Cyber Insurance Underwriting Risk

PRA supervisory statement sets out expectations of firms regarding of cyber insurance underwriting risk

UK Prudential Regulation Authority supervisory statement sets out proposed expectations of insurance firms regarding cyber insurance underwriting risk. Expectations are set out in three broad areas: i) non-affirmative cyber risk; ii) cyber risk strategy and risk appetite; and iii) cyber expertise. 

Publisher: National Regulators     Release date: Jul 2017     Country: United Kingdom

Type: Supervisory Practice

Topics: Cyber risk

Sectors: Insurance

Advisory to Financial Institutions on Cyber-Events and Cyber-Enabled Crime

FinCen advisory for banks to understand their obligations

Financial Crimes Enforcement Network advisory assists financial institutions in understanding their obligations regarding cyber-events and cyber-enabled crime. Advises on: i) reporting cyber-enabled crime and cyber-events; ii) including relevant and available cyber-related information in suspicious activity reports (SARs); iii) collaborating between Bank Secrecy Act/Anti-Money Laundering units and in-house cybersecurity units to identify suspicious activity; and iv) sharing information including cyber-related information, among financial institutions to guard against and report money laundering, terrorism financing, and cyber-enabled crime. 

Publisher: National Regulators     Release date: Oct 2016     Country: United States

Type: Consultative, discussion and issues paper

Topics: Cyber risk

Sectors: Banking

Enhanced Cyber Risk Management Standards

FRB, FDIC and OCC consultation on enhanced standards for cybersecurity risk management

US Federal Reserve Board, Federal Deposit Insurance Corporation and Office of the Comptroller of the Currency consultation on potential enhanced cybersecurity risk management and resilience standards to apply to large banks as well as to services provided by third parties to these firms. Standards would increase operational resilience and reduce impact on financial system in case of a cyber event experienced by one of these entities. 

Publisher: National Regulators     Release date: Oct 2016     Country: United States

Type: Consultative, discussion and issues paper

Topics: Cyber risk

Sectors: Banking

Deadline for comments: Jan 2017

Cyber Risk in the Insurance Sector

IAIS issues paper discusses cyber risk and mitigation of risks

International Association of Insurance Supervisors issue paper discusses challenges presented by cyber risk, including current and contemplated supervisory approaches for addressing these risks. Provides background, describes current practices, identifies examples, and explores related regulatory and supervisory issues and challenges. Focuses on cyber risk to the insurance sector and the mitigation of such risks. 

Publisher: Global Standard-Setting Bodies     Release date: Aug 2016    

Type: Consultative, discussion and issues paper

Topics: Cyber risk

Sectors: Insurance

Cyber Security in Securities Markets

IOSCO consultation discusses regulatory approaches to cyber security and tools available to respond to cyber risk

International Organization of Securities Commissions discussion paper about regulatory approaches to cyber security. Covers key segments of securities markets, including issuers, trading venues, market intermediaries, asset managers and financial market infrastructures and addresses related regulatory issues, challenges and approaches. Also describes practices adopted by market participants. Report underscores issues and opportunities for cooperation and information sharing among market participants and regulators. 

Publisher: Global Standard-Setting Bodies     Release date: Apr 2016    

Type: Consultative, discussion and issues paper

Topics: Cyber risk

Sectors: Securities

Cyber Security Risk Management

HKMA guidance setting out its expectations regarding effective cyber security risk management in banks

Hong Kong Monetary Authority guidance on cyber security risk management measures. Board and senior management of banks are expected to play proactive role in ensuring effective cyber risk management in the following areas: i) risk ownership and management accountability; ii) periodic evaluations and monitoring of cyber security controls; iii) industry collaboration and contingency planning; and iv) regular independent assessment and tests.

Publisher: National Regulators     Release date: Sep 2015     Country: Hong Kong, China

Type: Guideline

Topics: Cyber risk

Sectors: Banking

2015 Regulatory and Exam Priorities Letter

FINRA guidance highlights risks that could adversely affect investors and market integrity

US Financial Industry Regulatory Authority guidance for securities industry identifies shortcomings in five areas of broker-dealer activities: i) alignment of firms' interests with those of customers; ii) standards of ethical behaviour; iii) development of strong supervisory and risk management systems; iv) development, marketing and sale of novel products and services; and v) management of conflicts of interest. Specific areas of concern include: i) sale and supervision of interest-rate-sensitive and complex products; ii) controls around handling of wealth events in investors' lives; iii) management of cybersecurity risks; and iv) treatment of senior investors. Market regulation will focus on key areas including: i) abusive trading algorithms; ii) high-frequency trading; iii) cross-market and cross-product manipulation; iv) order routing practices, best execution and disclosure; and v) market access controls. 

Publisher: Industry Groups     Release date: Jan 2015    

Type: Guideline

Topics: Cyber risk

Sectors: Securities