Topic starter
11/07/2026 1:55 pm
TL;DR: Regulators and industry bodies are pushing financial services toward broader MFA coverage, tighter exception governance, and phishing-resistant methods because passwords, OTPs, and weak legacy access paths remain easy to steal or break, according to Secret Double Octopus. The defensible position is no longer “we have MFA,” but whether coverage, method strength, and evidence align across workforce, third parties, and privileged access.
Editorial analysis by NHI Mgmt Group, based on content published by Secret Double Octopus: “The Financial-Services Authentication Reset: MFA, Phishing Resistance, and What Regulators Now Expect”.
Key questions
Q: Where does MFA coverage usually fail in financial-services environments?
A: It usually fails at the edges of the identity estate, not in the main workforce rollout.
Q: Why do regulators care about phishing-resistant MFA instead of just MFA?
A: Because MFA alone does not prevent all credential theft or replay.
Q: What are the signs that an MFA programme is not audit-ready?
A: Common signs include unclear exception ownership, no expiry on bypasses, missing system coverage data, and weak reporting on which methods are actually allowed.
Practitioner guidance
- Map every access path to MFA enforcement Include workforce, contractor, privileged, remote admin, API-adjacent, and legacy routes so uncovered entry points are visible as control gaps.
- Classify authentication methods by assurance level Separate phishing-resistant authenticators from OTP, password, and fallback flows, then define which systems require the stronger class.
- Make exceptions time-bound and owned Require each MFA exception to have an accountable owner, expiry date, and remediation plan before it is approved.
Bottom line: Financial-services authentication is no longer judged by MFA presence alone, but by how completely it covers regulated access paths and how strong the allowed methods are.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:06 pm
Coverage is now the first control question, not the last. Financial-services MFA programmes fail when they are measured by deployment counts instead of access-path completeness. Legacy systems, admin channels, and third-party routes are where assurance breaks first, and that is where governance must now focus.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What should teams do when some systems cannot support strong MFA yet?
A: Treat those systems as formal exceptions, not informal leftovers. Apply compensating controls only with documented risk acceptance, a named owner, and a remediation deadline. The key is to stop those gaps from becoming permanent because permanent exceptions become the programme's weakest assurance point.
👉 Read our full editorial: Financial-services MFA is now a coverage and assurance problem