IGA for core banking fraud prevention: where access fails

At a glance

What this is: This is an analysis of how identity governance and administration reduces internal fraud in core banking by controlling standing access, separation of duties and lifecycle cleanup.

Why it matters: It matters because banks need to prevent misuse before transactions happen, and IAM teams must govern high-risk access across legacy core systems, vendors and internal roles.

Context

Core banking platforms concentrate the permissions that can move money, change records and update customer data, so access governance is a fraud control, not just an administrative function. When access outlives the task or role that justified it, the organisation is left trusting permissions that no longer match operational need.

This article frames identity governance and administration as the layer that keeps those permissions current across core systems, support teams, auditors and third parties. The underlying problem is not only who can log in, but who can still approve, change, reconcile or override within the banking workflow.

Key questions

Q: What breaks when banks do not remove core banking access after a role or contract ends?

A: The access itself becomes the fraud path. When permissions remain active after the business reason disappears, users can still move money, change records or approve actions inside the normal workflow. That is why delayed offboarding is not just inefficient. It preserves the exact authority internal fraud depends on.

Q: Why do standing privileges increase internal fraud risk in core banking environments?

A: Because they keep powerful actions available long after the original approval context is gone. In core banking, that means a user may retain the ability to override, adjust or approve transactions simply because the entitlement was never revisited. The longer that lasts, the more opportunity exists for quiet misuse.

Q: How do organisations know whether segregation of duties is actually working?

A: Segregation of duties is working only if no identity can combine enough permissions to complete the full banking workflow without an independent check. The test is not whether a policy exists, but whether cross-system role combinations are blocked before they create an end-to-end abuse path. If combinations are still possible, the control is only documented, not enforced.

Q: When should banks prioritise access review over broader fraud detection work?

A: When the concern is preventing internal misuse rather than investigating it after the fact. Detection finds suspicious transactions later, but access review decides whether the identity should have been able to act at all. If access governance is weak, monitoring only measures the size of the exposure.

Technical breakdown

Standing access in core banking becomes a fraud path

Core banking environments accumulate permissions because access is granted for operations, support, technology maintenance and vendor work, then left in place after the need expires. Standing access is especially dangerous where privileged roles overlap and older systems lack consistent offboarding discipline. The issue is not a single excessive account, but an access estate that keeps growing without a matching removal process. In that condition, routine permissions become latent fraud enablers because the identity still has the power to act even when the original business justification is gone.

Practical implication: govern core banking access as a lifecycle control, not a one-time approval.

Segregation of duties fails when roles are allowed to accumulate

Segregation of duties only works when no single identity can initiate, modify and approve the same financial process. In practice, banking teams often let combinations form gradually through role expansion, temporary exceptions and informal requests. Once those combinations span transaction entry, adjustment, reversal or beneficiary management, fraud can stay hidden inside normal system traffic. The technical failure is not that controls are absent on paper, but that the control model does not evaluate cross-role combinations continuously across platforms and business steps.

Practical implication: map conflicting entitlements across systems, not just within one role catalogue.

Why review timing matters more than review volume

Access reviews lose value when they occur long after the reason for access has changed. Infrequent certification means managers approve familiar-looking access without current context, especially in large banking estates where entitlement ownership is fragmented. The review then becomes a paperwork exercise rather than a governance decision. The deeper technical problem is stale context, because the longer access persists, the harder it is to distinguish legitimate operational use from overreach. Effective governance depends on review timing that tracks role change, risk change and usage change.

Practical implication: trigger reviews on role and risk changes, not only on calendar cycles.

Threat narrative

Attacker objective: The objective is to misuse legitimate banking permissions to move value, alter records or conceal unauthorized activity inside core systems.

