A. Overview of the South African Financial System

5. The South African financial system is large, concentrated and highly interconnected, with cross-border linkages. Banking sector assets account for 31 percent of total financial sector assets (the share of banks’ assets as a proportion of GDP is 115 percent), exceeding that of most other emerging economies. The banking sector in South Africa is highly concentrated with the sector dominated by five large banks accounting for more than 91 percent of the banking sector assets and the large banks are highly interconnected with other segments of the financial sector such as insurance and asset management. While South African banks’ cross-border operations represent a small part of consolidated balance sheets,⁷ operations continue to grow and are systemically important in many host countries (e.g., Botswana, Lesotho, Malawi, Mauritius, Mozambique, Namibia, Swaziland, Uganda, and Zambia). Thus, domestic shocks could generate outward spillovers, with a significant impact on the region.

6. There are six systemically important FMIs that are subject to the PFMI (Figure 1). This includes four payment systems (PS), one central securities depository (CSD)/securities settlement system (SSS), and one central counterparty (CCP).⁸ There are no trade repositories. The ZAR is a CLS-eligible currency, which is operated byan FMI located in a foreign jurisdiction.

• PS. These are: (i) the South African Multiple Option Settlement (SAMOS) system, the real-time gross settlement (RTGS) system owned and operated bythe SARB; (ii) the large-value payment system within STRATE, a privately operated SSS; (iii) the BankservAfrica retail payment system privately operated by BankservAfrica; and (iv) the South African Development Community RTGS (SADC-RTGS) system, which settles cross-border payments and is owned by SADC central banks and operated bythe SARB. At least 15 SADC member countries participate in the SADC-RTGS system.

• CSD/SSS. STRATE is also the sole operational CSD/SSS in South Africa. It facilitates the settlement of equities, bonds, and money market transactions.

• CCP. JSE Clear is the sole licensed clearing house in South Africa. JSE Clear acts as the settlement authority for the exchange-traded equities market and as the clearing house for the exchange-traded derivatives market.

Systemically Important Financial Market Infrastructures in South Africa

Citation: IMF Staff Country Reports 2022, 181; 10.5089/9798400214295.002.A001

• Download Figure
• Download figure as PowerPoint slide

View Full Size

Systemically Important Financial Market Infrastructures in South Africa

Citation: IMF Staff Country Reports 2022, 181; 10.5089/9798400214295.002.A001

• Download Figure
• Download figure as PowerPoint slide

Systemically Important Financial Market Infrastructures in South Africa

Citation: IMF Staff Country Reports 2022, 181; 10.5089/9798400214295.002.A001

• Download Figure
• Download figure as PowerPoint slide

7. The characteristics of the South African financial system (such as interconnectedness and fragilities of third-party service providers) could act as amplifiers to financial instability risks in the event of a cyber incident. The financial sector performs a critical function in the economy including allocating credit, facilitating settlement and payments and disruptions to these functions can cause financial instability. Characteristics such as a concentrated financial sector, a high level of interconnectedness and a lack of IT substitutability may act as amplifiers in the event of a cyber incident, transforming operational disruptions into risks to financial stability. It is therefore necessary to strengthen Fl’s ability to absorb operational risk-related events, such as cyber incidents, which could cause significant disruptions in financial markets.

B. Institutional Structure for Cyber Resilience

8. The SARB and PA are the leading public sector agencies in terms of strengthening cyber resilience for the financial sector. The SARB has responsibility for overseeing the stability of the financial system, the provision of liquidity assistance to FIs and oversight of the national payment system (NPS). Within the South African financial sector, cybersecurity and cyber resilience is critical for national financial stability. Given its role for overseeing financial stability, the SARB compiles a risk assessment matrix (RAM) that serves at the Financial Stability Oversight Committee⁹ and frames the analysis and assessment of the financial stability of the domestic financial system. Cybersecurity risks have featured as systemic risk in the RAM for the past two years. The SARB’s oversight and supervisory process of the payment system and FMIs is based on global standards and is risk-based and proportionate to the systemic risks posed by the supervised entity or system.

