Online Banking Category and SSL Inspection Exemptions
The Online Banking category identifies the hosts where people log in to their bank. Its most important job is not blocking: it tells a firewall or gateway which encrypted sessions to leave undecrypted.
What the Online Banking category includes
The category is deliberately narrow. It covers account access, where people sign in, check balances and move money, and leaves broader finance content to Financial Services.
Internet banking logins
Dedicated login and account hosts of retail and business banks.
Credit unions and mutuals
Member account portals of credit unions, building societies and cooperative banks.
Online only banks
Digital banks whose whole site is account opening and account access.
Card account portals
Card issuer portals for statements, limits and payments.
Business and corporate banking
Treasury and cash management portals for companies, often with hardware tokens.
Statement and document portals
Secure hosts where banks deliver statements, tax documents and signed agreements to customers.
Small business banking
Account portals for sole traders and small firms, including invoice and payroll features run by the bank.
Bank authentication hosts
Hosts used for strong customer authentication and payment confirmation during checkout.
Exclusions and neighbouring categories
A bank usually runs several hosts. The marketing site, the blog and the careers portal are not banking sessions, so they are classified by their own purpose.
Online Banking
- Login, account and payment hosts of banks.
- Credit union and building society member portals.
- Card account and statement portals.
- Bank operated authentication and confirmation hosts.
Elsewhere
- Bank marketing sites, rate tables, loan guides: Financial Services. See finance category filtering.
- Crypto exchanges and wallets: Cryptocurrency.
- Personal finance blogs and news: News/Media or Blogs/Personal Sites.
- Bank lookalike pages: Malware / Phishing / Suspicious. See phishing category.
- Bank careers portals: Job Search/Careers.
Why online banking is exempted from SSL inspection
Many organisations decrypt and inspect TLS traffic to find malware and data leaks. Banking sessions are the standard exception, for four practical reasons.
Sensitive data
Balances, transactions and credentials would pass through the inspection system and its logs.
Privacy rules
Employee privacy laws and works agreements in many countries limit inspection of personal banking. Check with your legal team.
Broken sessions
Some banking apps and portals reject a substituted certificate and simply fail to connect.
Low threat value
Established bank hosts are rarely the source of malware, so inspecting them adds risk without much benefit.
The catch: a bypass is only as safe as the category behind it. If a lookalike phishing host were labelled as a bank, it would pass through the gateway unseen. That is why lookalikes are classified as security risks, and why precision here matters more than breadth.
Setting up category based SSL inspection exemptions
A sequence that works across most firewalls and secure web gateways. Exact menus differ by product.
Decide the exemption set
Most teams start with Online Banking and health related categories. Write down why each one is exempt, for audits later.
Put the exemption before decryption
The rule must match on the hostname in the TLS handshake, before the session is decrypted. Category lookups on that hostname make this possible.
Keep security categories inspected
Malware / Phishing / Suspicious and newly registered domains stay blocked or inspected. Never exempt them alongside banking.
Add known pinned apps
Some banking apps pin certificates. Add their hosts to the bypass if users report failures.
Log the bypass, not the content
Record that a session was exempted, without decrypted payload, so security teams still see volumes.
Review monthly
Banks add hosts and merge brands. All domains are refreshed monthly, and new hosts arrive in daily delta files.
What breaks when banking traffic is decrypted
Decrypting a session means the gateway presents its own certificate to the device. Several banking features are built to notice exactly that.
| Feature | What the user sees | Why | Fix |
|---|---|---|---|
| Certificate pinning in apps | App says "no connection" or "insecure network" | The app accepts only the bank's own certificate | Bypass the app's hosts |
| Client certificate login | Corporate banking login fails | Mutual TLS cannot pass through a decrypting proxy | Bypass the corporate banking hosts |
| Interception checks | Warnings or blocked transactions | Some banking software detects a man in the middle | Bypass by category |
| Unmanaged devices | Browser certificate errors | The device does not trust the inspection root certificate | Do not decrypt guest or personal devices |
| Long payment flows | Payment confirmation times out | Extra latency on several authentication hosts | Include authentication hosts in the bypass |
Limits of hostname based bypass rules
A category bypass depends on seeing the hostname before decryption. Newer protocols make that harder, so it helps to know where the method stops working.
