Most Financial Institutions Have DMARC. Almost None Are Protected.

**Executive summary:** The report analyzes DMARC adoption in financial institutions worldwide, finding high rates of recorded DMARC usage but substantially lower enforcement (p=reject) across many countries; it highlights regulatory pressures (PCI DSS, FTC Safeguards, mailbox provider requirements), operational reasons for slow enforcement, the oversight gap for smaller financial businesses, and recommends inventorying senders and moving domains (including parked and defensive registrations) to p=reject to reduce spoofing and phishing risk.