LeanIX is now part of SAP
Build and transform technology landscapes to support evolving business strategies and operationalize innovation.
Learn moreMaximize market potential through a partner program offering LeanIX solutions tailored to your business model.
Learn more
LeanIX is now part of SAP
The aim of the European Banking Authority's report is to create increased cyber security by implementing tighter regulations when it comes to outsourcing services.
The aim of the European Banking Authority's report is to create increased cyber security by implementing tighter regulations when it comes to outsourcing services. These new EBA guidelines on ICT (Information and communications technology) are designed for all financial institutions and cover all methods of payment, including electronic money.
ICT guidelines or EBA guidelines affect cloud outsourcing and deployment in FinTech and are replacing the 2006 Committee of European banking Supervisors Guidelines on Outsourcing. In addition, they also include the EBA’s recommendations when it comes to outsourcing.
While the covered entities are defined in the guidelines, you will also find some details on specific procedures and obligations.
All financial institutions that fit the following criteria are obligated to follow the ICT guidelines as outlined in the report:
A more extensive range of companies, now including FinTech, will face the challenge of remaining competitive in a fast-moving market while complying with the guidelines.
Since 30th September 2019, all institutions addressed in the report have to adhere to the new rules.
The intricacy level of information and communication technologies is rising and so is the amount of security-related attacks. And frequently, the infrastructures used in ICT systems that help run a financial institution are interconnected.
Therefore, a breach in the system due to cyber incidents could potentially cause a total collapse of a vital infrastructure and lead to systemic impacts with devastating effects on an entire institution or, in the worst-case scenario, the world's financial markets.
What might seem like a doomsday scenario remains a possibility and poses an actual threat.
This prompted a response in the form of new EBA guidelines that establish how financial institutions need to address security risks and safeguard their ICT infrastructure. ICT and security management are a fundamental part of any financial institution's effort to meet its objectives in strategy, corporate expectations, operations management, and reputation.
The EBA guidelines also include Payment Service Providers. Whenever payment services are involved – including the issuance of electronic money from credit institutions and all activities beyond the payment services and investment firms – the guidelines apply.
In short, the PSPs that have to adhere to ICT guidelines include:
The guidelines apply to all of the above unless stated otherwise.
The EBA guidelines are designed to integrate the rules published in December 2017 in Article 95 of PSD2, with the title “Guidelines on security measures for operational and security risks of payment services.”
To level the playing field, the guidelines also elaborate on topics geared toward the mitigation of ICT and security risks in financial institutions.
In addition, the ICT guidelines also elaborate on the European Commission's request set out in the Financial Technology (FinTech) action plan, which was published in March 2018.
Included is a request to the European Supervisory Authorities to create guidelines on ICT risk management and mitigation requirements in the European Union’s financial sector.
The guidelines further address the spike in security risks as a result of the digitization of the financial sector and the interconnectedness of infrastructures, exposing everyone in the networks to attacks.
Through modern online telecommunication channels and wireless tech using wide area networks, the EU financial institutions open themselves up to increased risk. Not to mention all other financial institutions and third parties that are affiliated with EU institutions.
Through the ICT guidelines, institutions improve their cyber security and can better protect themselves from cyber-attacks. After all, cyber security risk management should be a part of a financial institution's overall security risk management.
Cyber-attacks have certain characteristics that should be taken into account when ensuring that information security measures are fit to combat cyber risks. This includes:
With the “Weakest Link Principle”, financial institutions and other market participants must work together to avoid security leaks.
The ICT operational units are the first line of defense. That is why the EBA guidelines focus on the responsibilities of the managerial body first and then the second line of defense, which consists of the information security function.
After public consultation, the guidelines now reflect a change to include the responsibility of internal governance bodies in risk management related to cyber security.
To better address the broader scope of provisions and matters regarding cyber security risk management, the requirements provided in the “Guidelines on the security measures for operational and security risks of payment services” are included and expanded in the new EBA guidelines.
In effect, the 2017 provisions were repealed because they do not proportionately address the nature, scope, or complexity of the institutions' risk management responsibility.
In the EBA guidelines for security risk management, the approach is to find a way to address outsourcing, innovation and balance it with compliance. Despite requests from public consultants to delete FinTech from the report, the ICT guidelines explicitly include provisions for security risk management that include all the relevant industry players.
