§ 1-212

If a financial institution requires a customer to provide an answer to a security question in connection with the provision of an account, the financial institution shall allow the customer to choose from at least two security questions options for each required security question.