UK regulators have given British financial firms a three-month deadline to demonstrate their operational resilience in the event of a cyber attack or IT breakdown. The demand by the Bank of England and the Financial Conduct Authority for banks to report on their exposure to risk and contingency planning for disruptive outages comes on the heels of a disastrous IT upgrade at TSB and the recent black out of the Visa network. In a joint statement, FCA chief Andrew Bailey and BoE deputy governor Jon Cunliffe, say: “Operational disruption can impact financial stability, threaten the viability of individual firms and financial market infrastructures, or cause harm to consumers and other market participants in the financial system.” With banks having to adapt their legacy architecture to keep pace with nimble-footed fintech competitors, the operational risks of a significant IT breakdown are becoming increasingly apparent. The watchdogs say that banks should have backup plans in place to enable full recovery withing two working days. This is in stark contrast to the ongoing crisis at TSB, which continues to dog the bank and its customers more than a month after a switch to a new IT platform went awry. Motivating the approach are a number of important concepts, which include: Penalties for those firms that fail to demonstrate adequate planning could result in a requirement for higher capital levels, sanctioning of executive leadership and a demand for more IT investment. The discussion paper follows the publication of the bank of England's Financial Stability Report which last week, which set out plans to test banks' resilience to resist and recover from a cyber attack on their payments systems.
The Bank of England and Financial Conduct Authority have handed the UK's banks a two days deadline in which to demonstrate their resilience to a cyber attack, including having a back-up plan enabling operations to resume within three-month. In a joint statement, the two organisations said cyber attacks threatened "financial stability, the viability of individual firms and financial market infrastructures", and warned of fines and sanctions for banks which did not comply. The move follows a disastrous IT upgrade at TSB and the Visa network's recent blackout.