The push towards digital banking solutions has made lenders increasingly reliant on common third-party IT firms, making them more susceptible to cyber disruption on a wider scale and a potential ripple effect within the market, according to the latest Global Finance Sustainability Report published by the IMF this month.
More than 50 per cent of IT providers supply their services to two or more global systemically important banks, implying a widespread overlap.
Cyber accidents have steadily increased from 2004 to 2023, according to the report. The number of cyber incidents with malicious intent — cyber attacks — have almost doubled relative to the period before the Covid-19 pandemic.
Financial firms are highly exposed to cyber risks, being subject to nearly one-fifth of all incidents. The sector has reported losses totalling almost $12bn since 2004, and $2.5bn since 2020, according to the IMF.
Ransomware attacks have the potential to impact financial markets, according to a recent report by the European Systemic Risk Board.
In January 2023, a cyber attack on Dublin-headquartered software company ION Group disabled some of the firm’s core functions, resulting in more than 40 banks, hedge funds and brokerages being unable to process derivatives transactions.
In November 2023, the US branch of the Industrial and Commercial Bank of China, China’s largest bank by assets, was targeted in a ransomware attack. Following the ordeal, some banks became wary of reconnecting their trading portals to ICBC due to security concerns.
Attacks on financial institutions and their digital services providers can also jeopardise client trust and firms’ ability to protect their customers’ data and meet their payment obligations, which can ultimately affect their profits.
The IMF pointed to a lack of effort by countries worldwide to address such risks, partially due to outdated policies and legal frameworks, which can lead to the lack of “effective oversight” of third-party providers.
Supervisors should require financial firms to develop and test response and recovery procedures to remain operational during cyber incidents, suggested the IMF.
Nevertheless, the report also found some positive trends, with around half of the jurisdictions included in the IMF survey saying that they now have the capacity to examine third-party service providers.
