Consider security risks before offering account aggregation

Q: Our bank's growth strategy includes offering a diversity of financial products through the Internet. How important is account aggregation to this strategy?

A: Web-based account aggregation is one of the newest Internet financial services applications affecting banks, and one of the most

controversial. Aggregation services allow customers to see all of their financial accounts on a single Web page. They are offered by independent thirdparty providers directly to customers and by a handful of financial services firms that have signed on to provide customers portal access through their Web sites.

While some have embraced the new technology, many banks are concerned that account aggregation may compromise the security of customer information. In order for account aggregators to access customer information from many different accounts and locations, customers must provide all of their user names and passwords.

When the customer logs on to the aggregator's page, the aggregator uses the stored passwords to electronically "scrape" current information from each of the customer's online accounts. In most cases the financial institution is unaware whether the customer or an aggregator is accessing the customer's information.

Banks are also concerned that account aggregators will eventually leverage their customer relationships to sell financial services online, posing a competitive threat that is spurring some to begin offering the service directly.

New regulatory guidance to banks offering account aggregation services, released last March, noted that banks should carefully evaluate the security measures utilized by their service providers.

The release also stated that the use of data feeds, in which financial institutions initiate the transfer of information based on a customer's direct authorization, can help improve security and are preferred to screen- scraping technology.

Most financial institutions are not yet ready to invest in the technology required to provide direct data feeds that could end up benefiting their competitors.

In addition, the number of customers who currently use aggregation services is relatively small, making it harder to justify the expense.

Whether they choose to offer account aggregation now or wait for improvements in the technology, banks may want to make an extra effort to help their customers better understand the risks posed.