12 CFR § 21.3 - Security program.

---
identifier: "/us/cfr/t12/s21.3"
source: "ecfr"
legal_status: "authoritative_unofficial"
title: "12 CFR § 21.3 - Security program."
title_number: 12
title_name: "Banks and Banking"
section_number: "21.3"
section_name: "Security program."
chapter_name: "COMPTROLLER OF THE CURRENCY, DEPARTMENT OF THE TREASURY"
part_number: "21"
part_name: "MINIMUM SECURITY DEVICES AND PROCEDURES, REPORTS OF SUSPICIOUS ACTIVITIES, AND BANK SECRECY ACT COMPLIANCE PROGRAM"
positive_law: false
currency: "2026-04-05"
last_updated: "2026-04-05"
format_version: "1.1.0"
generator: "[email protected]"
authority: "12 U.S.C. 1, 93a, 161, 1462a, 1463, 1464, 1818, 1881-1884, and 3401-3422; 31 U.S.C. 5318."
cfr_part: "21"
---


# 21.3 Security program.

(a) *Contents of security program.* The security program shall:

(1) Establish procedures for opening and closing for business and for the safekeeping of all currency, negotiable securities, and similar valuables at all times;

(2) Establish procedures that will assist in identifying persons committing crimes against the institution and that will preserve evidence that may aid in their identification or conviction; such procedures may include, but are not limited to:

(i) Using identification devices, such as prerecorded serial-numbered bills, or chemical and electronic devices;

(ii) Maintaining a camera that records activity in the banking office; and

(iii) Retaining a record of any robbery, burglary or larceny committed or attempted against a banking office;

(3) Provide for initial and periodic training of employees in their responsibilities under the security program and in proper employee conduct during and after a robbery; and

(4) Provide for selecting, testing, operating and maintaining appropriate security devices, as specified in paragraph (b) of this section.

(b) *Security devices.* Each national bank shall have, at a minimum, the following security devices:

(1) A means of protecting cash or other liquid assets, such as a vault, safe, or other secure space;

(2) A lighting system for illuminating, during the hours of darkness, the area around the vault, if the vault is visible from outside the banking office;

(3) Tamper-resistant locks on exterior doors and exterior windows designed to be opened;

(4) An alarm system or other appropriate device for promptly notifying the nearest responsible law enforcement officers of an attempted or perpetrated robbery, burglary or larceny; and

(5) Such other devices as the security officer determines to be appropriate, taking into consideration:

(i) The incidence of crimes against financial institutions in the area;

(ii) The amount of currency or other valuables exposed to robbery, burglary, or larceny;

(iii) The distance of the banking office from the nearest responsible law enforcement officers and the time required for such law enforcement officers ordinarily to arrive at the banking office;

(iv) The cost of the security devices;

(v) Other security measures in effect at the banking office; and

(vi) The physical characteristics of the banking office structure and its surroundings.