1. Entry occurs through legitimate access that was originally granted for operations, support or vendor work and was never removed.
2. Escalation happens when standing privileges, shared credentials or toxic permission combinations let the user take actions beyond the original task.
3. Impact is internal fraud through movement, alteration or approval of transactions and records without needing to break the core system itself.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Core banking fraud is an access-governance failure before it is a detection problem. Internal misuse usually succeeds because a user still has valid authority when the business reason for that authority has already ended. That makes prevention a lifecycle issue, not an investigation issue. Banks that treat fraud mainly as a monitoring problem leave the most dangerous permissions untouched until after harm occurs.

Standing privilege is the control gap this article exposes. The article shows how access granted for a valid task becomes a fraud path when it is never removed or requalified. That is the governance failure, not a lack of alerts. Practitioners should read this as a warning that persistent entitlements are themselves a fraud condition.

Toxic permission combinations are more dangerous than broad access alone. Fraud in banking often depends on one identity being able to initiate, adjust and approve steps that should be separated. When those combinations cross systems, the risk is no longer a single overprivileged account but a process that can be executed end to end by one actor. Banks need to govern the workflow, not just the account.

High-risk banking access needs continuous accountability, not periodic reassurance. The article’s strongest point is that legitimacy on day one does not equal legitimacy on day 90. Access reviews, deprovisioning and SoD enforcement have to remain tied to current business need, or the control environment drifts into trust without verification. The implication is that governance must stay live across the entire entitlement lifecycle.

Identity Governance and Administration is the prevention layer for core banking fraud. IGA matters here because it constrains who can act, not just what happened after the fact. In regulated banking environments, that makes access governance a core resilience control under NIST-CSF, ISO 27001 and sector obligations. Practitioners should treat entitlement governance as a fraud-reduction mechanism, not an audit afterthought.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.

What this signals

Live entitlement governance is the difference between control and memory. Core banking programmes cannot rely on quarterly certification alone when roles, vendors and support assignments change continuously. The practical shift is toward lifecycle-driven governance that removes access as quickly as it grants it.

Core banking access should be governed as a fraud surface, not a help desk queue. The article’s logic is that legitimate access decays into risk when nobody owns the removal step. Banks that centralise approval without continuous revalidation will keep producing stale permissions that look authorised but no longer belong.

Identity lifecycle discipline is the control boundary most banking programmes still underuse. Joiner, mover and leaver events should drive permission changes automatically, especially where legacy cores still carry the highest privilege. That is where the control plane has to be most exact, because internal fraud exploits delay, not complexity.

For practitioners

• Audit standing access in core banking systems Identify accounts and roles that were granted for temporary support, projects or vendor tasks and never formally removed. Prioritise privileged entitlements that can move money, alter records or override approvals.
• Enforce segregation of duties across workflows Check whether any identity can initiate, modify and approve the same banking process across applications, not just within one system. Flag combinations that create end-to-end control over transactions, adjustments or beneficiary changes.
• Shorten the interval between access change and review Trigger access review and deprovisioning when roles, responsibilities or vendor contracts change, instead of waiting for the next periodic certification cycle. Stale context is where harmful access looks normal.
• Track and revalidate high-risk entitlements Maintain an explicit inventory of permissions that allow reversals, overrides, backdated changes or other high-impact actions. Review these rights separately from routine access because they carry disproportionate fraud exposure.
• Tie access to identity lifecycle events Connect joiner, mover and leaver events to permission removal so that role changes and exits automatically reduce exposure. This is especially important for legacy core platforms where manual cleanup often lags.

Key takeaways

• Internal fraud in core banking often depends on access that was once legitimate and then left in place, not on technical compromise.
• The article ties the risk to standing privilege, weak segregation of duties and fragmented visibility across legacy and modern systems.
• Banks reduce that exposure by making access current, limiting high-risk entitlements and tying deprovisioning to role change.

Key terms

• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
• High-Risk Entitlement: A high-risk entitlement is any permission that can materially change money movement, records, approvals, or audit evidence. These rights need separate review because they carry more fraud potential than routine access, especially in systems where a small action can have direct financial impact.
• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.