OSFI issued an advisory on the Technology and Cyber Security Incident Reporting. The advisory sets out the OSFI expectations for federally regulated financial institutions (FRFIs) with respect to the reporting of technology and cyber security incidents affecting FRFI operations. The advisory describes characteristics of incidents that should be reported to OSFI, in addition to the initial notification and subsequent reporting requirements. The advisory comes into effect on March 31, 2019.
In the meantime, FRFIs are expected to continue reporting any major incidents according to previous instructions communicated by their Lead Supervisors. Effective March 31, 2019, this Advisory supersedes any prior instructions for technology and cyber security incident reporting. For the purpose of this Advisory, a technology or cyber security incident is defined to have the potential to, or has been assessed to, materially impact the normal operations of a FRFI, including confidentiality, integrity, or availability of its systems and information. Technology or Cyber Security Incidents assessed by a FRFI to be of a high or critical severity level should be reported to OSFI. FRFIs include banks, trust companies, loan companies, life insurance companies, fraternal benefit societies, and property and casualty insurance companies.
Effective Date: March 31, 2019
Keywords: Americas, Canada, Banking, Insurance, Cyber Risk, Incident Reporting, Advisory, Regtech, OSFI
Previous ArticleEBA Single Rulebook Q&A: Third Update for January 2019
FED finalized a rule that updates capital planning requirements to reflect the new framework from 2019 that sorts large banks into categories, with requirements that are tailored to the risks of each category.
ECB published results of the quarterly lending survey conducted on 143 banks in the euro area.
ESAs published the final draft implementing technical standards on reporting of intra-group transactions and risk concentration of financial conglomerates subject to the supplementary supervision in EU.
EBA published the annual report on asset encumbrance of banks in EU.
MAS revised the guidelines that address technology and cyber risks of financial institutions, in an environment of growing use of cloud technologies, application programming interfaces, and rapid software development.
FED updated the reporting form and instructions for the FR Y-9C report on consolidated financial statements for holding companies.
EBA issued a consultation paper on the guidelines on monitoring of the threshold and other procedural aspects of the establishment of intermediate EU parent undertakings, or IPUs, as laid down in the Capital Requirements Directive.
EC published Regulation 2021/25 that addresses amendments related to the financial reporting consequences of replacement of the existing interest rate benchmarks with alternative reference rates.
BIS published a bulletin, or a note, that examines the cyber threat landscape in the context of the pandemic and discusses policies to reduce risks to financial stability.
HM Treasury, also known as HMT, has updated the table containing the list of the equivalence decisions that came into effect in UK at the end of the transition period of its withdrawal from EU.