How Bank Vaults Work: Walls, Doors, Ratings and History

A bank vault is a room, not a box: walls of steel-reinforced concrete, a rated door with combination locks and a time lock, and an alarm wired to the police. Here’s how one is built and run today, how it got that way, and whether banks still bother.

Bank vaults at a glance

The word gives the game away. A vault was first an arched roof, and then the space under one, especially an underground room or cellar; only later did it become “the secure room or rooms in or below a bank used to store currency and other valuables”.¹ The important part is the room. With a safe, you put your valuables in a steel box. With a vault, you walk in, and the walls around you are the box. How that differs in practice is covered in our guide to vaults and safes compared.

Anatomy of a bank vault

Strip a vault down and you get five parts: the walls, the door, the locks, the day gate and the alarm. None of them works alone. A 1924 vault-engineering handbook warned that thousands of bank vaults had heavy, strong doors in walls with only “a small fraction” of their strength, and argued for “balanced protection” all round.²

The walls: reinforced concrete, poured or in panels

By the 1920s, vault engineers agreed that reinforced concrete was “the ideal material” for vault walls, with one condition: the steel mattered more than the concrete. The Rivet-Grip handbook wanted a basket weave of heavy bars near the outer face to stop the first drill, more rows through the full thickness to stop the next, and ties fixed to the bars so that a cut bar couldn’t simply be pulled out. Tests, it said, had shown that unreinforced or ordinary reinforced concrete “offers but little resistance to attack”.² Its own specification called for one part Portland cement, two parts sand and three and a half parts gravel or crushed stone, mixed to flow round the steel.²

That kind of vault was a building job. A Diebold and Mosler patent filed in 2000 describes the older poured vaults as concrete walls about 18 to 36 inches thick, with forms to build, steel to place and concrete to pour and cure, which made a new vault in an existing building almost impossible. The big change “over the past 25 years”, the same patent says, was the prefabricated concrete panel: made off site by the vault maker, shipped to the bank and assembled into floor, walls and ceiling. Panels meeting UL Class 1 were then generally at least six inches thick.³

The panels themselves are a materials story. Vault Structures of Fort Myers, Florida, described its high-performance concrete panels as three to four times the compressive strength of ordinary construction concrete, and its ultra-high-performance Hercvlite panels as two and a half to three times stronger again. Each panel sits in a galvanised metal pan, so the panels can be welded together on site into walls, ceiling and floor, and the welds are painted over to meet UL’s installation rules. For practical reasons panels were kept to 13 feet long, with an I-beam for wider spans.⁴

A modern specification reads much the same. New York State’s master specification for vaults lists interlocking panels with built-in openings for sprinklers and cables, wall panels bolted or welded to each other and welded to the ceiling, and a vault that can be six-sided or five-sided, standing on the building’s own concrete slab.⁵ From the outside, once the contractor has added drywall and paint, you might not know it was there.⁴

The door, the locks and the time lock

The door is the part everyone pictures, and we’ve given it a page of its own: our history of bank vault doors covers bolt work, crane hinges, round versus rectangular doors and who made them. The short version for a vault buyer today comes from the New York specification. The door is rated under UL 608 to match the walls, with a full-height stainless steel locking bar, two or three combination locks per door (the mechanical option is a UL 768 Group 1 four-wheel lock with at least a million possible combinations) and a UL 887 time lock with three movements, set to run for up to 144 or 199 hours.⁵

The time lock is what makes a vault a vault rather than a very large safe. Once it’s set, nobody can open the door before the set hour, however many combinations they know. It was the banks’ answer to robbers who kidnapped cashiers in the 1870s, and its story is told in our history of time locks.

The day gate

During opening hours the big door usually stands open, and the thing between you and the money is a grille. The specification describes the day gate as running the full width of the opening, “designed to restrict entry through vault door”, on piano or self-closing gravity hinges. A separate day guard lock holds the main door’s locking bar open so that nobody can be shut in by accident.⁵ You can see the idea in the 1908 Cleveland door at the top of this page, with its barred gate just inside the circle.⁶

Alarms and the rules behind them

In the United States the alarm isn’t optional. Under the Bank Protection Act of 1968, the FDIC requires each bank it supervises to have “a means of protecting cash or other liquid assets, such as a vault, safe, or other secure space”, an alarm system or other device “for promptly notifying the nearest responsible law enforcement officers”, and procedures for opening, closing and the safekeeping of all currency. If the vault can be seen from outside the building, the area around it has to be lit after dark.⁷ There’s something reassuringly old-fashioned about that last rule: a lit vault behind the glass is its own burglar alarm.