9. The financial sector recognizes the importance of developing cyber resilience and have implemented various measures. In addition to their established risk management processes, SIFIs have undertaken various initiatives to strengthen cyber resilience, including identifying and quantifying cybersecurity risks; implementing practices to protect most critical IT assets (i.e., ‘crown jewels’); develop intelligence-led defenses; collaboration and cooperation; and, engage in industry wide activities.

10. In terms of prudential supervision, cyber is a subset of operational risk which falls into the remit of the PA responsible for consolidated supervision. The PA is responsible for the prudential regulation and supervision of banks, insurance companies and capital market infrastructures (Mis).¹⁰ As part of its supervisory review, the PA monitors policies, processes, and practices related to cybersecurity risk and cyber resilience by regulated entities and further relies on outcomes of work done by independent parties such as internal and external audit as well as external cyber experts. The PA also conducts on- and off-site reviews through questionnaires, surveys, data center, walk-throughs,¹¹ and industry trend analysis.

11. The authorities responsible for the regulation, supervision, and oversight of FMIs include the SARB, PA and FSCA. The SARB’s National Payment System Department (NPSD) is responsible for the operations, oversight, supervision, and policy of payment systems. The PA is responsible for the supervision of capital market FMIs (CSD, SSS, CCP) from a prudential perspective. The FSCA is responsible for the supervision of CSD/SSS, CCPs and trade repositories from a conduct perspective. These responsibilities fall under the Financial Sector Regulation Act 9 of 2017 (FSRA), which is the overarching financial regulatory framework governing supervised financial firms. This Act specifies the financial sector regulators as the PA, FSCA, and Financial Intelligence Centre (FIC), while the SARB assumes an oversight function.

12. The Payments Association of South Africa (PASA) also has a key role in rulemaking. Under the NPS Act, the SARB was mandated to recognize a Payment System Management Body (PSMB), to organize, manage and regulate its members participating in the NPS. PASA is a self-regulatory body that develops legal constructs such as payment clearing house (PCH) agreements, clearing rules, and service level agreements. PASA also develops policies and position papers relating to clearing activities which are aligned to the overall NPS legislation.

13. There are well established mechanisms for domestic cooperation and coordination between the SARB and PA. To effectively detect and manage cyber-attacks on a national level, and thereby supporting financial stability, several cooperation platforms between authorities, sector CERTs,¹² and public and private businesses have been established. The SARB and PA have a mature framework for domestic cooperation and coordination across a range of topics that includes the area of cybersecurity and have entered into a number of MOUs for coordination of cross-border bank supervision with foreign authorities. Formal mechanisms exist for domestic sharing of information, coordination of activities, and working together across a range of topics. Protocols have been tailored for the risks associated with cybersecurity.

14. The SARB gathers threat intelligence through cooperation with other organizations and public sector agencies. Directive 2, issued by the PA in September 2019, requires banks to formally report material IT and/or cyber events and is currently the SARB/PA’s most direct source of cyber threat information. SARB is a member of the Central Bank and Regulator Supervisor Forum (CERES), which is a program of the Financial Services Information Sharing and Analysis Center, Inc. (FS-ISAC). SARB has also established a cyber resilience governance structure at the financial services industry level: the Cybersecurity Resilience Sub-committee (CRS), which is a sub-committee of the Financial Sector Contingency Forum (FSCF). The CRS meets quarterly to discuss pertinent cybersecurity matters within the financial sector and to monitor, evaluate and guide cybersecurity efforts. SARB also uses some open-source intelligence (OSINT) and subscription feeds for threat information and intelligence.

