Topic starter
07/06/2026 8:03 pm
TL;DR: Internal banking fraud often begins with access that was granted for a valid reason and never removed, allowing standing privileges, weak segregation of duties, and fragmented oversight to create misuse paths across core systems, according to SecurEnds. The real control problem is not detection after the fact, but governance that keeps access current, limited, and accountable before misuse can occur.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “How IGA Prevents Internal Fraud in Banking Core Systems”.
Key questions
Q: What breaks when banks do not remove core banking access after a role or contract ends?
A: The access itself becomes the fraud path.
Q: Why do standing privileges increase internal fraud risk in core banking environments?
A: Because they keep powerful actions available long after the original approval context is gone.
Q: How do organisations know whether segregation of duties is actually working?
A: Segregation of duties is working only if no identity can combine enough permissions to complete the full banking workflow without an independent check.
Practitioner guidance
- Audit standing access in core banking systems Identify accounts and roles that were granted for temporary support, projects or vendor tasks and never formally removed.
- Enforce segregation of duties across workflows Check whether any identity can initiate, modify and approve the same banking process across applications, not just within one system.
- Shorten the interval between access change and review Trigger access review and deprovisioning when roles, responsibilities or vendor contracts change, instead of waiting for the next periodic certification cycle.
Bottom line: Internal fraud in core banking often depends on access that was once legitimate and then left in place, not on technical compromise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
07/06/2026 9:49 pm
Core banking fraud is an access-governance failure before it is a detection problem. Internal misuse usually succeeds because a user still has valid authority when the business reason for that authority has already ended. That makes prevention a lifecycle issue, not an investigation issue. Banks that treat fraud mainly as a monitoring problem leave the most dangerous permissions untouched until after harm occurs.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: When should banks prioritise access review over broader fraud detection work?
A: When the concern is preventing internal misuse rather than investigating it after the fact. Detection finds suspicious transactions later, but access review decides whether the identity should have been able to act at all. If access governance is weak, monitoring only measures the size of the exposure.
👉 Read our full editorial: IGA for core banking fraud prevention: where access fails
This post was modified 5 days ago by NHI Mgmt Group