Banks rarely lack access policies. The challenge is proving that each permission still makes sense after a promotion, transfer or contractor change. Identity Governance & Administration (IGA) manages the approval, review and removal of digital access throughout a user’s lifecycle, as explained in tenfold’s guide to identity governance.
Banks rely on core banking platforms, payment systems, trading tools, customer databases, and cloud services. Staff need access to do their jobs, but outdated permissions can expose sensitive data or allow transactions to bypass checks. Compliance teams must show that access is justified, current, and traceable.
Why Regulatory Pressure Is Growing
Requirements vary by jurisdiction and service, but many frameworks expect strong access controls. The EU’s Digital Operational Resilience Act (DORA) has applied since January 2025 and requires in-scope financial entities to maintain sound ICT risk management and incident reporting. Its technical standards cover the identity lifecycle, least privilege, segregation of duties and the removal of access rights. Under Commission Delegated Regulation (EU) 2024/1774, access rights must be reviewed at least once a year, and at least every six months for systems supporting critical or important functions.
In the US, the Sarbanes-Oxley Act (SOX) requires applicable public companies to maintain and assess internal controls over financial reporting. Access permissions affecting financial reporting systems may form part of that control environment, particularly where users can change records, approve transactions or bypass segregation-of-duties safeguards.
PCI DSS applies to organisations that store, process or transmit cardholder data, as well as certain service providers whose activities can affect the security of payment account data. The PCI Security Standards Council sets out the requirements needed to demonstrate these outcomes. An IGA tool alone does not make a bank PCI DSS compliant, but it helps apply a consistent process and record evidence.
Access Reviews Need to Lead to Decisions
Access reviews ask whether a person still needs a permission. A team lead might approve access to a retail lending application for their reports, while a system owner might approve access to a treasury management system. Long lists of permissions that aren’t translated into plain language lead to rubber-stamping rather than an intelligent second check.
Reviews only work when decisions lead to action: remove unneeded access, document exceptions and escalate overdue decisions. Records should show who made the decision and when, which system and permission were affected, the business purpose and whether the change was actually applied. This turns reviews into a real process control rather than a box-ticking exercise carried out once before an audit.
Segregation of Duties Helps Reduce Insider Risk
SoD means ensuring that no one person has enough permissions to bypass a critical control. A single individual who can create a supplier and amend the payment details and then send them for payment could commit fraud or conceal errors. SoD rules can either block specific combinations of permissions outright or flag high-risk combinations for additional approval.
IGA tools can check role assignments against defined conflict rules, but exceptions remain. In a small team, for example, one employee may need to handle both reconciliation and payment release. The bank should document the exception, implement appropriate compensating controls and review the conflict at a frequency proportionate to the risk, potentially quarterly for higher-risk situations.
Why Manual Processes No Longer Scale
Spreadsheets and email become unreliable as applications, contractors, service accounts and staff changes multiply. Lists fall out of sync, owners use different formats, and approvals can be recorded without confirming access was removed. Reviewers may also lack the context to understand what a permission allows.
IGA platforms such as tenfold automate these tasks. When HR records a departure or role change, a workflow can notify teams, trigger access changes and log the result. Central reporting shows permissions across connected systems; standardised reviews flag overdue approvals and exceptions. Integration remains essential: an IGA platform can only report reliably on systems that are connected and maintained.
Making Governance a Working Control
Banks should identify critical systems, their owners and the rules for access. They can then set role-based permissions, risk-based review cycles and clear responsibility for granting, changing and revoking access. Privileged accounts, emergency access and third parties deserve close attention.
Useful measures include overdue reviews, time to remove access after departure, unresolved conflicts and recurring exceptions. These show where the process needs improvement. Counting completed reviews alone says little about whether risk has fallen.
Identity governance is becoming a core compliance function because banks must show that access rules work. Clear ownership, meaningful reviews, segregation of duties and timely offboarding make decisions easier to explain and evidence. Automation helps compliance and IT teams maintain control as systems and workforces change.