The guidelines are comprised of the following categories:
All the financial institutions are obligated to comply with the provisions in the EBA guidelines in a way that is proportionate to the size of the institution, its internal organization, scope, nature, complexity, and riskiness of the product/services provided.
The security risk management is obligated to involve the management body to ensure adequate governance, high standards of quality, and staff skills as well as the approval, supervision, and implementation of robust ICT strategies.
Within their strategy, the institutions have to evolve to effectively support organizational structure, ICT system changes, third-party dependencies as well as their staff and processes.
The institutions are obligated to identify and manage their infrastructure according to ICT guidelines. In addition to that, responsibility has to be directly assigned in order to manage and oversee ICT and security risks. This section covers assigning key roles and responsibilities, determining risk, and fixing problems from lessons learned.
A system of risk classification and assessment lays out how to mitigate risk and how to report relevant information according to the EBA guidelines. It also continuously audits the systems in place.
Under information security, the EBA guidelines define what constitutes an acceptable information security policy for security risk management. The ICT guidelines also outline logical security, physical security, ICT operations security, security monitoring, information security reviews, assessment and testing, and information security training and awareness.
In this section of the EBA guidelines, the financial institutions are advised to manage their ICT operations based on procedures and processes implemented by the management body. Incident and problem management are also covered, and it is explained how to best collaborate with the relevant responder in the event of an issue.
The institutions are instructed to set up a project governance process that defines responsibilities, assigns roles, and lays out accountability to support the implementation of ICT guidelines and strategies.
You will also find a section on ICT systems acquisitions and development and the ICT management change protocol.
In the event of severe business disruptions as a result of any cyber-attacks or security breaches, the institutions must be prepared to smoothly transition back into normalcy. The process described involves a business impact analysis, a business continuity and response plan, recovery plans, testing the plans, and finally setting up channels of communication during a crisis.
The PSPs' security risk management is mandated to establish and implement processes that increase awareness of security risks linked to each service. In light of new threats, assistance and guidance have to be implemented.
The rest of the EBA guidelines for PSPs are about the detection of fraudulent or malicious account uses, and ways to prevent breaches by disabling certain functions.
In the EBA outsourcing guidelines, the authority defines outsourcing as an arrangement between a regulated institution and a service provider who performs a process, service, or activity that would normally be taken care of internally.
Thus, each institution is advised to determine which arrangements fall under third-party outsourcing. The rules are stricter on the more sensitive tasks that could cause disruptions like systemic failure when compromised.
The EBA guidelines on outsourcing state that the institutions have to ensure that their risk-mitigating measures are effective when using third-party providers.
Therefore, third-party providers fall under the institution's definition of risk management.
To make sure that there is continuity of ICT services and ICT systems, the EBA outsourcing guidelines recommend institutions to ensure that the contracts and service- agreements, include the following measures:
The financial institutions that enter into these agreements with third-party providers have to monitor and ensure that the level of compliance with the security measures, objectives, and performance targets are met.
The security standard of third-party providers has to be up to par with the standard of the institutions that hire them, as stated in the EBA outsourcing guidelines.
The EBA guidelines particularly name cloud services as the highest security risk.
Cloud deployment efforts have increased across most industries, which was accelerated by the pandemic, forcing more people to work from home. The EBA guidelines on outsourcing, aim to cover the potential areas of risk that come with cloud-based workplaces.
Through software like LeanIX, large institutions are given the necessary tools and services within their enterprise architecture, while effectively managing application portfolios.
For enterprises that use more than 100 applications in their day-to-day operations, maintaining application transparency is an extremely difficult task. Thus, effective application management makes it much easier to adhere to the EBA guidelines on outsourcing.
LeanIX helps the mentioned institutions to keep a handle on all software from different vendors. After all, with an emphasis on third-party provider monitoring, conforming to complex EBA guidelines is much more feasible than it seems.
Free White Paper
Gain Value out of Your EA Program Now!
/EN/Reports/Thumbnail-Obsolescence-Gartner.png?width=260&height=171&name=Thumbnail-Obsolescence-Gartner.png)
/EN/Poster/Thumbnail-Obsolescence-Poster-Template-720x500-1.png?width=260&height=171&name=Thumbnail-Obsolescence-Poster-Template-720x500-1.png)
/EN-Tech-Stacks-Poster_Resource_Page_Thumbnail.png?width=260&height=171&name=EN-Tech-Stacks-Poster_Resource_Page_Thumbnail.png)