15. At the international level cyber threat information is shared by a malware information-sharing platform (MISP) driven by SABRIC which is maintained by the CERT-EU (France). South Africa is a member of the Community of African Banking Supervisors (CABS) that was established to assist regulators with the sharing of information or discussion of critical matters that have an impact across the African continent and/or other pertinent information. A CABS cyber-resilience subcommittee was recently established where the intention is to share information around cyber threats, intelligence gathering, cyber resilience supervisory frameworks, standards, and practices as well as any other information.¹³

16. In addition to the public sector mechanisms for information sharing, SABRIC plays a vital role for the private sector which connects with the public sector structures. SABRIC’s role is to ensure that their members are represented, contribute to and receive valuable insights from information shared by other participants, in the interest of creating cyber resilience within the financial services sector. SABRIC works closely with the Cybersecurity Hub in SA and with a mandate from members, intends to share information that can assist other sectors or Government, once the MISP, which is currently a proof of concept and includes commercial banks and insurers, is up and running. SABRIC has several stakeholder relationships that contribute to a data pool and perform global research, assisting with early detection of emerging trends so that they may alert members.

C. Cybersecurity Risk Regulatory Framework and Supervisory Practice Oversight Arrangements for FMIs

24. Authorities recognize the importance of cyber resilience and have issued regulatory instruments to set supervisory and oversight expectations for FMIs. Guidance Note 4 on the cyber resilience for FMIs was issued to the banking industry in 2017. The guidance is legally-binding. The PA is of the view that the principles and risk management categories are applicable to banks in addition to FMI, although since banks are not named in the guidance there is cause for some uncertainty. Additionally, the NPSD instructed all systemically important payment systems, through official correspondence, to implement and comply with the CPMI-IOSCO Guidance on Cyber Resilience for FMIs. The mission observed that the PA plans to issue a prudential or joint standard on cyber resiliency with the FSCA, which would be applicable to regulated financial institutions.

25. The NPS Act 78 of 1998 empowered the SARB to manage, administer, operate, regulate, and supervise payment, clearing, and settlement systems in South Africa. Amendments made in 2004 stipulated additional powers to withdraw the recognition of a payment system management body, designate settlement systems, enable payments to third persons, and issue directives. A major review of the NPS Act 78 of 1998 in 2018 further recommended that the SARB’s regulatory, supervisory and oversight responsibilities in the payment system and adoption of the PFMI be made explicit in the NPS Act, among others. As a CPMI member country, South Africa was expected to have formally adopted the PFMI by the end of 2012. The SARB has published a position paper and a supporting information paper broadly expressing its commitment to adopting the PFMI within the regulatory framework of the National Payment System as of September 2013. While the SARB could use moral suasion as a mechanism to effect change, it lacks formal powers to induce change or enforce corrective action in an FMI that is not complying with relevant regulations or policies relating to cyber resilience.

26. FMIs have started to implement the international guidance for cyber resilience and are at different levels of maturity.²⁰ At the time of the mission, the SARB’s NPSD Risk Division was in collaboration with the Cyber and Information Security Unit to formalize a cyber resilience framework for the SAMOS and SADC-RTGS. BankservAfrica completed self-assessments on cyber resilience and identified remedial actions for the retail payment system. STRATE has plans to align its cyber resilience framework with international standards, having used the frameworks established by NIST and the Center for Internet Security.

27. FMI critical service provider assessments have been implemented inconsistently across FMIs. While oversight expectations are clear and self-assessments forthcoming for messaging providers (SWIFT) where a foreign authority serves as the lead overseer, further improvements could be made for information technology providers or other third-party service providers that have been identified as critical service providers. Such identification would indicate what is considered non-essential services and clarify if certain utilities (such as basic telecommunication services and electricity) would fall under the category of critical service providers to FMIs in the context of South Africa. The mission observed that in one case, multiple external suppliers and vendors were reported but without identifying if they were critical service providers to the FMI.

