The Office of the Superintendent of Financial Institutions (OSFI) published final revisions to its advisory on public disclosure requirements for global systemically important banks (G-SIBs). OSFI also published an updated cyber-security self-assessment template to help federally regulated financial institutions gauge and improve their current state of readiness in the face of emerging and expanding cyber threats. The self-assessment template covers criteria for reviewing third-party providers, including the providers of cloud services. It examines the capability of a financial institution to respond to a cyber incident in areas ranging from organization and resources, to how it manages threats, risks, and incidents, and allows an institution to rate each element on a scale from non-existent to continuous improvement. In a related development, OSFI updated the requirements governing how federally regulated financial institutions should disclose and report technology and cyber-security incidents to OSFI.
The updated advisory on technology and cyber-security incident reporting, which becomes effective from August 13, 2021, supports a coordinated and integrated response to technology and cyber-security incidents when they occur at federally regulated financial institutions. As updated, the federally regulated financial institutions must report a technology or cyber-security incident to the Technology Risk Division of OSFI as well as their Lead Supervisor at OSFI within 24 hours. Other changes to the advisory include a new "failure to report" section. In case a federally regulated financial institution does not report a cyber incident, it could be subject to increased supervisory oversight by OSFI, could be placed on a watchlist, or could be assigned one of the stages in the OSFI supervisory intervention approach, among other measures.
The revised advisory on G-SIB disclosures addresses changes to the disclosure requirements included in the updated assessment methodology of the Basel Committee on Banking Supervision, which was published in July 2018 and will take effect for the 2022 G-SIB assessment exercise; the key changes relate to the new Trading Volume indicator and the inclusion of insurance activities for certain existing G-SIB indicators. The revised advisory also provides guidance on the availability of publicly disclosed G-SIB indicators and the nature of qualitative information to accompany the disclosure requirements. This advisory applies to federally regulated banks with a Basel III leverage ratio exposure measure (including exposures arising from insurance subsidiaries) exceeding EUR 200 billion at financial year-end, or a bank that was included in the assessment sample by OSFI based on supervisory judgment.
- Letter on Revised G-SIB Advisory
- Advisory on G-SIB Disclosures
- Cyber Security Self-Assessment
- Self-Assessment Template (XLSX)
- News Release on Cyber Incident Reporting
- Cyber Incident Reporting Advisory
Keywords: Americas, Canada, Banking, G-SIBs, Basel, Incident Reporting, Reporting, Cyber Risk, Regulatory Capital, Self-Assessment Template, OSFI
Previous ArticleOCC Proposes Revisions to Templates and Guidance on Stress Testing
The Office of the Superintendent of Financial Institutions (OSFI) published an update on the discussion paper that intended to engage federally regulated financial institutions and other interested stakeholders in a dialog with OSFI, to proactively enhance and align assurance expectations over key regulatory returns.
The European Commission (EC) published a report summarizing responses to the targeted consultation on the supervisory convergence and the single rulebook in the European Union (EU).
The European Central Bank (ECB) published its opinion on a proposal for a regulation on European green bonds, following a request from the European Parliament.
The Advisory Scientific Committee (ASC) of the European Systemic Risk Board (ESRB) published a report that explores the expected impact of digitalization on provision of financial and banking services, and proposes policy measures to address the risks stemming from digitalization.
The Hong Kong Monetary Authority (HKMA) is consulting on the draft Financial Institutions (Resolution) Ordinance (Cap. 628), or FIRO, Code of Practice chapter on liquidity and funding in resolution, until March 14, 2022.
The Swedish Financial Supervisory Authority (FI) announced that the capital adequacy reporting as at December 31, 2021 must be done by February 11, 2022.
The European Banking Authority (EBA) announced that the guidelines on the reporting and disclosure of exposures subject to measures COVID-relief measures shall continue to apply until further notice.
The Central Bank of the Philippines (BSP) issued communications covering developments related to online lending platforms, open finance framework and roadmap, and on the expected regulations in the area sustainable finance.
The Board of Governors of the Federal Reserve System (FED) published the final rule that amends Regulation I to reduce the quarterly reporting burden for member banks by automating the application process for adjusting their subscriptions to the Federal Reserve Bank capital stock, except in the context of mergers.
The European Banking Authority (EBA) published its assessment of risks through the quarterly Risk Dashboard and the results of the Autumn edition of the Risk Assessment Questionnaire (RAQ).