The Cyprus Securities and Exchange Commission (CySEC) has taken a pivotal regulatory step by adopting new joint guidelines that require financial institutions to accurately estimate the aggregated annual costs and losses arising from significant information and communications technology (ICT) incidents. These measures, aligned with the Digital Operational Resilience Act (DORA Regulation), were set forth by the European Supervisory Authorities on July 17, 2024.
Regulatory Mandate and Industry Scope
Under Article 11(11) of the DORA Regulation, all financial entities under CySEC’s jurisdiction are now mandated to report aggregated annual losses from major ICT incidents. This comprehensive requirement covers a spectrum of market participants, including Cyprus Investment Firms, crypto-asset service providers, asset-referenced token issuers, central securities depositories, central counterparties, trading venues, alternative investment fund managers, management companies, and crowdfunding service providers authorized by CySEC.
Follow THE FUTURE on LinkedIn, Facebook, Instagram, X and Telegram
Establishing Uniform Reporting Standards
The implemented guidelines aim to standardize the methodology for loss estimation by specifying a uniform framework and template for reporting. This initiative is designed to bolster the consistency and reliability of financial reporting and risk management across the board, ensuring that all regulated entities adhere to a common framework in quantifying operational digital risks.
Enhancing Digital Operational Resilience
Enshrined as Regulation (EU) 2022/2554, the DORA Regulation underscores the imperative for robust digital operational resilience within the financial sector. CySEC’s regulatory action reinforces the broader European initiative to enhance ICT oversight and fortify the industry’s ability to withstand digital disruptions, a move that is critical in today’s increasingly tech-dependent financial landscape.
Future Perspectives
As financial institutions begin to comply with these rigorous standards, the industry is poised to benefit from enhanced transparency and more effective risk mitigation. These measures not only safeguard the financial system against the evolving landscape of digital threats but also contribute to a more resilient and stable economic environment.