PA’s Regulatory Framework for Cybersecurity

28. The PA has a long history of implementing a principles-based regulatory framework for cybersecurity based on global standards. Cybersecurity is a subset of operational risk containing general requirements for risk management and governance. Specifically in relation to cyber, however, Guidance Note 4 of 2017 refers to cyber resilience for FMIs and was issued to the banking industry, representing the PA’s expectations. The PA relies upon the principles in this Guidance Note—as set out by the CPMI and IOSCO—as applicable to the banking industry. This Guidance Note is complemented with several targeted guidance materials. The complete regulatory framework for cyber for FIs is below (Figure 2).

Prudential Authority’s Regulatory Framework for Cyber for Financial Institutions

Citation: IMF Staff Country Reports 2022, 181; 10.5089/9798400214295.002.A001

• Download Figure
• Download figure as PowerPoint slide

View Full Size

Prudential Authority’s Regulatory Framework for Cyber for Financial Institutions

Citation: IMF Staff Country Reports 2022, 181; 10.5089/9798400214295.002.A001

• Download Figure
• Download figure as PowerPoint slide

Prudential Authority’s Regulatory Framework for Cyber for Financial Institutions

Citation: IMF Staff Country Reports 2022, 181; 10.5089/9798400214295.002.A001

• Download Figure
• Download figure as PowerPoint slide

Main Findings and Recommendations Pertaining to the Regulatory Framework

29. The mission recommends the PA moves toward a consistent regulatory framework (based on prudential standards) for cyber regulation. While guidance notes have been used by the PA historically, the mission recommends the PA move toward a consistent multi-sectoral regulatory framework (based on prudential standards) for cybersecurity and operational resilience. The production of prudential standards rather than a guidance note will strengthen the application and enforceability to influence behavior through the full weight of the regulatory framework. The use of prudential standards will also signal to industry the importance of this topic. The recent publication of the BCBS’s “Principles for Operational Resilience and the revision of the Principles for the Sound Management of Operational Risk” gives the PA the opportunity to codify this guidance into regulation for consistency, enforceability, applicability of the regulations to bring about changes in behavior of firms, to get them to fully internalize systemic risks into higher standards of risk management consistent with the SA’s / PA’s expectations risk tolerance consistent with financial stability responsibilities.

30. The mission recommends the revised National Payment System Act be expedited into law to further establish explicit regulatory, supervisory and oversight powers for the SARB. This would form the basis for formally adopting the CPMI-IOSCO PFMI, observing the CPMI-IOSCO Guidance on Cyber Resilience for FMIs, and identifying and overseeing critical service providers to systemically important PS. For the latter, this would cover risk identification and management, robust information security management, reliability and resilience, effective technology planning, and strong communication with users.²¹ Explicit powers would enhance the SARB’s ability to obtain timely information and to induce change or enforce corrective action if an FMI is not complying with relevant regulations or policies.

31. The mission recommends formalizing the cyber resilience frameworks for all systemically important FMIs with metrics for benchmarking. This is applicable for the SAMOS, SADC-RTGS, STRATE, and JSE Clear. Metrics and maturity models would allow the FMIs to benchmark and assess its cyber resilience maturity against a set of predefined criteria, such as operational reliability objectives. Benchmarks would require FMIs to analyze and correlate findings from audits, management reviews, incidents, recovery time objectives, near misses, tests, and exercises as well as external and internal intelligence gathered. Also, such metrics help identify gaps in the cyber resilience framework for remediation.

32. The mission recommends that all FMI critical service providers, in addition to messaging providers, should be assessed against the CPMI-IOSCO Assessment Methodology for the Oversight Expectations Applicable to Critical Service Providers. Ratings could be considered in the annual self-attestations submitted by FMI CSPs to support the continuation of critical services for the FMIs and external audits should be completed against acceptable national or international standards. This could safeguard against risk from other critical service providers, particularly information technology firms and/or third-party service providers, that performs, on a continuing basis, activities essential to the operations of the FMI. The continuous, secure, and efficient delivery of these services bythe third-party service provider maybe critical to the operations of the FMI or, in some cases, multiple FMIs. Furthermore, a rating for each oversight expectation can be assigned and applied to reflect the gravity and urgency of the need to remedy identified issues of concern.