Encrypted Client Hello
When the hostname in the handshake is encrypted, the gateway sees only an outer name. Many teams handle this at DNS or by policy on managed browsers.
QUIC and HTTP/3
Some gateways cannot inspect QUIC and push browsers back to TCP. Check how your product treats it before relying on category rules.
Direct IP connections
Apps that connect by IP give no hostname to match. Category data works on names, so these need IP based rules.
DNS as a backstop
Category lookups at the resolver still label the session. See DNS filtering vs web filtering.
Typical site types and hosts
One bank can produce traffic to five or more hosts in one session. This is where domain and host level data earns its keep.
| Host type | What happens there | Usual category | Inspection |
|---|---|---|---|
| Bank homepage | Products, rates, branch finder | Financial Services | Inspect or exempt |
| Login host | Sign in, accounts, payments | Online Banking | Exempt |
| Authentication host | One time codes, payment confirmation | Online Banking | Exempt |
| Static asset host | Images, scripts for the portal | CDN / Hosting / Infrastructure | Inspect |
| Analytics and chat widgets | Tracking, customer support chat | Advertising/Marketing or Web-based Applications | Inspect |
| Lookalike login | Credential theft | Malware / Phishing / Suspicious | Block |
Online banking policy by environment
Almost no one blocks this category. The decisions are about inspection, logging and shared devices, such as library and classroom computers where a user may forget to sign out.
| Environment | Access | Inspection | Notes |
|---|---|---|---|
| K-12 schools (CIPA) | Allow | Exempt | Not a CIPA category. Staff and older students may need it; shared devices should clear sessions. |
| Businesses | Allow | Exempt | The standard case for a category based bypass. See web filtering software for business. |
| Banks and financial firms | Allow | Policy dependent | Own bank hosts may be handled separately. See banking web filtering. |
| Healthcare and public sector | Allow | Exempt | Usually exempted together with health categories. |
| Guest Wi-Fi | Allow | None | Guest networks rarely decrypt traffic at all. |
| Parental control | Allow | Not applicable | Teen banking apps are common; blocking breaks them. |
Privacy and employee monitoring considerations
Inspection rules touch employee privacy law, which differs by country. The points below are general orientation, not legal advice; check the current rules with your legal team.
European Union
Data protection law requires monitoring to be necessary and proportionate. Decrypting personal banking is hard to justify, which is why exemptions are common.
Works councils
In some countries, such as Germany, employee representatives have a say in monitoring systems. Banking exemptions are a frequent part of those agreements.
United States
Employer monitoring is broadly allowed on company systems, but some states require notice to employees. Exempting banking reduces exposure either way.
Sector rules
Regulated industries may have their own logging and retention duties. Align the bypass list with them before rollout.
Coverage and delivery facts
What product and security teams usually ask before using the category in a bypass list.
Domains
Categorized domains, with several ranked categories per domain where needed.
Of traffic
Covered by the 20 million most visited domains, including major banks.
Delta files
New and changed domains every day; all others refreshed monthly.
Your systems
CSV, Parquet or JSON on premise or air gapped, plus an included lookup API.
Multi-category cases
Domains can carry several ranked categories. For banking, the split between hosts often matters more than the ranking on one host.
Bank with one domain for everything
Online Banking, Financial ServicesMarketing and login on one host. Both labels, so a bypass on Online Banking covers it.
Bank with split hosts
Financial Services / Online BankingMarketing host and login host classified separately, the cleanest case for inspection rules.
Payment wallet
Financial Services, Online BankingAccount balance and transfers make banking a strong secondary label.
Crypto app with bank account
Cryptocurrency, Financial ServicesCrypto policy usually decides; not exempted as banking by default.
Brokerage portal
Financial Services, Online BankingTrading first; some teams add it to the bypass for privacy reasons.
