On May 13, 2022, the Federal Financial Institutions Examination Council (FFIEC) rescinded the E-Banking booklet in its Information Technology Examination Handbook. The booklet had been in place since 2003, and its release led many banks and credit unions to create a separate electronic banking policy and risk assessment.

The rescission does not mean electronic banking risk disappeared. It means you can address that risk through the broader risk management disciplines already covered elsewhere in the FFIEC handbook. Operational risk belongs in business continuity management. Information security risk belongs in the Information Security booklet. Cyber risk can be evaluated through your institution’s cybersecurity assessment process. Third-party risk belongs in vendor management and oversight.

For your institution, this creates room to reduce duplication. A separate policy or assessment can become less useful when it repeats controls, owners, and risks already documented across the information security program. Bringing the work together can give management and the board a clearer view of how electronic banking depends on systems, vendors, people, and recovery capabilities.

The stronger approach is not to delete the old documents and move on. Review where each electronic banking risk is now addressed. Confirm that ownership is clear, controls are documented, and reporting still reaches the people responsible for oversight. If a risk does not have a home in the broader program, the consolidation is not finished.

This change also reflects a practical direction for regulatory guidance. Technology evolves faster than a handbook organized around individual channels or products can keep up. Risk management principles can apply across mobile banking, online account access, payment systems, cloud services, and the next technology your institution adopts.

The rescission may remove one policy and one risk assessment from your workload. More important, it gives you a reason to check whether the remaining program tells one coherent story. Your examiners should be able to see how your institution identifies electronic banking risk, applies controls, monitors performance, manages third parties, and prepares for disruption without tracing the same issue through several disconnected documents.