This included obtaining information on Internet banking risks and each regulator’s strategy for overseeing Internet banking activities, the methods used to identify depository institutions that offer Internet banking, the existence of safety and soundness and information systems examination procedures for reviewing Internet banking, and the extent of examinations of third- party firms. Regulators Agree Internet Banking Presents Risks and Oversight Challenges, While Extent of Any Industrywide Problems Is Unknown

Internet banking services heighten various types of risks that are of concern to banking regulators, and the regulators have advised institutions to mitigate these risks through the implementation of risk management systems that emphasize, among other things, (1) active board of directors’ oversight, (2) effective internal controls, and (3) comprehensive internal audits. Most regulators provided such guidance in advisory letters to all covered depository institutions. Too Few Examinations Had Been Conducted to Identify the Extent of Any Industrywide Internet Banking-Related Problems

While examiners found that some depository institutions were not taking all of the prescribed precautions to mitigate risks, too few examinations with documented on-line banking assessments were available at the time of our review to identify the extent of any industrywide Internet banking- related problems. OTS recently established a requirement that it receive advance notice of an institution’s plans to establish a transactional Web site. Other Monitoring Methods to Identify Depository Institutions Offering Internet Banking

Regulators use a variety of other methods to identify depository institutions that are already offering Internet banking services. In contrast, FRS and OCC do not require that an institution’s new Internet banking activity be thoroughly examined. However, OTS and FDIC were the only regulators with procedures to gather centralized information on depository institutions’ plans to offer Internet banking. With the exception of NCUA, the banking regulators were developing, testing, or implementing new on-line banking examination procedures and had conducted at least some examinations of institutions’ Internet banking services. Objectives, Scope, and Methodology

Our objectives were to (1) describe risks posed by Internet banking and any identified industrywide Internet banking-related problems, (2) assess the methods used by regulators to track depository institutions’ plans to provide Internet banking services, (3) determine how regulators examined Internet banking activities, and (4) determine the extent to which regulators examined firms providing Internet banking support services to depository institutions. To identify the risks posed by Internet banking, we interviewed officials from the Federal Deposit Insurance Corporation (FDIC), Federal Reserve System (FRS), Office of the Comptroller of the Currency (OCC), Office of Thrift Supervision (OTS), and National Credit Union Administration (NCUA). 5. 6. OTS commented that the draft of this report did not include information on its Web site reporting requirement and the agency’s national database. 4.
Why GAO Did This Study

Pursuant to a congressional request, GAO reviewed federal oversight of depository institutions' Internet banking activities, focusing on: (1) the risks posed by Internet banking and the extent of any industrywide Internet banking-related problems; (2) the methods used by regulators to track depository institutions' plans to provide Internet banking services; (3) how regulators examined Internet banking activities; and (4) the extent to which regulators examined firms providing Internet banking support services to depository institutions.

What GAO Found

GAO noted that: (1) Internet banking heightens various types of traditional banking risks of concern to regulators, including strategic, compliance, security, reputation, and transactional risks; (2) as provided in regulatory guidance to banks, savings and loan associations, and credit unions, these risks should be managed through implementation of risk management systems that emphasize active board and senior management oversight, effective internal controls, and comprehensive and ongoing internal audit programs; (3) examinations of Internet banking that GAO reviewed found that some depository institutions were not taking all the necessary precautions to mitigate Internet banking risks; (4) while deficiencies were found, none of these examinations reported any financial losses or security breaches; (5) during GAO's review, too few examinations had been completed to identify the extent of any industrywide Internet banking-related problems; (6) regulators use a variety of methods to identify depository institutions that are already offering Internet banking services, however, only two regulators had systematically obtained centralized information on depository institutions' plans to provide such services and had a database of this information at the time of GAO's review; (7) the Office of Thrift Supervision recently established a requirement that depository institutions: (a) notify it in advance of plans to establish a transactional Web site; and (b) report their Web site address in quarterly Thrift Financial Report filings; (8) the Federal Deposit Insurance Corporation developed a centralized database that contains information on a depository institution's plans to provide Internet banking services; (9) most regulators were developing, testing, or implementing new on-line banking examination procedures, which included procedures for examinations of Internet banking, and most had conducted at least some examinations of depository institutions' Internet banking operations; (10) the Federal Reserve System (FRS) and the Office of the Comptroller of the Currency do not require that an institution's new Internet banking activity be thoroughly examined; (11) the National Credit Union Administration (NCUA) was the only regulator that had not developed requirements and procedures for Internet banking examinations; and (12) each regulator has the authority to examine depository institutions' banking services provided by a third party and to avoid duplication of effort, regulators often cooperate in examining third-party firms.