What is Change of Authorization (CoA)

Change of Authorization (CoA), standardized in RFC 5176, is a RADIUS protocol extension that enables administrators to dynamically modify the access privileges, network permissions, or security policies of an active user or device session in real-time—without disconnecting the session or requiring re-authentication. Unlike traditional RADIUS authentication, where network devices initiate requests to servers, CoA reverses this flow: the RADIUS server sends unsolicited CoA-Request packets to network switches, access points, or controllers to immediately change VLAN assignments, apply restrictive ACLs, enforce bandwidth limits, trigger reauthentication, or terminate sessions based on security events, compliance violations, or policy updates.

In BFSI environments, CoA enables immediate response to security events, compliance violations, or policy changes by adjusting what authenticated devices and users can access while they remain connected to branch networks, ATMs, or digital banking infrastructure.​

How does Change of Authorization (CoA) work

CoA operates as an extension of the RADIUS authentication protocol, reversing the traditional communication flow. Normally, network devices like switches and access points send authentication requests to a RADIUS server; with CoA, the RADIUS server or policy engine (such as Cisco ISE or similar NAC platforms) can send unsolicited commands back to network devices to change session attributes for already-connected endpoints.​

When a CoA event is triggered—such as a device failing a security posture check, a policy update from the security team, or detection of anomalous behavior—the RADIUS server sends a CoA-Request packet to the network access device managing that session. This request includes instructions such as applying a different VLAN assignment, pushing downloadable access control lists (dACLs) to restrict traffic, forcing session reauthentication, quarantining the device, or completely terminating the connection. The network device processes the CoA request and responds with either a CoA-ACK (acknowledgment) if successful or CoA-NAK (non-acknowledgment) if the change cannot be applied.​

For BFSI institutions, this happens seamlessly: a teller workstation that loses antivirus protection can be immediately moved to a quarantine VLAN with restricted access to only remediation servers, or an ATM exhibiting suspicious communication patterns can have its core banking access revoked—all without service interruption for legitimate transactions continuing elsewhere on the network.

Explore our Banking Network Solutions

Why CoA matters for BFSI security

Real-Time Threat Response

Banks and financial institutions operate 24/7 digital channels, branch networks, and payment infrastructure where unplanned downtime directly impacts customer transactions, regulatory SLAs, and brand trust. CoA provides the agility to enforce security and compliance policies in real time without the service disruption that would result from forcing mass logoffs or waiting for devices to reconnect.​

From a cybersecurity perspective, CoA is critical for containing threats rapidly: if endpoint detection systems flag a compromised branch PC or if fraud analytics identify suspicious ATM behavior, CoA allows security teams to isolate or restrict the device immediately, limiting lateral movement and data exfiltration before manual intervention. This aligns with RBI's emphasis on proactive cyber defense and timely incident response capabilities. 

Compliance Automation

Similarly, when devices fall out of compliance—missing security patches, disabled firewalls, or expired certificates—CoA can automatically quarantine them until remediation is complete, maintaining the integrity of PCI DSS cardholder data environments and regulatory audit trails.​

Common BFSI use cases for CoA

• Automated compliance enforcement: When Network Access Control systems detect that a bank branch employee's laptop has disabled antivirus software, failed to install critical security patches, or exhibits non-compliant configurations, CoA immediately moves the device to a restricted quarantine VLAN. The endpoint retains network connectivity but access is limited exclusively to remediation servers where users can download patches, update antivirus definitions, or resolve configuration issues. Once compliance is restored, automated posture reassessment triggers another CoA to return the device to production VLANs with full access to core banking applications—all without IT intervention or user logoff.
• Dynamic ATM and kiosk isolation: ATMs and payment kiosks communicate with core banking systems via dedicated network segments. If network monitoring detects unusual traffic patterns from an ATM—such as connections to unauthorized external IP addresses, anomalous data transfer volumes, or behavioral indicators consistent with ATM malware like Ploutus or GreenDispenser—CoA immediately applies stricter access controls isolating the ATM while allowing other branch ATMs and operations to continue normally. Security teams investigate the flagged ATM for compromise without impacting customer service across the broader branch network.
• Time-based and guest user access management: Guest Wi-Fi in bank lobbies and contractor access require time-limited connectivity. When captive portal systems authenticate guest users or sponsored access workflows approve vendor connectivity, RADIUS servers assign session timeout attributes. Upon expiration, CoA automatically downgrades access privileges, moves users to restricted VLANs, or forces reauthentication with credential validation. This ensures temporary access cannot be exploited for extended periods and contractors cannot maintain connectivity beyond approved maintenance windows—critical for PCI DSS audit trails and regulatory compliance.
• Incident response and threat containment: Modern Security Operations Centers (SOCs) rely on automated response workflows to contain threats at machine speed. When User and Entity Behavior Analytics (UEBA) platforms detect anomalous privilege escalation attempts, unusual database queries, or suspicious file encryption activity indicative of ransomware, security orchestration platforms (SOAR) automatically invoke CoA through RADIUS APIs to quarantine affected endpoints, revoke VPN access, or force multi-factor reauthentication—all before human analysts complete incident triage, reducing average containment time from hours to seconds
• Policy rollout and group updates When banks update security policies for entire user groups—such as implementing new VLAN segmentation for payment processing staff, applying updated firewall rules for branch managers, or enforcing data loss prevention policies for call center employees—traditional approaches require coordinated logoff campaigns or scheduled maintenance windows. CoA enables centralized policy servers (Cisco ISE, ClearPass, FortiAuthenticator) to push changes to all active sessions instantly across hundreds of branches and thousands of endpoints. Policy enforcement becomes immediate and consistent, eliminating gaps where outdated policies remain active during transition periods.​

Simple analogy- Understanding CoA

Imagine a bank branch where employees are issued access badges in the morning. Traditionally, if you needed to change someone's access level—say, revoking their ability to enter the vault—you'd have to wait until they leave for the day and issue a new badge tomorrow. CoA is like having smart badges that can be remotely reprogrammed in real time: the moment a security concern arises or a role changes, the badge instantly reflects new permissions without the employee needing to return it or leave the building.​

Key takeaway

Change of Authorization empowers BFSI institutions to enforce security and compliance policies dynamically during active network sessions, enabling immediate containment of threats, automated remediation of non-compliant devices, and agile policy updates—all without disrupting legitimate banking operations or forcing service downtime.

Explore our Banking Network Solutions