The FDIC is where most of your IT security requirements will come from. Below I have listed a few items which make the cloud a non-starter. In summary, it costs

The FDIC is where most of your IT security requirements will come from. Below I have listed a few items which make the cloud a non-starter. In summary, it costs $20+ million dollars to start a bank. The reason every small bank has the same crappy online banking and digital services is because everyone except large institutional banks has to outsource everything to a handful of third party providers who can maintain these requirements. As far as your business idea, you should check out simple.com. They have been working on the problem for years and have just barely managed to cut enough red tape to provide a not terrible user experience for a handful of tasks. Have a full accounting and audit of every VoIP device, VPN device, wireless device, switch, router, modem, firewall, and proxy server connected to the network. Demonstrate physical access controls for employees, vendors, and anyone else who may have access your equipment. Every single person with physical access to customer information devices must have a 10-year criminal background check performed (this is actually a federal law that applies to the Finance, public education, public transportation, etc industries). Formal configuration and patch management procedures for all devices (including upstream routers and switches). Diagrams of physical and logical network topologies. The Fair and Accurate Credit Transactions Act of 2003 requires physical destruction of devices storing customer data. Reporting of all physical security incidents to FDIC IT examination.