Featured Product

    EBA Publishes Guidelines on ICT and Security Risk Management

    November 28, 2019

    EBA published the final guidelines on the mitigation and management of information and communication technology (ICT) and security risks for banks in EU. The guidelines set out expectations on the way in which all financial institutions should manage their internal and external ICT and security risks. The guidelines provide financial institutions with a better understanding of supervisory expectations for the management of these risks, covering sound internal governance, information security requirements, ICT operations, project and change management, and business continuity management. The guidelines, which apply to credit institutions, investment firms, and payment service providers, enter into force on June 30, 2020.

    These guidelines respond to the EC's FinTech Action plan request for EBA to develop guidelines on ICT risk management and mitigation requirements in the financial sector in EU. The guidelines:

    • Focus on the management and mitigation of ICT and security risks by establishing sound internal governance and an internal control framework that sets clear responsibilities for the staff of financial institutions, including for the management bodies
    • Require financial institutions to maintain up-to-date inventories of their business functions, supporting processes and information assets and to classify them in terms of criticality, based on the confidentiality, integrity, and availability of data
    • Remind financial institutions to ensure the effectiveness of the risk-mitigating measures, as defined by their risk management framework, when outsourcing or using third-party providers
    • Specify high-level principles on how ICT operations should be managed, including requirements to improve, when possible, the efficiency of ICT operations; implement logging and monitoring procedures for critical ICT operations; maintain an up-to-date inventory of their ICT assets; monitor and manage the life cycle of ICT assets; and implement backup plans and recovery procedures
    • Specify expectations on business continuity management and developing response and recovery plans, including testing, and their consequent updating based on the test results
    • Cover the management of relationship of payment service providers with payment service users to ensure that users are made aware of the security risks linked to the payment services and are provided with the tools to disable specific payment functionalities and monitor payment transactions

    In implementing these guidelines, financial institutions should refer to the existing standards and leading best practices. These guidelines intend to be technology and methodology agnostic. The implementation of these guidelines should be done in accordance with the principle of proportionality, taking into account the scale and complexity of operations, the nature of the activity engaged in, the types of services provided, and the corresponding ICT and security risks related to the processes and services of financial institutions. These guidelines complement, and should be read in conjunction with, the supervisory assessment to the applicable institutions in EBA guidelines on ICT risk assessment under the Supervisory Review and Evaluation Process (EBA/GL/2017/05) and other relevant guidelines such as EBA guidelines on outsourcing arrangements (EBA/GL/2019/02). 


    Related Links

    Effective Date: June 30, 2020

    Keywords: Europe, EU, Banking, CRD, PSD 2, ICT Risk, Cyber Risk, Proportionality, Operational Risk, Outsourcing Arrangements, Third-Party Arrangements, Fintech, EBA

    Featured Experts
    Related Articles

    APRA Sets LAC for D-SIBs, Proposes to Enhance Crisis Preparedness

    APRA issued a letter on the loss-absorbing capacity (LAC) requirements for domestic systemically important banks (D-SIBs) and published a discussion paper, along with the proposed the prudential standards on financial contingency planning (CPS 190) and resolution planning (CPS 900).

    December 02, 2021 WebPage Regulatory News

    EC to Review Macro-Prudential Rules while ESRB Assesses Policy Stance

    The European Commission (EC) launched a call for evidence, until March 18, 2022, as part of a comprehensive review of the macro-prudential rules for the banking sector under the Capital Requirements Regulation (CRR) and Directive (CRD IV).

    December 01, 2021 WebPage Regulatory News

    FSB Sets Out Good Practices for Crisis Management Groups

    The Financial Stability Board (FSB) published a report that sets out good practices for crisis management groups.

    November 30, 2021 WebPage Regulatory News

    APRA Penalizes Heritage Bank for Incorrect Reporting of Capital

    The Australian Prudential Regulation Authority (APRA) found that Heritage Bank Limited had incorrectly reported capital because of weaknesses in operational risk and compliance frameworks, although the bank did not breach minimum prudential capital ratios at any point and remains well-capitalized.

    November 29, 2021 WebPage Regulatory News

    OSFI Releases Annual Report 2021-2022

    The Office of the Superintendent of Financial Institutions (OSFI) released the annual report for 2020-2021.

    November 29, 2021 WebPage Regulatory News

    OSFI Updates Timeline for Implementation of Certain Basel Rules

    Through a letter addressed to the banking sector entities, the Office of the Superintendent of Financial Institutions (OSFI) announced deferral of the domestic implementation of the final Basel III reforms from the first to the second quarter of 2023.

    November 29, 2021 WebPage Regulatory News

    EC Defers Adoption of Regulatory Standards for Disclosures Under SFDR

    EIOPA recently published a letter in which EC is informing the European Parliament and Council that it could not adopt the set of draft regulatory technical standards for disclosures under the Sustainable Finance Disclosure Regulation (SFDR) within the stipulated three-month period, given their length and technical detail.

    November 29, 2021 WebPage Regulatory News

    FCA Releases MIFIDPRU Application Forms and Third Set of Rules on IFPR

    The Financial Conduct Authority (FCA) published the third in a series of policy statements that set out rules to introduce the UK Investment Firm Prudential Regime (IFPR), which will take effect on January 01, 2022.

    November 29, 2021 WebPage Regulatory News

    APRA Finalizes Capital Adequacy Standards for Banks

    The Australian Prudential Regulation Authority (APRA) published, along with a summary of its response to the consultation feedback, an information paper that summarizes the finalized capital framework that is in line with the internationally agreed Basel III requirements for banks.

    November 29, 2021 WebPage Regulatory News

    CPMI-IOSCO Seek Comments on Access to Central Clearing and Portability

    The Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO) issued a consultative report focusing on access to central counterparty (CCP) clearing and client-position portability.

    November 29, 2021 WebPage Regulatory News
    RESULTS 1 - 10 OF 7751