Hello,

We're currently building out our new account process for online applications and I'm wondering whether or not the "welcome" email can contain and unmasked account number. This is needed in order to access online banking.

Is there a regulation that governs this that I'm not aware of and do you happen to know if this needs to go out securely, like with docusign or another secure platform?

Any takers?

Transmitting account numbers unsecured is never a good idea. Since you appear to be in CA, you might check State law. If you are opening accounts online, I am confused how that is done in a non-secure environment or at least your account opening disclosure are not delivered secured prior to the account actually being opened and why, if you need to deliver an account number, you will deliver it using a different method.

These are my thoughts exactly and why I'm making sure we get this right. From what I can tell there is no current law or regulation, federal or state, so it's falling back to best practice. I'd like to deliver them using a secure passcode and will push for that method.

The account opening enviornment is secure but the welcome notice sent is what is in question. Some accounts will not be approved automatically so we are trying to figure this piece out.

Thanks for your assistance.

if they are opening the account online in a secure fashion, is the account number not displayed to them at that time? why would any follow up email need to display anything but a masked number with a few of the last digits showing? perhaps i am not understanding how your online account open process works.

but sending them the full account number unsecured? just opening the bank to issues.

The situation has been completely resolved now, as the vendor has released an update that allows for an alternative. A follow-up notice will be sent with secure access only, required authentication, and expires.

The reason for the follow-up notice is only for accounts not immediately approved during the application.