Blog

A bank or credit union branch is a layered-security building, and the door hardware has to reflect that layering. The entry is an access-controlled mandatory vestibule, the teller line and back-office doors run high-security cylinders and electrified locks, the vault and cash-handling perimeter use delayed egress, and the after-hours ATM lobby runs on its own access-control schedule. The principle that ties all of it together is defense in depth with code-compliant egress. Every secured door must still let occupants out, so a well-specified branch is built with fail-secure electrified hardware and delayed egress rather than locked or chained exits. This guide walks each branch zone, explains the fail-mode logic, and shows where high-security keyways and delayed egress actually earn their cost.

The branch security model: nested zones

The most common specification mistake is treating a branch as one locked box. In practice a branch separates into nested zones, and each transition between zones is a separate, deliberately specified opening with its own hardware, fail mode, and access policy.

• Public zone (entry vestibule, lobby): controlled entry, free egress, and monitored. This is where the public meets the branch, so it has to feel open while still controlling flow.
• Transaction zone (teller line, platform): access-controlled doors that separate public space from staff space. These are staff-only transitions, not public doors.
• Secure zone (cash room, vault perimeter, back office): high-security cylinders, delayed egress, and audit-grade access control. This is the core the whole layered model protects.
• After-hours zone (ATM lobby): scheduled access control that runs independently of branch hours, so the ATM stays reachable when the rest of the branch is locked down.

Thinking in zones keeps the specification honest. It forces a decision about fail mode, key control, and access schedule at every door instead of defaulting to a single lock type across the building.

Hardware by zone

The table below maps each branch zone to its recommended hardware, the fail mode that keeps it both secure and code-compliant, and the reason that choice is correct for that opening.

Zone	Hardware	Fail mode	Why
Entry vestibule	Access control plus electrified locks, two interlocked doors	Fail-secure	Mandatory vestibule slows entry and controls flow
Teller-line door	Electrified lock or strike plus access control	Fail-secure	Staff-only transition
Cash room / vault perimeter	Delayed egress plus high-security cylinder	Fail-safe with timer	Slows an unauthorized exit with cash
Back office / records	High-security cylinder lockset	Fail-secure	Audit-grade key control
ATM lobby (after hours)	Scheduled access control, card or mobile	Fail-secure	24/7 access decoupled from branch hours
Required exits	Panic / exit hardware	Free egress	Life safety always wins

For the fail-mode logic across these doors, see fail-safe vs fail-secure: how to choose for every electrified device. For the electrified-versus-maglock decision at the vestibule, see electric strike vs maglock detailed comparison and how to choose a magnetic lock (maglock).

High-security cylinders and key control

Banks are the textbook case for restricted, patented keyways. Keys must not be copyable at a hardware store, and key issuance has to be auditable so that a lost or terminated employee key can be tracked and revoked. A branch that skips this step quietly accumulates uncontrolled key copies, which is exactly the failure auditors and insurers care about.

• High-security cylinders (Medeco, Mul-T-Lock, ASSA, Schlage Primus) with restricted blanks and a UL 437 listing on the most sensitive doors. These resist picking, drilling, and bumping, and the restricted blank is what actually stops unauthorized duplication. See Medeco vs Mul-T-Lock vs ASSA high-security cylinders.
• A documented master-key system so that issuance, revocation, and audit are controllable from a single plan. A lockset that accepts a high-security large-format interchangeable core (LFIC), such as the Schlage ND-series lever with a Medeco LFIC, pairs branch-grade lever hardware with audit-grade key control and lets you rekey a door in seconds by swapping the core. See master key systems for commercial buildings.
• The right keyway decision is covered in commercial cylinder keyways and keying compatibility. Restricted keyways are exactly right in a branch, where the supplier-lock-in trade-off is worth it for the control you get in return.

Browse high-security options in the cylinders, cores, and key blanks category.

Delayed egress on the cash and vault perimeter

Delayed egress (governed by ANSI/BHMA A156.24) holds a door for 15 seconds after someone pushes to exit, sounding an alarm during the delay, before it releases. It is the right tool on cash-handling and vault-perimeter doors because it slows an unauthorized exit with cash without ever trapping anyone. The door always releases on the timer, on a fire alarm signal, and on loss of power, so life safety is never compromised. Plan for these requirements:

• Required signage, the 15-second release, alarm annunciation, and automatic release on both fire alarm and power loss.
• Local authority having jurisdiction (AHJ) approval. Some jurisdictions restrict where delayed egress is permitted, so confirm before you specify it.
• A request-to-exit device so authorized staff can exit without triggering the alarm. See how to choose a request-to-exit device (REX) and how to choose an exit door alarm.

For the broader standards context behind A156.24, see the BHMA A156 series cheat sheet.

