Internet Banking Growth Continues

Internet banking services are offered by a fast growing number of depository institutions. Regulators Need to Ensure Institutions Mitigate Risks

regulators have provided to depository institutions, concerning various types of Internet banking risks, including security risk, transactional risk, and various types of strategic risk. Limited Examinations Do Not Indicate the Extent of Any Industrywide Problems

Before I go into what we found in looking at examinations, I need to point out that, we found too few examinations had been completed to identify the extent of any industrywide Internet banking-related problems.Reasons the regulators gave for the small number of examinations done to date included examiners being diverted to mitigation efforts concerning the Year 2000 computer problem and a shortage of trained examiners to carry out Internet banking examinations. implemented the on-line banking risk mitigation steps outlined by the regulator. For example, regulators found that some institutions had not prepared strategic plans or had not obtained board of directors’ approval before initiating on-line banking. For example, examiners were concerned that some smaller institutions were implementing Internet banking systems before they had established operating policies and procedures and that bank management had to be reminded that operating policies and procedures were not optional. As more examinations are completed, information sharing among the regulators could help them better understand the extent of the risks posed by Internet banking, develop risk profiles that would allow them to target institutions requiring further attention, and help them allocate limited resources among competing priorities. Some Regulators Do Not Identify New Internet Banking Systems Plans

Before discussing how regulators supervise Internet banking, I want to touch on a problem we found in how some regulators identify depository institutions planning new Internet banking services. We found that regulators used a variety of methods to identify institutions that were already offering Internet banking services, such as Internet Web site searches and examiners’ preexamination planning information gathering. However, we found that only two regulators were systematically obtaining information on institutions’ plans to provide such services and had a centralized database of this information at the time of our review. Regulators’ Efforts to Supervise New Internet Banking Systems Differ

We found that regulators’ policies differed in the discretion examiners had to decide whether to examine an institution’s new Internet banking activity. In updating our information for this testimony, we were told that as part of the joint study, regulators have met with five of the largest third-party firms to discuss risks associated with Internet banking, to gain a better understanding of available products and services and the associated security features of those products and services, and to obtain information on these firms’ contingency plans. At the time of our fieldwork NCUA had not examined any third- party firm’s Internet banking services; but NCUA officials recognized the need to begin to conduct such examinations. We recommended that the Comptroller of the Currency, the Chairman of the Board of Governors of the Federal Reserve System, and the Chairman of the National Credit Union Administration establish procedures to obtain more timely information on institutions’ plans to offer Internet banking.
Why GAO Did This Study

Pursuant to a congressional request, GAO discussed the regulatory efforts to identify and mitigate risks to U.S. depository institutions' operations introduced by the growth in the use of Internet banking systems, focusing on: (1) the risks posed by Internet banking and the extent of any industrywide Internet banking problems; (2) how the five U.S. financial regulators track institutions' plans to provide Internet banking services; (3) how regulators have begun to examine Internet banking activities; and (4) the extent to which regulators have examined firms providing Internet banking support services to institutions.

What GAO Found

GAO noted that: (1) Internet banking heightens various types of traditional banking risks and GAO's review of 81 examinations showed that roughly 44 percent of the depository institutions examined had not completely implemented risk-management steps that regulators said are needed to limit on-line banking risks; (2) shortcomings included some institutions' lack of approval of strategic plans by their board of directors and a lack of policies and procedures at some institutions for Internet banking operations; (3) however, too few examinations had been conducted at the time of the review to identify the extent of any industrywide Internet banking-related problems; (4) regulators attributed their limited number of examinations to a diversion of examiners to higher-priority efforts to address the year 2000 computer problems and to their limited number of examiners with expertise in information systems; (5) GAO's work found that some regulators could use more systematic methods for identifying institutions' plans for new Internet banking systems and maintaining this information centrally; (6) GAO found that regulators use a variety of methods to identify depository institutions that already offer Internet banking services, but that only two of the regulators centrally collected information on plans for new services; (7) GAO found that regulators could benefit from adopting systems to keep abreast of institutions' plans for new Internet banking services and to allow them to proactively oversee this new and evolving banking activity; (8) GAO found variations in the supervisory approaches regulators followed to help ensure that institutions mitigate the risks posed by Internet banking; (9) GAO found that the Federal Deposit Insurance Corporation (FDIC) has completed the most examinations of on-line banking operations, and that the Office of Thrift Supervision and FDIC have been actively issuing policies and procedures for Internet banking examinations; (10) in contrast, the National Credit Union Administration (NCUA) had not conducted any Internet banking examinations at the time of GAO's fieldwork and was the only regulator that had not developed procedures for Internet banking examinations; (11) five regulators are beginning to work cooperatively to carry out a study of third-party firms providing Internet banking support services; and (12) although NCUA is part of the joint study, GAO is concerned that third-party firms providing services solely to credit unions are not being reviewed.