Legal regulations and acts of the Republic of Croatia define the foundations for the protection of financial institutions. Physical and technical protection of financial institutions and their facilities is defined in advance, according to the categorization of protected facilities. The type of protection, the implementation of protection and the guidelines are regulated by legal obligations, whether it is the facilities of central banks, branches, ATMs or the protection of value during transport. Financial institutions, especially smaller facilities with a lower level of protection, are often targeted by bandits. Precisely because of this lower level of protection, and the requirements for the complexity of protection by technical and physical methods of protection, it is easier for robbers to commit a robbery with minor possible consequences and almost no need to develop a robbery plan. It is further important to mention that the very forms of attacks on financial institutions have changed the way robbery is done today. Cyber attacks on financial institutions have become more frequent over the past few years, with major consequences for users, and especially for financial institutions and their businesses. Physical and technical protection is an obligation when we talk about protecting financial facilities from physical attacks, and cyber security is an obligation when we talk about the increasingly frequent hacker attacks.