Supervision Arrangements of the PA

33. The PA implements a risk-based approach to supervising cybersecurity risk, employing a mix of off-site and onsite analysis. The PA follows a risk-based approach to supervising cybersecurity risk and has a long history of supervising operational risk and IT security risk (see Figure 3 for a summary of the PA’s approach to IT Risk supervision).²² The PA conducts detailed institution specific assessments of SIFI’s business continuity plans (BCPs) with a focus on operational resilience. The PA follows a thorough approach to assessing operational risk of which BCPs are included. The PA expects BCPs to be developed with operational resilience in mind, such that banks and FMIs take into account the unavailability of third-party providers under various scenarios in order to be able to fulfill their obligations in the event of a cyber incident or other operational disruptions.

Prudential Authority’s Approach to Information Technology Risk Supervision

Citation: IMF Staff Country Reports 2022, 181; 10.5089/9798400214295.002.A001

• Download Figure
• Download figure as PowerPoint slide

View Full Size

Prudential Authority’s Approach to Information Technology Risk Supervision

Citation: IMF Staff Country Reports 2022, 181; 10.5089/9798400214295.002.A001

• Download Figure
• Download figure as PowerPoint slide

Prudential Authority’s Approach to Information Technology Risk Supervision

Citation: IMF Staff Country Reports 2022, 181; 10.5089/9798400214295.002.A001

• Download Figure
• Download figure as PowerPoint slide

34. Cybersecurity risk supervision is a subset of the PA’s risk-based approach to operational risks. The PA’s overall approach is a mix of onsite and offsite analysis. Line supervisors collect material throughout the supervision cycle used as inputs into an onsite examination. In addition to the routine reporting, the PA has implemented a ‘Flavor of the Year’ questionnaire to facilitate a deep dive on a specific topic, of which cyber has been a recent focus. The supervisory cycle for SIFIs is typically between one to two years for an onsite examination of operational risk.

35. For SIFIs (the five largest banks), the PA will undertake a two to three-day onsite examination of operational risk. Pre-visit material is requested and evaluated by the PA prior to the onsite. The onsite will cover all aspects of operational risk such as: third-party risk management, disaster recovery, business continuity, governance, etc. Cybersecurity risk will be covered in all operational risk onsite examinations for SIFIs and will consist of a dedicated session with bank management evaluating the issues identified during off site analysis such as: internal audit reports and results of work undertaken by the external auditor. To date, the PA has relied mainly on supervisors with an operational risk background to undertake onsite examinations and recently hired a cyber expert to complement the existing team of operational risk specialists.

36. The PA plans to enhance the information gathering process by implementing an annual questionnaire to be completed by SIFIs. The questionnaire is designed to assess the institution’s cybersecurity posture and maturity. The design of the questionnaire leverages global best practice and will be an input into the PA’s risk-based approach to supervision.

Main Findings and Recommendations Pertaining to the Supervisory Approach

37. There is scope to strengthen cybersecurity supervision and oversight, for which additional resources are needed. There is need for greater supervisory intensity and, in particular, onsite examinations. This would help ensure supervisors are armed with sufficient knowledge, skills, time, and support to challenge management decisions. To get more out of each visit, major factual discoveries should take place before the visit. A program—based on a cybersecurity questionnaire evaluating maturity such as the cyber resilience questionnaire²³ (CQUEST) used in the UK or TIBER-EU—would help inform preparation for the examination in advance, as would penetration-testing (firm’s own or regulator-led).²⁴ With this information pre-analyzed, onsite conversations could focus on issues identified and to explore threats and vulnerabilities in more depth.

