Summary

  • Cardinal Bancshares needed approval to establish Security First Network Bank. A contemporaneous OTS account says it did not need a separate permit merely to offer banking on the Internet.
  • The regulator attached electronic-security duties to the new institution. Later orders show that bank ownership, audits and community-lending obligations remained tied to the institution, however customers reached it.

A bank approval, with a modem in the story

In May 1995, the Office of Thrift Supervision approved what it later called the nation's first Internet bank: Security First Network Bank. By October, customers could open accounts, move funds between accounts and pay bills through the Internet. The familiar history stops there, at the browser. The regulator's record goes one step further and makes the whole experiment more interesting.

Cardinal Bancshares sought permission to establish Security First as a subsidiary. A contemporary OTS account, preserved in the FDIC Banking Review, says Cardinal did not have to ask for permission simply to operate on the Internet. It applied because it was setting up a new bank. The OTS approved the institution and required it to address electronic-security issues.

That distinction made the Web a delivery route, not a banking charter. A customer might meet the bank through a modem and a screen; the legal organization behind the account still had to be approved and supervised. The bank's novelty was its customer interface. The deposit institution was not a collection of web pages that had promoted itself into a bank.

The OTS repeated the chronology in its July 1997 announcement for Atlanta Internet Bank. It called that institution the second Internet bank it had approved in two years and dated Security First's approval to May 1995. The same announcement placed Atlanta Internet Bank in Columbia, South Carolina, while saying much of its operation would run out of Atlanta. Even the later “all-Internet” bank had a legal home and an operating office. The network could stretch the customer route; it could not make institutional geography disappear.

The screen did not absorb the bank's duties

The OTS was willing to treat the Internet as a route for services already within a thrift's powers. It was less willing to treat a glowing screen as a security control. In a January 1998 speech, director Ellen Seidman said the agency required each Internet applicant to hire an independent security firm to test account security. She named account integrity, consumer protection and Community Reinvestment Act duties alongside ordinary safety and soundness.

The 1997 Atlanta Internet Bank approval shows what that scrutiny could look like in a later case. The OTS required independent specialists to test whether its Internet operation could be entered without authorization or detection, and set a deadline for the review. Those are Atlanta Internet Bank's documented conditions. Security First's 1995 approval carried electronic-security conditions, according to the FDIC account; the precise text of that first order is absent from this source packet. The original order would show exactly what the regulator required in Security First's own case.

The harder continuity test arrived when the owner changed. In Order 98-87, dated 21 August 1998, the OTS approved Royal Bank of Canada's application to acquire control of Security First. The order called the target a federal stock savings bank. It required independent audit reports for three fiscal years, an enhanced Community Reinvestment Act plan, and prior approval for major deviations from the submitted business plan. That is a remarkably physical list for a supposedly virtual institution: board, audit, capital plan and lending obligations all remained attached to the bank.

The order approved a transaction subject to conditions. A later S1 Corporation filing with the SEC says the banking operations were sold to Royal Bank of Canada in 1998 and the remaining company focused on software. The bank and the technology supplier had become different commercial paths. A browser could be moved across institutions; a banking charter and its supervisory duties could not be copied with the interface.

The first Internet bank is often remembered as a new address for money. The original records make it a sharper lesson about authority. The regulator approved a bank, tested a new way to reach it, and kept looking for the people and records responsible when the owner changed. The modem shortened the distance to the customer. It never signed the audit report.

Sources