Banks and credit unions in Arizona operate under a security baseline most businesses never face: the federal Bank Protection Act of 1968 (12 U.S.C. §§ 1881–1884 (12 U.S.C. § 1882)). It requires every federally regulated depository institution to run a formal security program — and meeting the letter of that law is only the floor. This guide explains what the Act actually requires, the real threat picture Arizona branches face today, how licensed physical-security officers and technology fit together, and how to move from merely “compliant” to genuinely protected.

What the Bank Protection Act requires

The Act is implemented through each federal regulator’s security-procedures rule — for example 12 C.F.R. Part 21 for national banks, Part 208 for Fed-member banks, Part 326 for FDIC-supervised banks, and Part 748 for NCUA credit unions. Across all of them, the core obligations are consistent. Every institution must:

Designate a security officer with authority to develop and administer a written security program, who reports on its effectiveness to the board of directors at least once a year.
Adopt a written security program that sets procedures for opening, closing, and the safekeeping of currency, negotiable securities, and other valuables, and that assigns responsibility for training employees.
Install and maintain security devices reasonable for the branch: an alarm or similar device, tamper-resistant locks on exterior doors and windows, lighting for the building and its surroundings during darkness, surveillance capability, and vaults or safes that meet the regulator’s specifications.
Train staff in their responsibilities during a robbery and in preserving evidence and identifying suspects afterward.
Review the program annually and document its effectiveness in a report to the board.

Notice what the regulation does not do. It sets minimums, not a ceiling. It tells a bank it must have cameras and an alarm; it does not tell it whether those cameras are actively monitored, whether footage is retained long enough to support a prosecution, whether the alarm ties to a rehearsed response, or whether a trained officer is present when the branch is most exposed. Those judgments are delegated to the security officer — which is exactly where a professional program earns its keep.

How the Act applies to community banks and credit unions

The obligations scale with the institution, not away from it. A two-branch community bank or a small credit union carries the same duty to designate a security officer, keep a written program, and file an annual board report as a regional bank does — often with a fraction of the staff to do it. That is precisely why many smaller Arizona institutions outsource the physical-security layer: assessment, officer staffing, and program documentation, delivered by a licensed provider rather than improvised by a branch manager who already wears five hats.

The Arizona threat picture

Arizona’s mix of dense metro branches, fast-growing suburban corridors, and long rural stretches produces a distinct risk profile:

Branch robberies and “note jobs.” The classic exposure, still concentrated at opening and closing and during teller-line lulls. Most are non-takeover demand-note robberies, but takeover-style incidents carry far higher injury risk.
ATM attacks. Ram-raids and cutting attacks on standalone units, plus card skimming and shimming that quietly turn a machine into a data-theft device for weeks before anyone notices.
Night-deposit and cash-in-transit exposure. Business customers making drops and armored-car pickups are targeted in parking lots and vestibules, not lobbies.
Tailgating and after-hours intrusion. Unauthorized entry through a door held open by an employee, or forced entry when the branch is dark and unstaffed.
Insider threat and social engineering. A meaningful share of losses is driven by employees, or by callers impersonating IT, executives, vendors, or examiners to move money or credentials.
Elder financial exploitation. Vulnerable customers pressured into large withdrawals at the counter — a branch-level responsibility that now sits squarely inside the security and compliance conversation.

Physical security officers for banks

A visible, trained officer is the most direct deterrent to the robbery and lobby-safety risks above. In Arizona, security guards are licensed and regulated by the Department of Public Safety under A.R.S. Title 32, Chapter 26. Armed officers must additionally hold the armed endorsement and satisfy firearms-qualification and training requirements. A bank program should decide deliberately between two tiers:

Unarmed officers — strong visible deterrence, access control, lobby and elder-customer safety, controlled opening and closing, and a calm authority figure for disputes.
Armed officers — appropriate for high-cash branches, cash-handling escorts, and locations with an elevated robbery history, where institutional policy and insurer requirements support it.

