The Financial Conduct Authority (FCA) has published its Consultation Paper CP24/20 focused on enhancing safeguarding practices for the Payment and E-Money firms. The FCA’s proposed safeguarding changes represent a significant upgrade to existing practices, and firms should begin preparing now to ensure they can meet the timeframes.

Operational resilience isn’t achieved in isolation. Today’s interconnected financial sector means that third-party vendors, and market infrastructures are integral to delivering IBS. Mapping these dependencies is crucial; firms need to understand exactly what resources—people, processes, technology, and vendors—are involved in each important business service.

“Firms should read this review, consider how their firm compares, and use it to address any shortfalls or gaps and raise standards. It is better for firms to resolve issues now than wait for us to identify and intervene on issues and remediate any harm later.” 

Third-party risks emerge from direct relationships between financial institutions and their vendors or service providers, fourth-party risks arise from the subcontractors of these third parties. Do your supplier relationships look a little like the image, and do you really understand who is dependent on who?

Regulators cannot possibly stay ahead of cybercriminals and it’s simply not realistic to expect them to. Regulations can lag years behind criminal innovation, and like the picture I asked our AI to create for this post, we face an indestructible enemy. If you’re C-suite, start thinking about the regulatory requirements for security as the floor, and then ask yourself “how much do we need to invest to stand up?”

As I said in my post last week: “The operational resilience requirements in the UK share common objectives with the EBA guidelines for Information and Communication Technology (ICT) security risk management, and the requirements laid down by DORA in the EU.” It made sense to me to follow up with a piece on the EBA guidelines.