I guess Banks need to follow some kind of compliance (like PCI), and there are at least, some guidelines or tested solutions for them.