38. To support greater frequency and intensity of supervision, the mission recommends additional specialist resources. Recruitment of additional cybersecurity risk specialists, to allow more time during on-sites, which should be at least annual for SIFIs. The addition of risk specialists will provide an opportunity for the PA to provide regulated entities with benchmarking of industry experience and risk management standards to assist with prioritization. Furthermore, this will allow the PA to shift its reliance away from outcomes of work completed by independent parties (such as internal and external audit as well as external cyber experts) to onsite work conducted by in-house risk specialists.

39. The mission recommends monitoring the compliance of SAMOS and SADC-RTGS participants with the mandatory controls of the SWIFT Customer Security Program, and ensuring self-attestations are audited. This should aim to protect the endpoint security of wholesale payments. Cooperation among the relevant FMI and banking authorities would be necessary to exchange information in relation to SWIFT CSP compliance.

D. Third-Party Vulnerabilities and Vendor Risk Management

40. Third-party service providers play an integral role for South African SIFIs. Part of a FIs technology supply chain include third-party vendors which can be classified into two broad groups: (i) vendors common across the entire financial sector, e.g., PASA, Visa/Mastercard, SWIFT messaging network, credit bureaus and utility providers (such as telecommunication and electricity); and (ii) vendors specific to a particular FIs, e.g., software and hardware providers, internet service providers, etc.

41. The SARB has identified the following payment FMIs as SIPS in terms of the PFMI criteria: The South African Multiple Option Settlement (SAMOS) system which is a real-time gross settlement (RTGS) system owned and operated by the SARB. A retail payment system that clears retail transactions in respect of all the payment streams, excluding the card stream, owned and operated by Bankserv Africa. A large value payment system that clears the delivery and payment legs of equities, bonds, and money market transactions, owned and operated by Strate (Pty) Limited. CLS system, which settles foreign exchange transactions in designated currencies, including the ZAR— owned and operated by the CLS Bank International. SADC-RTGS system, which settles cross-border transfers that require immediate settlement—owned by SADC central banks and operated by the SARB.

42. To manage dependencies on third-party service providers, FIs have implemented an enterprise-wide approach to governance and risk management. FIs recognize the need to manage dependencies effectively and employ a range of risk management practices, including:

• Identifying and cataloguing all critical vendors, via full mapping of systems, infrastructures, and suppliers;

• Implementing self-identified maturity gap analysis;

• Service level agreements (SLAs) in legal contracts to test and manage resilience of critical service providers;

• Ongoing monitoring and measuring of the performance of vendors against SLAs; and

• Disaster recovery fail overs tested regularly (e.g., quarterly).

43. While dependency on third-party providers is not unique to South Africa, in some cases these providers exhibit high levels of concentration, low substitutability, and fragilities (outside of scenarios of cyber incidents) which could act as amplifiers in the event of a cyber incident. Management of third-party service providers is a priority, particularly where the Fl does not have leverage to negotiate with large global ICT service providers. In terms of the utility service providers, there are vulnerabilities and fragilities, some of which are specific to South Africa, in particular telecommunications and electricity.

44. The SARB undertook an integrated mapping initiative to map the markets and payments systems to provide insights into cyber resilience. A “cyber map” identifies the main technologies, services, and connections between financial sector institutions, service providers, and in-house or third-party systems. At a conceptual level, mapping aims to highlight key financial and technological connections between financial institutions (including FMIs) and between these firms and third-party technology and service providers. Even a basic map will identify systemic institutions, service providers, and technology providers and their relationships in the financial system and thus provide a valuable reference for supervisors to identify key vulnerabilities and allocate resources.²⁵ There is currently no single high-level view of the end-to-end South African financial sectorv is a vis financial and cyber networks. To address this gap, the SARB contracted a service provider to develop a high-level map for the national payment and market systems. The aim of the mapping exercise is fourfold:

• Defining the critical services executed by the financial sector;

• Collecting data on systematically important institutions;

• Identifying the critical system used to carry out the critical services; and

• Mapping the connections between the institutions.

