I'm not sure why you would assume that Google Analytics or other third-party analytics software would be forbidden. Google probably has a better security model

I'm not sure why you would assume that Google Analytics or other third-party analytics software would be forbidden. Google probably has a better security model than most banks, especially with premier products like Google Analytics. It also doesn't give information about your banking info unless Google Analytics has been completely compromised. Additionally most bank security teams would immediately notice that the network traffic sent to Google Analytics had increased exponentially. Jacques Mattheij's research does indicate some security risk, but not an enormous amount. Most of these externally-hosted javascript libraries have dedicated security teams on par or better than those at banks