n 2025, the Italian cybersecurity market reached €2.78 billion, growing by 12% compared to the previous year. In the banking sector, this acceleration is taking place within an even more demanding context: since January 17, 2025, the Digital Operational Resilience Act (DORA) has become applicable to European financial institutions, while the EBA Guidelines on ICT and Security Risk Management further reinforce the need for a consistent approach to technology risk governance.
To address such a landscape, Identity Access Management (IAM) must integrate with applications, infrastructures, hybrid environments, privileged identities and audit processes.
The interaction with physical access control systems becomes particularly relevant in administrative facilities and critical environments such as data centers, server rooms, control rooms, technical facilities, vaults, or areas operated by ICT suppliers. In this article, we examine how to design an IAM model capable of connecting digital identities, authorizations, physical access credentials, monitoring and governance within the banking sector.
Takeaways
-
IAM in banking does not only govern user authentication; it also manages identities, privileges, policies, authorizations and the entire access lifecycle across hybrid environments.
-
Integration between IAM and ACS is particularly relevant in administrative facilities and critical environments, where physical control protects infrastructures, data, sensitive processes and operational responsibilities.
-
RBAC and ABAC enable a more consistent assignment of permissions and physical access credentials: the former based on roles, the latter based on attributes and operational context.
-
A mature IAM model should connect digital identity, access entitlement, policy, approval, duration, usage, review and revocation.
-
Correlating IAM, PAM, ACS, SIEM/SOC and application events strengthens monitoring, auditing and authorization verification activities.
Identity Access Management (IAM) is the set of processes and technologies that enables organizations to govern digital identities, attributes, authentication, authorizations and the entire access lifecycle. In banking, however, its scope extends far beyond application login: it governs identities, attributes, authorizations, privileges and access lifecycle management across an ecosystem composed of core banking applications, legacy systems, cloud environments, SaaS platforms, critical infrastructures and third parties.
When physical security protects administrative facilities or highly critical environments, access credentials—whether badges, temporary credentials or authorization to pass through a secure entry point—must also be incorporated into the same governance model.
Security, accountability and compliance all depend on this capability.
IAM Challenges in Banking: Fragmentation, Privileges and Hybrid Environments
In banking, the complexity of Identity Access Management stems from layered infrastructures and the variety of access domains that must be governed. Core applications, legacy platforms, cloud services, SaaS solutions, APIs, test environments, administrative tools, payment systems, outsourcing providers, ICT vendors and physical infrastructures may all rely on different authorization models. When these domains are not aligned under a common framework, bank access control becomes difficult to implement and monitor.
The first challenge concerns identity fragmentation. Many financial institutions still manage user records, roles and privileges across multiple systems: corporate directories, business applications, legacy databases, HR systems, cloud platforms and third-party tools. Without an authoritative source and a reliable synchronization process, the same user may have inconsistent profiles across different environments. The issue goes beyond operational efficiency. Misaligned identities can lead to excessive privileges, access rights that were never revoked, or authorizations that no longer match the user’s actual role. A typical example is a role change. If an organizational transition does not automatically trigger a privilege review, users may retain access rights that are no longer appropriate for their new responsibilities.
The second challenge is privilege creep, namely the gradual accumulation of unnecessary permissions. Over time, temporary projects, role changes and organizational restructuring can result in layers of access rights that should have been reduced or revoked, increasing operational exposure and making it more difficult to demonstrate compliance with the principle of least privilege.
The third challenge concerns privileged access management. System administrators, database administrators, infrastructure operators, security teams, outsourcing providers and application vendors often work within critical environments. Without integration between IAM and PAM (Privileged Access Management), elevated privileges may remain permanent, shared among multiple users, poorly tracked or disconnected from a clearly defined owner.
In banking environments where critical functions increasingly depend on systems and services managed by third parties, this lack of visibility can become a significant security, compliance and accountability issue.
What Technologies Should Identity Access Management Integrate With in Banking?
