# Do US banks have to follow NIST SP 800-63?

> **Short answer:** Not directly. NIST SP 800-63 is written for US federal agencies, and no banking regulator has adopted it as a rule for banks. In practice examiners, auditors and security teams use it as the benchmark for authentication strength, while the FFIEC’s 2021 guidance asks banks to match controls to risk rather than prescribing methods.

- URL: https://glide-cleartext.pages.dev/q/do-us-banks-have-to-follow-nist-800-63/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

## Who the guidelines bind

The Digital Identity Guidelines set requirements for US federal agencies that authenticate people to government systems.[^1] Banks are supervised by banking regulators, and the Federal Financial Institutions Examination Council (FFIEC) coordinates the examination standards those regulators use.[^2]

## What the FFIEC expects instead

The FFIEC’s August 2021 guidance, *Authentication and Access to Financial Institution Services and Systems*, is written in terms of risk, not methods.[^2] It asks institutions to assess the threats to each customer and employee access path and to apply controls that match. It does not name SMS codes, passkeys or any other technology as required or forbidden.

## Why NIST still matters to banks

When an examiner, auditor or board asks how strong a login is, NIST’s authentication assurance levels are the common yardstick. NIST also moves first: its classification of SMS codes as restricted is the most-cited US reference point in arguments about retiring them.[^1] See [is SMS OTP still allowed under NIST 800-63-4?](https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/).

## What this means for you

### Banks & credit unions

Expect to be asked how your authentication compares with NIST even though you aren’t bound by it. Mapping each login and step-up flow to an assurance level (AAL1–AAL3) gives examiners a common vocabulary.

### Fintechs & payment firms

If you partner with a bank, its vendor-risk team will likely use NIST terms in due diligence. Having your own mapping ready shortens that process.

### Developers & identity teams

Use NIST’s assurance levels as the design target for each flow. They translate into concrete requirements, such as which authenticator types are acceptable at AAL2.

## Follow-up questions

**What does the FFIEC 2021 guidance replace?**

It superseded the FFIEC’s 2005 guidance on authentication in internet banking and its 2011 supplement.


## Sources

[^1]: SP 800-63-4: Digital Identity Guidelines. NIST. https://pages.nist.gov/800-63-4/
[^2]: Authentication and Access to Financial Institution Services and Systems. FFIEC, 2021-08-11. https://www.ffiec.gov/news/press-releases/2021/pr-08-11

## Related questions

- [Is SMS OTP still allowed under NIST SP 800-63-4?](https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/)
- [Has any US regulator banned SMS OTP?](https://glide-cleartext.pages.dev/q/has-any-us-regulator-banned-sms-otp/)
- [What does “restricted authenticator” mean in NIST SP 800-63B-4?](https://glide-cleartext.pages.dev/q/what-does-restricted-authenticator-mean-in-nist-800-63b/)

## Cite

Cleartext. “Do US banks have to follow NIST SP 800-63?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/do-us-banks-have-to-follow-nist-800-63/

## Changelog

- 2026-09-24: First published.