31 October 2026 · 11 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)
GLBA and FFIEC Penetration Testing: What Banks, Credit Unions and Non-Bank Financial Institutions Must Test, How Often, and for Whom
The Gramm-Leach-Bliley Act set one goal, safeguarding customer financial information, and left five regulators to define how. The FTC now requires non-bank institutions to test annually and assess vulnerabilities every six months; the banking agencies and the NCUA examine against the FFIEC handbook and expect independent testing of the systems that move money. This guide maps the obligations and the scope an examiner expects to see.
What GLBA requires and the two regulatory tracks
The Gramm-Leach-Bliley Act of 1999 requires financial institutions to protect the security and confidentiality of customers' non-public personal information. Section 501(b) of the Act instructed the financial regulators to write safeguards standards, and they did so on two tracks that still define the landscape in 2026. Banks, thrifts and their holding companies fall under the Interagency Guidelines Establishing Information Security Standards issued by the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC) and the Federal Reserve Board (FRB), examined using the Federal Financial Institutions Examination Council (FFIEC) IT Examination Handbook. Federally insured credit unions fall under the National Credit Union Administration (NCUA) and its equivalent guidelines in 12 CFR Part 748. Everyone else that is 'significantly engaged' in financial activities but is not a bank falls under the Federal Trade Commission's Safeguards Rule, 16 CFR Part 314.
The non-bank population is far larger than most people assume: mortgage brokers and non-bank lenders, auto dealers that arrange financing, payday and instalment lenders, loan servicers, collection agencies, tax preparers, check cashers and money transmitters not otherwise regulated, investment advisers not registered with the SEC, and the thousands of colleges and universities that participate in federal student aid, for whom the Department of Education enforces Safeguards Rule compliance. European fintechs that lend, service or broker in the United States through a US entity, and European groups with US non-bank subsidiaries, are in this population.
The two tracks differ in style. The FTC rule is prescriptive, with named controls and frequencies. The banking and credit union track is principles-based and examination-driven: the guidelines require regular testing of key controls by independent parties, and the FFIEC handbook tells examiners what a credible testing programme looks like. In practice both tracks converge on the same expectation: an independent penetration test of the systems that hold or move customer money and data, at least annually, from both the internet and the inside.
The FTC Safeguards Rule: what 16 CFR Part 314 requires since June 2023
The FTC's 2021 amendments, with most provisions effective 9 June 2023, turned a short principles rule into a control catalogue. Section 314.4 lists the elements of a compliant information security programme.
314.4(d)(2): annual penetration testing and semi-annual vulnerability assessments
Unless the institution implements continuous monitoring, it must conduct penetration testing of its information systems at least annually, based on the risk assessment, and vulnerability assessments, including systemic scans or reviews of information systems reasonably designed to identify publicly known vulnerabilities, at least every six months, and additionally whenever there are material changes to operations or business arrangements or circumstances that may have a material impact on the programme. Institutions holding information on fewer than 5,000 consumers are exempt from this element.
314.4(c): the technical safeguards the test measures
Access controls and least privilege, an inventory of data, personnel, devices and systems, encryption of customer information in transit over external networks and at rest, secure development practices for in-house applications, multi-factor authentication for any individual accessing any information system, secure disposal of customer information no later than two years after last use, change management procedures, and monitoring and logging of authorised user activity. These are the controls a penetration test exercises; the test is how (d) confirms that (c) is real.
314.4(h) and (i): incident response plan and the annual board report
A written incident response plan with defined goals, internal processes, roles, external communications, remediation and documentation, and an annual written report from the Qualified Individual to the board or senior officer covering the status of the programme, risk assessment, test results, security events and recommended changes. Penetration test results are named content for that report.
314.4(j): notifying the FTC within 30 days
Since 13 May 2024, a notification event involving unencrypted customer information of at least 500 consumers must be reported to the FTC as soon as possible and no later than 30 days after discovery, through the FTC's online form. The notice becomes public. The connection to testing is direct: the most common notification events (compromised credentials without MFA, exposed file transfer systems, unpatched perimeter appliances) are precisely what an annual external and internal test is designed to find first.
Who regulates whom, and what each expects from testing
The institution type determines the regulator, the examination style and the incident clock. The testing expectation is similar across the table; the paperwork is not.
| Institution | Primary regulator and rule | Testing expectation | Incident notification |
|---|---|---|---|
| Non-bank financial institutions (lenders, brokers, servicers, dealers, higher education) | FTC, Safeguards Rule 16 CFR Part 314 (Department of Education enforces for Title IV institutions) | Annual penetration test plus vulnerability assessments every six months, or continuous monitoring; results in the annual board report | FTC within 30 days for events involving 500 or more consumers |
| National banks and federal savings associations | OCC, 12 CFR Part 30 Appendix B; FFIEC IT Handbook | Regular testing of key controls by independent parties, scope and frequency set by risk; examiners expect annual external and internal testing of critical systems | Primary regulator within 36 hours of a notification incident |
| State non-member banks | FDIC, 12 CFR Part 364 Appendix B; FFIEC IT Handbook | Same interagency guidelines; FDIC IT examinations use the FFIEC InTREx procedures | Within 36 hours |
| State member banks and bank holding companies | Federal Reserve Board, 12 CFR Part 208 and 225 appendices; FFIEC IT Handbook | Same interagency guidelines; holding companies expected to oversee testing at subsidiaries | Within 36 hours |
| Federally insured credit unions | NCUA, 12 CFR Part 748 Appendix A; Information Security Examination (ISE) procedures | Independent testing of controls proportionate to size and complexity; ISE reviews the testing programme and its follow-up | NCUA within 72 hours of a reportable cyber incident (12 CFR 748.1(c)) |
| Any of the above with a New York licence | Also NYDFS, 23 NYCRR Part 500 | Annual penetration testing from inside and outside under 500.5, in addition to the above | NYDFS within 72 hours; extortion payments within 24 hours |
The FFIEC handbook, the CAT sunset and the NCUA ISE
For banks and credit unions the operative text is the FFIEC IT Examination Handbook, in particular the Information Security booklet (2016) and the Architecture, Infrastructure and Operations booklet (2021). The Information Security booklet's section on programme effectiveness describes the assurance activities examiners expect: audits, vulnerability assessments and penetration tests, performed by parties independent of those who build and run the controls, with scope driven by the risk assessment, results reported to the board, and findings tracked to closure. The booklet is explicit that a penetration test should attempt to exploit vulnerabilities rather than list them, and that the institution should test from the perspective of an outsider on the internet and of an insider or compromised host.
