Competition and technology are demanding that banks provide more convenient payment choices for consumers.  Consequently, banks are offering mobile financial services (MFS) that can be accessed through mobile devices such as phones, tablets and similar devices. 

Friday, the Federal Financial Institution Examination Council released a new Appendix, “Mobile Financial Services,” to the “Retail Payment Systems” booklet of the FFIEC Information Technology (IT) Examination Handbook. This new Appendix E focuses on risks associated with activities and devices for mobile financial services. The Appendix emphasizes an enterprise-wide risk management approach for effectively managing and mitigating existing and evolving risks.  The FDIC and the OCC also have issued bulletins that make the new FFIEC Appendix applicable to national banks and all banks regulated by the FDIC.

The new Appendix states that management should identify, measure, mitigate, and monitor the risks involved and be familiar with technologies that enable MFS.  It reminds bankers that MFS can pose elevated risks related to device security, authentication, data security, application security, data transmission security, compliance, and third-party management.  To address these risks, the Appendix discusses what bankers must do to identify and measure the risks associated with MFS technologies as well as what needs to be done to mitigate those risks.  Additionally, it discusses what is necessary for a bank to have in place appropriate performance monitoring systems for assessing whether the product or service is meeting operational expectations.

Equally as important to the guidance it gives to bankers, the Appendix also provides direction to examiners when they are reviewing a bank’s program that allows a mobile device to access a customer’s accounts.  It directs examiners to accomplish nine specific objectives during the examination of a bank’s program to allow mobile devices to access financial services offered by the bank.  Banks that offer MFS for its customers must be prepared to effectively respond to the examiner’s inquiries.