Financial Institutions Security

A branch security program is built around two narrow windows and one long one. The tight ones are the minutes before the doors open and after they lock, when staff arrive in the dark carrying keys and combinations and a single employee at a back door is the whole perimeter. An officer who arrives before staff and stays past close changes that sequence: the door is unlocked into a lobby that has already been cleared, not the other way around, and closing runs on a fixed order — vestibule cleared, ATM alcove checked, night-deposit slot inspected for tampering, staff walked to their cars. The long window is business hours, where the job is presence and observation rather than enforcement. Officers read the queue, the vestibule and the teller line, register the person who has been studying brochures for twenty minutes, and hold the sightline while an armored carrier works a transfer at the curb. The transport belongs to the carrier; the ground around it does not.

Federally insured banks and credit unions are both required to maintain a written, board-approved security program — for banks, under the Bank Protection Act and its implementing regulations, which also require a designated security officer and an annual report to the board on how the program performed. None of that requires a guard post; the mandated program is about devices and procedures. What it changes is what you should want from a vendor once you do have officers on site, because their paperwork becomes part of your evidence. Post orders should mirror the institution's own written program rather than a generic patrol template, so anyone reading both documents sees one policy rather than two. Daily activity and incident reports need to be timestamped, retained, and legible enough to survive an examiner, an insurer, and — after a robbery — a federal subpoena. Third-party risk expectations mean the vendor gets vetted too: PPO license in good standing, current BSIS guard cards for every assigned officer, exposed-firearm permits with documented requalification for armed posts, certificates of insurance naming the institution as additional insured, and background-check attestations. Ask for that packet before signing rather than when an examination window opens. Assembling it retroactively is where vendors come apart.

Two other assignments sit inside this sector. Operations centers and financial data centers are audit environments first: badge discipline, no-tailgating enforcement, escorted vendor access for HVAC and hardware technicians, and a visitor log that whatever the site is audited against — a SOC 2 report, a PCI assessment, internal audit — will sample line by line. The hard part is cultural: holding a door for a colleague reads as courtesy everywhere else, and an officer has to decline it politely, shift after shift, without becoming the reason staff start routing around the post. The second assignment is scale. A Los Angeles branch network is spread across the basin, so the deliverable is consistency: identical post orders, one reporting format, and supervision that is regional rather than nominal, with relief officers briefed on the site instead of arriving cold. Where a network is in scope, that consistency is what we commit to in writing — not headcount. Branches inside multi-tenant office towers add another layer, since a separate base-building vendor holds the lobby and the escalation path has to be agreed with building security in advance. Headquarters and investment or wealth-management offices are a third profile again — no cash on site, a small staff, clients arriving by appointment, and a front desk that is the only real access control — with executive protection added around annual meetings, layoffs and credible threats.