The FFIEC Cybersecurity Assessment Tool (CAT), which many institutions used since 2015 to self-assess inherent risk and maturity, was retired on 31 August 2025. The FFIEC pointed institutions to alternatives: the NIST Cybersecurity Framework 2.0, the Cyber Risk Institute (CRI) Profile, which is the sector-specific overlay of NIST CSF, the CISA Cross-Sector Cybersecurity Performance Goals, and the CIS Critical Security Controls. Whichever framework an institution adopts, the testing expectation does not move: each of them contains an outcome that controls are tested for effectiveness, and examiners will ask how.
Credit unions are examined by the NCUA under its Information Security Examination (ISE) procedures, introduced in 2023 and scaled to the size and complexity of the institution. The ISE reviews governance, risk assessment, controls and, specifically, the testing programme: who tested, when, what was found, and whether management closed the findings. Since September 2023 credit unions must also notify the NCUA within 72 hours of a reportable cyber incident, which places the same premium on finding exposures through testing before an attacker does.
What a bank or credit union penetration test should cover
Examiners judge the scope against the institution's risk assessment and its business. For most banks and credit unions the following systems are where customer money and data are at risk.
- Online and mobile banking: authentication and enrolment flows, account takeover paths, transaction authorisation, session management, and the APIs behind the mobile applications
- Interfaces to the core banking system and the core processor, including file transfers, batch jobs and the privileged accounts that administer them (the processor's own environment is covered by its SOC reports; your side of the interface is yours to test)
- Payment origination: wire, ACH and real-time payment systems, dual-control enforcement, and the workstations and users that can initiate or approve payments
- The internal network from an assumed-breach position: Active Directory, privileged access paths, segmentation between branch, back office and payment environments
- Remote access, VPN and virtual desktop infrastructure, including third-party and contractor access
- Branch and ATM networks, teller systems and the connectivity between them and the data centre or cloud
- Email and social engineering: phishing resistance of staff with payment or administrative privileges, consistent with the training requirement in both tracks
- Fintech, banking-as-a-service and vendor integrations: the APIs, credentials and data flows that partners use, and what a compromised partner connection could reach
- Where the institution is a SWIFT user: the secure zone, operator PCs and the controls in the Customer Security Controls Framework
- Detection: what the SOC or managed detection and response provider saw during the internal test, and how long it took
Third parties, banking-as-a-service and SWIFT
Both GLBA tracks make the institution responsible for its service providers. The FTC rule requires institutions to select providers capable of maintaining safeguards, to require them by contract, and to periodically assess them. The banking agencies' Interagency Guidance on Third-Party Relationships of June 2023 sets out the life cycle: due diligence, contracting, ongoing monitoring and termination, with heightened scrutiny for critical activities. Banking-as-a-service arrangements, in which a bank provides the charter and a fintech provides the customer relationship and the technology, drew a series of enforcement actions in 2024 and 2025 precisely because the sponsor bank had not tested or monitored what its partner built. The practical consequence for a fintech partner is that the sponsor bank will ask for a current penetration test report of the fintech's platform and of the integration, and for the European fintechs serving US banks that question arrives during onboarding.
Institutions connected to SWIFT carry a further programme: the Customer Security Programme (CSP) and its Customer Security Controls Framework, attested annually in the KYC Security Attestation application with an independent assessment required since 2021. The framework includes an advisory penetration testing control (7.3A) covering the SWIFT secure zone, operator PCs and connectors, and a mandatory vulnerability scanning control. A bank that aligns its annual penetration test with the CSCF scope, and tests the secure zone from the position of a compromised corporate workstation, answers both its GLBA examiners and its SWIFT assessor with one engagement.
How HackersHub supports GLBA and FFIEC testing programmes
We scope the engagement to the systems in the institution's risk assessment that hold or move customer information: online and mobile banking, payment origination, core interfaces, the internal network and the integrations with partners and processors. The test combines an external component against the internet-facing perimeter and applications, an assumed-breach component from a standard workstation to measure what a phished employee or a compromised vendor connection could reach, and a detection record that shows what the institution's monitoring saw. For FTC-regulated institutions we structure the annual test and the six-monthly vulnerability assessments as one programme with one evidence trail for the Qualified Individual's annual report. For banks and credit unions the report is written to be handed to the examiner: scope tied to the risk assessment, methodology stated (NIST SP 800-115, OWASP), named independent testers, risk-rated findings and a retest.
Testers are OSCP-certified and named in the report. HackersHub is based in Amsterdam, Netherlands and works for financial institutions and fintechs in Europe and the United States; US environments are tested remotely within agreed windows and US business hours, and for European groups with US subsidiaries we align the GLBA engagement with the DORA programme so one annual test serves both.
Frequently asked questions
Preparing for your next IT examination?
We test the systems that hold and move customer money from the internet and from the inside, record what your monitoring detected, and write the report for the examiner who will read it. Talk to an expert.