An operational guide to IAM integration should start with mapping all the domains involved in access control. HR systems and corporate employee records represent the primary source for identity, role, location, employment status and organizational affiliation. Directories and Identity Providers manage authentication, attributes, groups and Single Sign-On (SSO). IGA and PAM platforms respectively govern access requests, approvals, recertifications, access reviews, privileged accounts and administrative sessions.
Alongside these systems are application and infrastructure domains, including core banking platforms, legacy systems, cloud services, SaaS applications, APIs, workload automation solutions and security tools. In modern environments, integration can be achieved through federation, APIs or automated provisioning. Legacy systems, on the other hand, may require dedicated connectors, controlled synchronization mechanisms, file exchanges or reconciliation procedures. The fundamental objective is to maintain consistency across identities, attributes, policies, authorizations and monitoring activities.
Physical access control becomes part of this model only when it directly impacts security, compliance or operational continuity. Examples include administrative facilities, data centers, server rooms, control rooms, technical facilities, vaults, compliance areas and spaces managed by ICT service providers. In these contexts, the Access Control System (ACS) can receive identities, roles, attributes, user status, expiration dates and policies from the IAM platform. In return, it can provide physical access events that support auditing, SIEM/SOC activities and security workflows.
Consider the example of an ICT supplier authorized to perform maintenance activities in a server room. The HR system or vendor management platform records the external identity; the IAM system links it to an internal sponsor and an expiration date; the IGA platform manages the approval process; the ACS enables physical access only during the authorized time window; and the SIEM or control room receives the resulting events for monitoring and auditing purposes. Without this chain of integration, badges, application accounts, VPN access and operational authorizations would be managed separately.
In a banking environment, IAM therefore acts as a consistency layer connecting identities, attributes and policies, while individual systems enforce access controls within their own domains. The quality of integration is measured by the ability to trace the entire path from identity to authorization, enforcement and monitoring.
In the banking sector, IAM serves as the layer that ensures consistency between identities, attributes and policies, while individual technologies enforce controls within their specific domains. The effectiveness of integration is ultimately measured by how transparently organizations can trace the relationship between identity, authorization, enforcement and monitoring.
Best Practices for Integrating IAM and Access Control in Banking
Best practices for IAM integration in banking should begin with identifying the specific areas where interaction with Access Control Systems (ACS) creates tangible value. The convergence of digital identity and physical access control should not be applied indiscriminately across all banking locations; rather, it is most relevant in administrative facilities and critical environments. In these contexts, IAM provides the ACS with the information required to grant, modify or revoke access rights, while the ACS returns events that support monitoring, security, auditing and operational workflows.
The following best practices are particularly relevant:
1. Define the Scope and Integrate IAM and ACS into Access Entitlement Management
The first step is determining where integration between IAM and the Access Control System is genuinely necessary. In banking, extending this approach uniformly across all offices and branches is rarely justified. Its value emerges primarily where physical access protects infrastructure, sensitive data, critical processes or operational responsibilities.
Defining the scope means identifying which areas require physical access control linked to digital identity, which roles are allowed access, which attributes must be evaluated, which permissions should have expiration dates and which events should be included in monitoring and audit processes.
Once the scope has been defined, IAM and ACS integration should be based on bidirectional communication. IAM provides the ACS with identities, roles, attributes, user status, expiration dates and policies; the ACS enforces these rules at physical entry points and returns events that support auditing, monitoring and security activities.
The most traditional approach is Role-Based Access Control (RBAC). Under this model, access is determined by the role a user holds within the organization, and permissions and access credentials are assigned accordingly. This approach is particularly effective for recurring and standardized access requirements, such as differentiating between IT staff, compliance teams, security personnel, maintenance staff and authorized vendors.
In highly critical environments, however, a role alone may not be sufficient. Two users performing the same function may require different access rights depending on their location, shift, destination area, assignment duration, confidentiality level of the resource or emergency conditions.
In these cases, Attribute-Based Access Control (ABAC) becomes relevant. Access decisions are evaluated in real time based on user attributes, resource attributes and contextual information such as department, employment status, location, time of access, risk level or authorized time window.