The entry vestibule and the after-hours ATM lobby

Two openings are specific to financial branches and deserve their own attention:

• Mandatory access vestibule. Two interlocked doors control the flow of people into the branch, often with electrified locks on both leaves and access control governing the inner door. Egress stays free on the inner door so no one is ever held in. The vestibule is as much about controlling the pace of entry as it is about keeping anyone out.
• After-hours ATM lobby. Card or mobile access on a schedule that is independent of branch hours keeps the ATM reachable 24/7 while the branch itself is secured. Use scheduled fail-secure electrified hardware with monitored door contacts so you can see when the lobby is accessed. Keypad or proximity entry suits the rotating access this space needs. See keypad vs proximity entry for doors.

ADA requirements apply throughout the branch. Operating force, lever shape, and approach clearances all have to comply even on the highest-security doors, so accessibility cannot be treated as an afterthought. See ADA compliance for commercial door hardware.

How to spec a branch, step by step

If you are starting a new branch or retrofitting an existing one, a repeatable order of operations keeps the specification clean:

1. Map the zones first. Walk the floor plan and label every door as public, transaction, secure, after-hours, or required exit before you pick any hardware.
2. Assign a fail mode to each door. Default to fail-secure for security doors and free egress for required exits, and reserve delayed egress for the cash and vault perimeter.
3. Build the key plan. Decide the restricted keyway and master-key structure up front so every cylinder you order fits one auditable system.
4. Confirm code and AHJ. Verify delayed-egress permission, fire-door latching, and ADA clearances with your local authority before ordering.
5. Specify access schedules. Set the ATM lobby and after-hours doors on their own schedules so branch hours and ATM availability are decoupled.

Common bank hardware mistakes

1. Standard cylinders on sensitive doors. Ordinary keys get copied at any hardware counter. Use restricted high-security keyways with documented key control.
2. Locking exits for security. A locked or chained exit is a life-safety violation. Use delayed egress, which slows an exit without ever trapping anyone, instead of a locked door.
3. A maglock on a fire-rated perimeter door. Fire doors must positively latch, and a maglock does not latch. Use a fail-secure electric strike or electrified lock instead.
4. Tying the ATM lobby to branch hours. Put the lobby on a separate access schedule so the ATM stays reachable after the branch closes.
5. Delayed egress without AHJ approval. Confirm local rules first, because some jurisdictions restrict where delayed egress is allowed.

Code framework and security ratings a branch should specify

Two code sets decide how far a branch can go in locking a door, and both protect free egress. NFPA 101, the Life Safety Code, and the International Building Code (IBC) both treat egress as non-negotiable, so any electrified or delayed-egress opening must release occupants on power loss, on a fire alarm, and within the timed delay the code allows. A branch that specifies delayed egress is leaning on the special locking-arrangement provisions in NFPA 101 and the IBC, not working around them, which is why local authority having jurisdiction (AHJ) approval is part of every compliant design.

Access-controlled openings also depend on a reliable request-to-exit (REX) signal. A REX device, a motion sensor or a switch in the exit hardware, tells the access-control system that someone is leaving on purpose so the door releases without logging a forced-entry alarm. Pairing REX with the door position switch is what lets a branch keep a clean audit trail on the teller line and back-office doors.

On security ratings, a branch should default to ANSI/BHMA Grade 1 hardware at every secured opening, because Grade 1 is the heaviest commercial cycle and strength tier and matches the traffic a busy branch sees. Where the threat includes attack at the teller line or a transaction window, UL 752 ballistic ratings come into play for the glazing and the surrounding frame, and the hardware behind that line is usually a heavy mortise lock rather than a cylindrical lock, since the mortise case carries the deadbolt, the anti-friction latch, and the high-security cylinder in one reinforced body.

FAQ

What cylinders do banks use?

High-security, restricted-keyway cylinders such as Medeco, Mul-T-Lock, ASSA, and Schlage Primus, frequently UL 437 listed, so keys cannot be copied without authorization and issuance stays auditable. They are paired with a documented master-key system.

Is delayed egress legal on bank doors?

In many jurisdictions, yes. Delayed egress is permitted under ANSI/BHMA A156.24 with the required signage, the 15-second release, and automatic release on alarm and power loss. Local AHJ rules vary, so confirm before specifying.

Can a bank lock its exit doors during business hours?

No. Required exits must allow free egress at all times. Slow an unauthorized exit with delayed egress and access control, never with a locked or chained door.

What hardware secures an after-hours ATM lobby?

Scheduled access control (card or mobile) on fail-secure electrified hardware, decoupled from branch hours, with monitored door contacts so the lobby stays reachable 24/7 while secured.

What is the difference between fail-safe and fail-secure in a branch?

Fail-safe hardware unlocks on power loss and suits delayed-egress and life-safety doors, while fail-secure hardware stays locked on power loss and suits security doors where egress is handled separately. Matching the fail mode to the door is the core of a compliant branch spec.

Next step

Spec by zone: an access-controlled vestibule, high-security restricted cylinders on the teller line and back office, delayed egress on the cash and vault perimeter, and independent after-hours access on the ATM lobby, with free egress preserved everywhere. Browse electric strikes, cylinders, cores, and key blanks, and keypad and proximity locks. Our commercial desk designs branch key-control systems and confirms delayed-egress compliance with your AHJ.