Whichever tier fits, the value lives in the procedures the officer enforces: controlled open/close routines, robbery-response protocols that put life safety first and compliance with demands over heroics, disciplined incident documentation that survives in court, and steady management of distressed or aggressive customers. An officer who merely “stands there” is a wasted post; an officer who runs a routine is a control.

The technology layer

Devices satisfy the Act; an integrated, maintained system protects the branch:

Surveillance with retention long enough to support law-enforcement and civil follow-up, and cameras positioned to capture faces and license plates — not just wide, useless lobby shots.
Access control on staff-only areas, vaults, and after-hours entry, with auditable logs that also deter insider misuse.
Monitored intrusion and hold-up alarms tied to a written, rehearsed response plan rather than a sticker on the door.
ATM hardening — anti-skimming, tamper alerts, and lighting, with a routine for physical inspection.

From compliant to protected: the branch risk assessment

The instrument that connects all of this is a per-branch risk assessment. It weighs each location’s robbery and crime history, cash levels, layout and sightlines, neighboring occupancy, hours, staffing, and existing devices, then prescribes the right officer tier, camera placement, and procedures for that branch. Run once and filed away, an assessment is a compliance artifact. Re-run when the threat picture, layout, or staffing changes, it becomes the engine of a program that actually deters the next loss. That cadence — assess, staff and equip to the assessment, train, test, reassess — is the difference between passing an exam and being protected.

Frequently asked questions

Does my bank or credit union legally need a security officer?

Yes. Under the Bank Protection Act, every federally regulated depository institution must designate a security officer and maintain a written security program that the board reviews at least annually. The requirement applies to small community banks and credit unions, not just large institutions.

Are banks required to have armed guards?

No. The Act does not mandate armed — or even any — guards; it mandates security devices and procedures. Whether to staff armed or unarmed officers is a risk-based decision for the security officer, shaped by the branch’s history, cash levels, insurer requirements, and Arizona’s licensing rules.

What security devices does the Act require?

At minimum: an alarm or comparable device, tamper-resistant locks, adequate exterior and interior lighting, surveillance capability, and vaults or safes meeting the regulator’s specifications — with the exact mix scaled to each branch’s risk.

How often should the security program be reviewed?

The security officer reports on the program’s effectiveness to the board at least annually. A serious program also re-runs a branch-level risk assessment whenever the threat picture, physical layout, hours, or staffing change materially.

Can a community bank outsource its security officer duties?

The institution retains legal responsibility, but the assessment, officer staffing, program documentation, and training can be delivered by a licensed provider — a common and cost-effective model for smaller Arizona banks and credit unions.

Robbery response: what real training covers

The Bank Protection Act requires employee training but leaves the substance to the institution. A serious program drills the fundamentals until they are reflex: comply with a robber’s demands and never resist for money’s sake; activate the hold-up alarm only when it is safe to do so; observe and mentally record height, build, clothing, speech, and direction of flight; protect the scene and preserve evidence after the subject leaves; and account for every employee and customer. Tellers rehearse bait-money and dye-pack procedures where used, and managers rehearse the first ten minutes — securing the branch, calling law enforcement, notifying the security officer, and beginning the incident record. Officers, where posted, anchor all of this with a calm, practiced presence rather than confrontation.

Coordinating with law enforcement and regulatory reporting

Physical security does not end at the branch door. A robbery, ATM attack, or significant fraud often triggers a Suspicious Activity Report (SAR) obligation under the Bank Secrecy Act, and clean surveillance footage, accurate witness descriptions, and a preserved scene are what make both the criminal case and the regulatory filing defensible. Building the relationship with local police and the FBI’s bank-robbery investigators before an incident — sharing branch layouts, camera coverage, and points of contact — turns a chaotic event into a coordinated response. A licensed security partner helps standardize this across every location so the weakest branch is not the one that determines the outcome.

Authoritative sources

Protect your branches with a licensed Arizona team

Honeybadger Solutions provides AZDPS-licensed armed and unarmed officers, branch risk assessments, and counter-surveillance for financial institutions across Arizona. We build to the Bank Protection Act baseline — and past it. Request a confidential branch security assessment, or explore our armed security services and guard services.