For banks, this means that every access entitlement can be linked to a verifiable chain consisting of identity, attribute, policy, approval, duration, usage, review and revocation. The value of IAM-ACS integration lies in making physical access consistent with the organization’s identity governance model, traceable over time and easier to revoke when circumstances change.
2. Establish an Authoritative Identity Source
For employees, this role is typically fulfilled by HR systems. For suppliers, contractors and consultants, organizations may need to integrate vendor management or contractor management systems.For service accounts and technical identities, dedicated registries, clearly assigned owners and links to the assets or applications they support are required.
Without these distinctions, IAM platforms may propagate incomplete or inconsistent information across applications, infrastructures and physical security systems.
3. Standardize Identity Attributes
Role, organizational unit, location, employment type, risk level, owner, start date, end date and identity status should remain consistent across IAM platforms, directories, applications, physical security systems and audit platforms. Attributes are the foundation of access policies. If they are outdated or poorly governed, even advanced access control models can produce incorrect authorization decisions.
4. Design a Robust Joiner-Mover-Leaver Process
Hiring, role changes, transfers, suspensions, supplier changes and terminations should automatically trigger provisioning, modification, recertification or revocation workflows. This principle applies to application access, privileged accounts and, where relevant, physical access to data centers, server rooms, control rooms, technical facilities and compliance areas.
Timely revocation remains one of the most important security controls. An active digital account, a privileged credential that has not been disabled or a physical badge that has not been revoked can all become operational vulnerabilities.
5. Integrate IGA, PAM and ITSM Processes
Identity Governance and Administration (IGA) platforms govern access requests, approvals, segregation of duties and access review campaigns. Privileged Access Management (PAM) solutions control privileged accounts, administrative sessions, temporary privilege escalation, break-glass access, technical credentials and secret rotation.
In more mature banking environments, these controls should also integrate with IT Service Management (ITSM) processes, linking access rights to tickets, changes, incidents, operational approvals and audit trails.
6. Apply MFA and Adaptive Authentication to High-Risk Access
VPN connections, cloud consoles, critical applications, administrative sessions and sensitive operations require security controls that adapt to the context, device, network, geography and user behavior.
The same principle can extend to highly sensitive physical access scenarios. In mobile credential deployments, for example, issuing an access credential to a smartphone may require identity verification through SSO or a corporate Identity Provider, with access rights granted according to role, policy and authorization duration.
7. Centralize Monitoring and Evidence Collection
IAM events should feed SIEM and SOC platforms alongside logs generated by PAM systems, cloud services, applications, VPNs, APIs and, where relevant, physical security platforms.
This correlation enables organizations to detect anomalies that would otherwise remain invisible. An after-hours privileged access session, an abnormal VPN connection, an unusual API call or physical access to a technical area may each carry a different significance when analyzed together.
Finally, integration should produce auditable evidence. Every authorization should be traceable throughout its entire lifecycle: request, approval, assignment, usage, review and revocation.
This capability is particularly important in light of evolving European regulations. DORA requires financial institutions to adopt a structured approach to ICT risk management, while the EBA Guidelines on ICT and Security Risk Management emphasize documented controls, clearly assigned responsibilities and safeguards that remain verifiable over time.
Conclusion
To successfully integrate IAM into banking environments, organizations must move beyond siloed access management practices and adopt a model in which identities, privileges, applications, infrastructures, physical systems and audit processes are governed consistently. The key challenge is the ability to connect every access entitlement to a specific role, responsibility, policy, validity period and verifiable evidence trail.
In an increasingly hybrid, regulated and interconnected financial ecosystem, Identity Access Management becomes a fundamental enabler of both security and operational governance. Its effectiveness depends on the quality of its integrations with HR systems, directories, IGA platforms, PAM solutions, cloud services, APIs, SIEM/SOC platforms, legacy systems and physical access control technologies.
Only through this level of integration can bank access control become a truly traceable process that aligns with the sector’s resilience, governance and compliance requirements.
