify an online banking application. Examiner is trying to claim that we should require new internet banking users to print out the application that they have to fill out online and sign it and return it to our bank before we give them online access to their accounts. We are already using 2 validation questions (last deposit amount and balance of last statement) and he is still stating that this isn't proper identity verification. Does anyone have any thoughts on this? I am presenting to my Board in September and I want them to record in the minutes that we accept the rist of our verification program. I need some backup information to prove this to them. Under the USA Patriot Act the law requires each covered financial institution to, at a minimum; verify the identity of any person seeking to open an account to the extent reasonable and practicable. Signing an online application is not reasonable or practical. Does anyone have any thoughts or experience with this?

Authentication should be based on your CIP and consistent with the USA Patriot Act. The FFIEC does suggest in the FFIEC E-Banking IT Examination handbook that "New account applications submitted on-line increase the difficulty of verifying that application information. Many institutions choose to require the customer to come into an office or branch to complete the account opening process." (pg. 31). This may be where your examiner is coming from . . .

FFIEC IT Examination Handbook - E-Banking Booklet - August 2003

Most banks will allow the customer to mail-in the signed application as well. The "violation" noted by the state examiner is his/her opinion, as I am not aware of a regulation or law that requires hand-written signatures for applications. As suggested by RH, if your CIP adequately documents the verification process for on-line applications, and if the CIP sufficiently outlines the risk mitigants, then you should be fine. But in the end, you will need to make the state examiner happy. (Is the FDIC on-board with the state examiner's conclusion?)

FDIC has never said one thing about it.

You need to decide if you'll accept the criticism or dispute it. Does your state require a written, signed application? What about E-Sign/UETA rules?

I think the bottom line for me would be to ask for a cite, where I could see this requirement. I don't know otherwise that it exists. Next, you need to decide if you want to fight this. It needs to be resolved before your next exam. The board accepting the risk is support, but certainly doesn't resolve the disagreement with your regulator. You need to decide if you'll bump this up to an ombudsman or the next level in that agency's chain.