The supervisory guidelines (major banks III-3-8-2(2) and the parallel guidelines for regional banks, crypto-asset exchanges, electronic payment instrument businesses and cooperative financial institutions), as amended with immediate effect on 27 February 2026, ask banks to take security measures matched to transaction risk referring to these Guidelines, and specifically: not to put URLs of password entry pages or login links in emails or SMS (except where unavoidable to meet legal duties), to encourage customers to log in from bookmarks or the official app, to introduce sender domain authentication in a planned way and to promote takedown of phishing sites; and, according to the business, to implement and make mandatory by default phishing-resistant multi-factor authentication (for example passkeys or PKI-based authentication) for important operations such as login and withdrawals (offering alternative MFA with monitoring of opt-out rates where customers lack devices, and, until implementation, announcing the schedule and strengthening behaviour detection and login notifications), notify customers of logins and transactions by email or similar, lock accounts automatically after repeated authentication failures, detect unauthorised access by login behaviour analysis and keep login and transaction records for later verification, require additional authentication or block suspicious access, and have a structure to contact users promptly on detecting unauthorised logins or abnormal transactions; authentication methods are reviewed periodically and when the environment or incidents change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.