Bank lookalike
Malware / Phishing / SuspiciousNever shares a label with the real bank, so it is never exempted.
Bank phishing and why precision matters
Banks are among the most imitated brands online. Lookalike hosts appear daily, often hours before the first message is sent.
Signals of a genuine bank host
- Long registration history under the bank's brand.
- Part of the bank's known host family.
- Linked from the bank's own homepage and app.
- Consistent content and login flow over time.
Signals of a lookalike
- Registered days ago, often with "secure" or "verify" in the name.
- Hosted on cheap or free infrastructure.
- Reached only through messages and short links.
- Login form posting to an unrelated host.
About 300,000 newly registered domains are categorized every day and checked again after a week and after a month. Combine the category with a phishing and malware domain feed to keep lookalikes out of any bypass.
Inspection bypass audit checklist
Auditors and security reviewers often ask how exemptions are controlled. These points answer most of their questions.
Documented
- Which categories are exempt, and why.
- Who approved the list and when it was last reviewed.
- Which legal or privacy rule each exemption supports.
- Where bypassed sessions are logged.
Enforced
- Security categories evaluated before any bypass.
- Newly registered domains never exempt.
- Category data updated daily and refreshed monthly.
- Manual host exceptions kept short and reviewed.
How vendors use the Online Banking category
Firewall, gateway and endpoint vendors license the category as part of the full database and use it in several places.
Default bypass lists
Shipped TLS inspection profiles that exempt banking out of the box.
Exports for other tools
External dynamic lists and PAC files for licensed customers. See blocklist formats.
Privacy controls
Endpoint agents skip screenshot or content capture on banking hosts.
Fraud context
Fraud teams see when a session moved from a message link to a banking host.
On premise lookups
Files run inside the vendor's own systems, so no hostname leaves the network.
Online Banking category FAQ
What is the Online Banking web filtering category?
It covers the hosts people use to manage bank accounts online: internet banking logins, account portals of banks, credit unions and building societies, online only banks and card portals. General finance content is in Financial Services.
Why exempt online banking from SSL inspection?
Decrypting personal banking exposes sensitive data to the inspection system, can conflict with privacy rules and employee agreements, and can break apps and logins that expect the bank's own certificate.
Is it safe to bypass inspection for a whole category?
Only if the category is precise. Lookalike phishing hosts must never be in the exempted set, which is why bank lookalikes are classified as Malware / Phishing / Suspicious.
Should schools block online banking?
No. It is not a CIPA category and there is rarely a reason to block it. Blocking pushes people to less safe workarounds.
What is the difference between Online Banking and Financial Services?
Financial Services covers information, investment, insurance, loans and financial news. Online Banking is narrower: the account access hosts where people log in and move money.
Does exempting banking weaken malware protection?
Very little, if the exemption is precise. Established bank login hosts are rarely a malware source, and DNS filtering plus endpoint protection still apply to the session.
Should our own bank hosts be exempt on our corporate network?
Financial firms often treat their own hosts separately, under internal monitoring rules. That is a policy decision for your security and compliance teams.
Are payment checkout pages in Online Banking?
Merchant checkout pages are classified with the merchant. Bank authentication hosts that confirm a payment during checkout are Online Banking, so including them in a bypass keeps payments working.
Do credit union sites count as banks?
Yes. Member account portals of credit unions, building societies and cooperative banks are part of the category, because they serve the same account access purpose.
How do new bank hosts get added?
Banks launch new hosts for apps, brands and mergers. Newly registered domains are categorized daily and checked again after a week and after a month, and all domains are refreshed monthly.
Can the category be exported as a bypass list?
Yes. Licensed customers can export categories as firewall external dynamic lists, hosts files, DNS RPZ and PAC files, alongside CSV, Parquet and JSON. Check a host first with the domain category lookup.
License the web filtering database
Online Banking, Financial Services and 57 other categories plus the IAB Content Taxonomy, for inspection bypass lists, filters and gateways. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Talk to us