The vault itself can carry its own sensors. Among the factory options in the New York specification are a door contact alarm, a heat detector and a telephone jack in the door.⁵ Beyond that, banks and alarm firms don’t publish their layouts, and we haven’t tried to guess them.

How vaults are rated: UL 608 and EN 1143-1

A vault rating is a measure of time, not a promise. In the US, UL 608 covers vault doors and the modular panels used for vault floors, walls and ceilings. Classes are based on the net working time needed to break in with common mechanical tools, electric tools, cutting torches or a mix of them; the standard doesn’t cover the thermal lance (burning bar) or explosives.⁸

The New York specification ties the UL classes to the matching ASTM F1090 types and notes that federal government projects use different requirements.⁵ In Europe, strongrooms are certified under EN 1143-1 in nine resistance grades, V to XIII, and the door must be of the same grade or higher. Walls can be cast on site around prefabricated armouring elements or built from prefabricated panels as a room within a room; for cast walls, grades V to IX call for at least 400 mm of wall.⁹ Higher grades need thicker walls, up to at least 1,000 mm for grade XIII.

Types of bank vault

“Bank vault” covers several rooms that look alike from the corridor and do very different jobs. Here’s how they divide up.

A cash vault is a processing plant as much as a strongroom. In J.P. Morgan’s description, an armoured courier picks up a business’s notes, coins and cheques and takes them to the vault; the business gets provisional credit for the amount it declared; vault staff count the deposit and adjust the credit if needed. Cash orders run the other way, delivered by courier in the denominations the customer asks for.¹⁰ Cash on the move has its own weak points, as the 1978 Lufthansa heist at Kennedy Airport showed. Behind the banks sit the Federal Reserve’s own vaults. On a page last updated in 2017, the Fed says its 28 cash offices serve about 8,400 banks, savings institutions and credit unions; deposited currency is stored “in secure vaults until it is verified”, then counted and checked for counterfeits, and unfit notes are destroyed.¹¹

A safe deposit vault is the one most people have stood inside. Renting a box usually means signing a card that staff check on every visit, and the box needs two different keys, yours and the bank’s.¹² Our guide to safe deposit box keys explains how to tell which bank and lock a stray key belongs to.

Bullion vaults are a league of their own. The New York Fed’s gold vault sits on bedrock 80 feet below street level, behind a 90-ton steel cylinder, and held about 507,000 bars weighing 6,331 tonnes in 2024, none of it owned by the Fed.¹³ We compare it with Fort Knox, the Bank of England and others in the most secure bank vaults in the world, and the odder ones (seed banks, records, cheese) in the world’s strangest vaults. Record vaults, finally, are built to keep fire out rather than burglars: the New York specification offers fire-rated modular vaults from Class 125 for two hours to Class 350 for four.⁵

A short history of the bank vault

Early American bank vaults were iron rooms inside masonry. When burglars broke into the Ocean National Bank in New York in June 1869, they faced granite walls lined with boiler iron and three iron doors one behind the other.¹⁴ Makers soon built whole vaults in the factory. In 1875 Diebold, Norris & Co. of Canton, Ohio, had a building just for safe deposit vaults, and the one it made for the San Francisco Safe-Deposit Company measured 27 by 32 feet and 12 feet high, weighed 800,000 pounds and took forty railroad cars to deliver. It had three doors, five locks and 4,600 boxes, with gold and silver trimmings that, by gaslight, made a “scene of dazzling splendor”.¹⁵ Prefabrication, it turns out, isn’t new; it just used to be iron.

The 20th century moved the strength into concrete and steel. By 1924, a Cleveland reinforcement maker could note that banks were buying vault doors of twenty inches or more, although the lowest insurance rates applied to any door ten inches thick, and that the safe deposit business was growing fast enough to justify it.² That November, York Safe and Lock advertised that it had installed six “revoluble” vault entrances, each ten feet thick, at the New York Federal Reserve Bank; you can see York’s 1924 Federal Reserve advert in our collection.¹⁶

Timeline

• 1869 Burglars at the Ocean National Bank, New York, face granite walls lined with boiler iron and three iron doors.
• 1874 The first commercially successful time lock is fitted to a bank.
• 1875 Diebold, Norris & Co. ships a 400-ton iron safe deposit vault to San Francisco in forty railroad cars.
• 1924 Vault engineers call reinforced concrete “the ideal material”; York advertises ten-foot vault entrances at the New York Fed.
• 1968 The Bank Protection Act leads to federal security rules for vaults, alarms and lighting.
• c.1975 Prefabricated concrete panels begin to replace poured vaults, by a 2000 Diebold patent’s reckoning.
• 2001 Diebold buys Mosler’s security business, bringing the big American vault names under one roof.
• 2021 Chase stops renting new safe deposit boxes.

