Featured Product

    Dubai FSA Publishes Key Findings from Review of Cyber Risk Frameworks

    June 24, 2020

    Dubai FSA published the key findings from its thematic review on the cyber risk management frameworks of firms operating in the Dubai International Financial Center. The review, which was launched in July 2019, assessed cyber risk governance frameworks, cyber hygiene practices, and incident-preparedness programs of firms authorized by Dubai FSA. The review found that a significant number of firms had either not implemented a comprehensive cyber risk management framework or performed only a limited cyber risk assessment.

    The review shows that a significant number of firms perform only a limited cyber risk assessment. In many instances, neither the board nor senior management oversight of cyber risk management was sufficient. This was especially prevalent where firms outsourced their IT infrastructure and cyber security functions to an IT service provider. This was also evident in the fact that there was a lack of senior management review of cyber security audits, reviews, and tests. Only half of all firms have a due diligence process to assess whether third-party service providers meet the cyber security requirements and even fewer firms periodically test whether third-party service providers satisfy the cyber security requirements. 

    The majority of firms have implemented some form of a cyber incident response plan to respond to, and limit the consequences of, a cyber incident. However, in many cases, the cyber response procedures are addressed in general terms as components of the business continuity plan and are not tailored specifically to cyber threats. Less than half of all firms have implemented a crisis management communication plan that addresses external stakeholders while more than half of firms’ cyber incident response plans do not include a formal requirement for periodically testing the response to a cyber incident. Where firms do have a periodic testing requirement, it was identified that a significant number of firms have not tested any component of their cyber incident response plans in the past year. The published report summarizes such key findings and observations, along with the expectations of Dubai FSA and examples of best practices of cyber risk management. 

    The review was undertaken in two phases, with the first phase consisting of a questionnaire seeking high-level information on the cyber security practices of each authorized firm and the second phase consisting of desk-based reviews and onsite visits to selected firms representing a range of business models and financial services activities. Although not part of this review, the new remote working protocols established in 2020 also bring new cyber risk vulnerabilities that need to be addressed by the financial services industry. According to Mr. Bryan Stirewalt, the Chief Executive of the Dubai FSA, enhancement of the cyber resilience of regulated population is one of the key priorities of Dubai FSA, which has steadily increased the supervisory focus on cyber risk and is constantly engaging with firms in the Dubai International Financial Center to ensure they have sufficient safeguards in place to shield against and to respond to and recover from cyber incidents. The focus of Dubia FSA also includes support for development of industry-level guidance on cyber risk management practices. 

     

    Related Links

    Keywords: Middle East and Africa, UAE, Dubai, Banking, Cyber Risk, DIFC, Operational Risk, Cyber Testing, Outsourcing Arrangements, Third-Party Arrangements, Dubai FSA

    Related Articles
    News

    Regulators Fine Goldman Sachs for Risk Management Failures

    FCA and PRA in the UK, FED in the US, and the authorities in Singapore have fined Goldman Sachs for risk management failures in connection with the 1Malaysia Development Berhad (1MDB).

    October 23, 2020 WebPage Regulatory News
    News

    Canada Hosts International Conference of Banking Supervisors

    BCBS announced that OSFI and the Bank of Canada hosted the 21st International Conference of Banking Supervisors (ICBS) virtually on October 19-22, 2020.

    October 22, 2020 WebPage Regulatory News
    News

    FCA Proposes More Measures to Help Insurance Customers Amid Crisis

    FCA proposed guidance on how firms should continue to seek to help customers who hold insurance and premium finance products and may be in financial difficulty because of COVID-19, after October 31, 2020.

    October 21, 2020 WebPage Regulatory News
    News

    EBA Issues Opinion to Address Risk Stemming from Legacy Instruments

    EBA issued an opinion on prudential treatment of the legacy instruments as the grandfathering period nears an end on December 31, 2021.

    October 21, 2020 WebPage Regulatory News
    News

    ESRB Publishes Non-Bank Financial Intermediation Risk Monitor for 2020

    ESRB published the fifth issue of the EU Non-bank Financial Intermediation Risk Monitor 2020 (NBFI Monitor).

    October 21, 2020 WebPage Regulatory News
    News

    HM Treasury Publishes Policy Statement Amending Benchmarks Regulation

    HM Treasury announced that the new Financial Services Bill has been introduced in the Parliament.

    October 21, 2020 WebPage Regulatory News
    News

    APRA Initiates Action Against a Bank for Liquidity Compliance Breach

    APRA announced that it has increased the minimum liquidity requirement of Bendigo and Adelaide Bank for failing to comply with the prudential standard on liquidity.

    October 21, 2020 WebPage Regulatory News
    News

    PRA Consults on Implementation of Certain Provisions of CRD5 and CRR2

    PRA published the consultation paper CP17/20 to propose changes to certain rules, supervisory statements, and statements of policy to implement elements of the Capital Requirements Directive (CRD5).

    October 20, 2020 WebPage Regulatory News
    News

    US Agencies Finalize Rule to Reduce Impact of Large Bank Failures

    US Agencies adopted a final rule that applies to advanced approaches banking organizations and aims to reduce interconnectedness in the financial system as well as to reduce contagion risks associated with the failure of a global systemically important bank (G-SIB).

    October 20, 2020 WebPage Regulatory News
    News

    US Agencies Finalize Rule on Net Stable Funding Ratio Requirements

    US Agencies (FDIC, FED, and OCC) adopted a final rule that implements the net stable funding ratio (NSFR) for certain large banking organizations.

    October 20, 2020 WebPage Regulatory News
    RESULTS 1 - 10 OF 6004