ECB published the final cyber resilience oversight expectations for financial market infrastructures (FMIs). The cyber resilience oversight expectations are based on the global guidance on cyber resilience for financial market infrastructures. This guidance was published by CPMI and IOSCO in June 2016. ECB also published a high-level overview of the comments received during the consultation and summarized the main amendments to the cyber resilience oversight expectations.
The cyber resilience oversight expectations provide FMIs with detailed steps on how to operationalize the guidance, provide overseers with clear expectations to assess FMIs under their responsibility, and provide the basis for a meaningful discussion between the FMIs and their respective overseers. During the consultation, ECB received responses from 20 entities, including FMIs, banks, banking communities, and associations. Comments in the public consultation mostly focused on four aspects:
- Level of prescriptiveness of the expectations
- Three levels of cyber maturity and how these correspond to other international cybersecurity frameworks, which also have maturity models
- Process for oversight assessments against the cyber resilience oversight expectations
- Need for harmonization across different jurisdictions and among regulators, to reduce the fragmentation of regulatory expectations and facilitate oversight convergence
Cyber resilience is an important aspect of the operational resilience of FMIs and efficient operation of FMIs is essential for maintaining and enhancing financial stability. If not properly managed, FMIs can be sources of financial shocks, such as credit losses. They can also be a major channel through which these shocks are transmitted across domestic and international financial markets.
- Press Release
- Cyber Resilience Oversight Guidance (PDF)
- ECB Response to Consultation
- Responses from Entities (ZIP)
- CPMI-IOSCO Guidance on Cyber Resilience
Keywords: Europe, EU, Banking, PMI, FMI, Cyber Resilience, Cyber Risk, Operational Risk, ECB
Previous ArticleEIOPA Publishes Q&A on Regulations and Guidelines
APRA updated the lists of the Direct to APRA (D2A) validation and derivation rules for authorized deposit-taking institutions, insurers, and superannuation entities.
EC adopted a package that includes the digital finance and retail payments strategies and the legislative proposals for regulatory frameworks on crypto-assets and digital operational resilience.
ECB published an opinion (CON/2020/22) on proposals for regulations amending the securitization framework of EU, in response to the COVID-19 pandemic.
FCA is consulting on its approach to the authorization and supervision of international firms operating in UK.
MAS published amendments to Notice 637 on the risk-based capital adequacy requirements for reporting banks incorporated in Singapore.
FCA announced that it will move firms to RegData from Gabriel in the coming months in stages, based on the reporting requirements of firms.
ISDA issued a letter to regulators to flag that it now expects the supplement to the 2006 ISDA Definitions and the Interbank Offered Rate (IBOR) Fallbacks Protocol to be effective around mid- to late-January 2021.
APRA has concluded its review of the comprehensive plans of authorized deposit-taking institutions for the assessment and management of loans with repayment deferrals.
ESAs (EBA, EIOPA, and ESMA) published the first joint report that assesses risks in the financial sector since the outbreak of the COVID-19 pandemic.
BoE and HM Treasury confirmed that the COVID Corporate Financing Facility (CCFF) will close for new purchases of commercial paper, with effect from March 23, 2021.