Sources for the timeline: Walling (1869); our time lock history (1874); Comley (1875); the Rivet-Grip handbook and York’s advert (1924); 12 CFR 326 (1968); US patent 6,543,371 (c.1975); Diebold’s 2001 annual report (2001); Associated Press (2021).¹⁷¹⁸ The 400 tons are the short tons of the 800,000-pound figure.

Who builds bank vaults today

Most of the great American vault names now sit inside one company. Diebold bought York’s safe and vault business in 1946 and Herring-Hall-Marvin of Hamilton, Ohio, in September 1959,¹⁹ and on 25 October 2001 it acquired Mosler’s physical and electronic security business in the United States and Canada.¹⁷ The 2000 modular panel patent quoted above was filed by Diebold and Mosler together.³

Smaller specialists make the rest. Vault Structures of Fort Myers, Florida, built UL 608 panels and round doors, and said UL retested each class every seven years.⁴ International Vault of Siler City, North Carolina, says it designs, delivers and installs custom modular vaults, vault doors and day gates built to UL 608, with “more than 30 years” of projects behind it.²⁰ The New York specification also names Worldwide Safe and Vault as a maker of lightweight metal-clad panels.⁵ We found no maker that publishes a list of the banks it has built for, which, given the product, is fair enough.

Do banks still have vaults?

Yes, but the rule is looser than people think. The federal requirement is “a vault, safe, or other secure space”, so a small branch can meet it with a safe.⁷ And the money has moved. Cash made up 14% of US consumer payments in 2024, and consumers have made about seven cash payments a month since 2021, which the Federal Reserve suggests may be a “floor” for cash use.²¹ In 2015 a third of payments were in cash.²²

The safe deposit side is shrinking faster. In 2022 the Associated Press reported that Chase had stopped opening new safe deposit boxes, that its newest branches “have not vaults for some time”, and that vaults are expensive to install and “pose 24/7 security risks”. Existing box holders could keep theirs while their branch stayed open.¹⁸ Many old vault doors now stand open, for good, in banking halls turned into shops, bars and gyms, as our vault door history shows.

Cash vaults and central bank vaults are a different matter: somebody still has to count, store and ship the notes that people do use, which is the work of the commercial cash vaults and the Fed’s cash offices described above.¹⁰¹¹

How much money is in a bank vault?

We couldn’t find a single bank that publishes how much cash sits in a branch vault, and the FDIC rule explains why it varies: the bank’s security officer decides what extra protection is needed by weighing, among other things, “the amount of currency or other valuables exposed to robbery, burglary, and larceny”.⁷ What we do have is the national total. The Federal Reserve reported vault cash held by banks subject to reserve requirements at about $95.3 billion in August 2020, then stopped publishing the series when it discontinued its H.3 release that September.²³

Are bank vaults airtight?

Tight, yes; a death trap, no. A vault with its time lock running can’t be reopened until the set time, and there’s usually no way to open the door from inside, so vault designers have long had to think about the person who gets shut in. A 1994 patent for a vault ventilator puts it plainly: some provision “must be made” to give fresh air to anyone trapped, operated by the person inside. Earlier systems ran tubes, sometimes with blowers, through the walls or door jambs; that design moved the fan into the door’s lock unit.²⁴

Today it’s in the specification. The New York master specification calls for an emergency vault ventilator to UL 680, with the same burglary classification as the door, and for fire-rated vault doors an escape mechanism that works the locks from the vault side.⁵

People do still get locked in. On the evening of 24 October 2023 a customer was shut inside a community safe deposit vault in the basement of the World Diamond Tower on Fifth Avenue, Manhattan, while visiting his box. Firefighters tried cutting through the concrete wall, hit metal plating, and decided to wait rather than use torches near him; they kept in touch by phone and camera. The time lock released the door at about 6:15 the next morning, and he was checked by paramedics and released without injury.²⁵

Bank vault myths and facts

Sources for the myths: the New York State vault specification and CBS New York; the Diebold modular panel patent; 12 CFR 326.3 and the Associated Press; the UL 608 summary cited above.^52537188

Frequently asked questions