If you are thinking about doing this yourself, I would hire some programmer who used to work for a bank (lots of those around nowadays). I don't recall if ther

If you are thinking about doing this yourself, I would hire some programmer who used to work for a bank (lots of those around nowadays). I don't recall if there are any Federal or industry guidelines for banking encryption, but there is FIPS for general security. There is also explicit law about audit trails, chains of custody, access controls, reporting breaches, etc. In general you are legally obligated to know you were pwned and how. Access to a system must not allow access to data. Access to one account must not allow access to another (ie, use a different encryption key for each account). Physical access to a system must be secured and audited, etc.