45. At the time of the mission, the SARB and PA were researching options to take forward the mapping exercise. While conceptually appealing, the dynamism and complexity of the financial sector and the technologies it uses can make cyber mapping challenging. It can be expensive and time-consuming to build detailed maps. However, mapping exercises that do not aspire to completeness and apply thresholds for inclusion, as well as qualitative approaches, have proved to be a useful tool. Cyber mapping is nascent across national supervisors though some have commenced this effort. The initial mapping exercise was still in development at the SARB and PA with next steps to be determined.

E. Response and Recovery Capabilities

47. The SARB plays a pivotal role in the response and recovery framework. The SARB has established a cyber-resilience governance structure at the financial services industry level, namely the Cybersecurity Resilience Sub-committee (CRS), which is a sub-committee of the Financial Sector Contingency Forum (FSCF). The primary objective of the CRS is to monitor, evaluate and guide cybersecurity efforts within the financial sector, including national structures and other critical service providers by:

• Fostering trust and collaboration: and

• Facilitating joint initiatives reinforcing the operational resilience of the financial sector.

48. The CRS is a key mechanism for threat information-sharing and collaboration between public and private sector stakeholders. The CRS meets quarterly to discuss pertinent cybersecurity matters within the financial sector. Participants include the PA (as regulator), SARB, national financial structures and associations, commercial banks and insurers. While all cyber incidents need to be reported to the PA, the CRS adds an additional layer of information sharing specifically related to cyber. In addition to the CRS, the local banking industry collaborates through SABRIC and the National Cybersecurity Hub to develop and assist with intelligence gathering and knowledge sharing. The CRS is the main hub by which escalation of cyber incidents will occur and whereby response and recovery decisions will be coordinated. The structure for coordination and escalation contains several committees between the FSCF and the Government. In the event a cyber incident is designated systemic, however, there is a potential short-cut for the FCFS to escalate cyber incidents to the FSOC/ Government/ Governor.

49. Mechanisms and processes for cross-border coordination and cooperation are less developed. While there are plans underway to facilitate information sharing cross-border, there is currently no or limited sharing of information with other jurisdictions. South Africa is a member of the CABS that was established to assist regulators with the sharing of information or discussion of critical matters that have an impact across the African continent and/or other pertinent information. While various activities have been initiated, processes and protocols to encourage cyber resilience remain at early stages, such as cybersecurity crisis management exercises.

50. SIFIs are strengthening internal response and recovery protocols that help maintain critical business functions during disruptions, such as through penetration testing. SIFIs have raised recovery and response capabilities to a main priority as part of risk management frameworks for cyber resilience conducting in-house cyber-attack simulations as part of crisis management exercises. Simulations and crisis exercises are continually updated and informed by incidents (such as the October 2019 industry-wide DDoS attack on internet infrastructure). Threat-led penetration tests are typically conducted on a periodic basis with the results feeding back into cybersecurity risk management frameworks.

51. Each institution in the financial sector has an independent responsibility for ensuring acceptable risk in their own business. This includes, among other things, the responsibility for secure and stable operating solutions, good backup and emergency solutions and actively contributing to a robust financial infrastructure. Assessment of the business continuity management of FIs and FMIs are done as part of the PAs risk assessment and on-site inspections, and through oversight assessments against Principle 17 of the PFMIs. Firms are required to monitor and test their capabilities regularly such as disaster recovery and business continuity plans and more sophisticated risk management such as penetration testing.

52. FMIs have largely set recovery time objectives at two hours with end-of-day settlement following disruptive events, but actual experiences present implementation challenges. Prolonged power outages could disrupt the FMI and/or other entities that have interdependencies with the FMI (such as other FMIs, settlement banks, liquidity providers, service providers). While most SIPS closely align with the two hours recovery time objective, this is varied for the retail payment system where multiple time objectives could be set by banks for different payment and settlement services. As payments increasingly move towards near real-time environments for retail transactions and cross-border for both retail and large-value payments, this presents a challenge on setting clear and achievable recovery time objectives in the context of fast-moving cyber incidents where settlements must be achieved by end-of-day.