In advance of the European Anti-Financial Crime Summit taking place in Dublin tomorrow at the RDS, the Compliance Institute is calling on Ireland’s financial services organisations to ramp up their efforts in getting up to speed on their obligations under new EU rules and the enforcement of the Digital Operations Resilience Act (DORA).
Published in the Official Journal of the EU on December 27, 2022, DORA is set to be fully applicable from January 2025 onward and establishes a regulatory framework for digital operational resilience in the financial sector. This Directive addresses the digital operational risk of financial entities regulated by the Central Bank of Ireland and is the first of its kind aimed at preventing and mitigating cyber threats.
According to a recent survey from the Compliance Institute, almost one in three (32pc) financial service organisations in Ireland have not yet begun to prepare for new EU rules which will help them prevent and mitigate cyber-attacks – one of the most prevalent types of financial crime in Ireland, despite it being only seven-and-a-half months before the new rules come into force.
Commenting on the findings, Michael Kavanagh, CEO of the Compliance Institute said:
“This Summit is an important date in the financial services sector calendar for 2024. The forum fosters and prompts discussion and debate on some of the biggest challenges facing Ireland’s financial organisations.
Ireland is now Europe’s largest data hosting cluster, putting the need for elevated cybercrime and data protection systems into sharp focus. Regulators need to ask themselves how they can regulate and supervise without stifling innovation. Businesses and organisations need to ask how they can best prepare and respond, and the general public also needs to know what measures they can take to protect themselves”.
Cybercrime
In a separate survey conducted by the Compliance Institute of 230 compliance professionals in financial services organisations nationwide at the end of 2023, hacking, phishing, online scams, and other variations of cybercrime were found to be the most prevalent financial crimes in Ireland (See Appendix).
Mr. Kavanagh went on to say,
“Cybercrime is developing and advancing at a pace so fast that organisations and legislators cannot keep up. These attacks can have catastrophic consequences not just for those whom they are perpetrated against, but for the wider public. We only have to look at the devastation that was caused to patients following the 2021 hacking of the HSE to understand the severity of the crimes.
Regulators in Ireland, and around the world, are constantly updating and issuing new guidance to firms in response to emerging cyber security issues, such as fake documentation and the reliability of information sources”.
DORA
Mr. Kavanagh explained,
“The main objective of DORA is to prevent and mitigate cyber threats and ensure that financial entities can withstand, respond to, and recover from all types of ICT-related disruptions and threats. So, there are clearly huge benefits and protections in store for both financial institutions and consumers alike as a result of these new rules coming on board – provided the rules are complied with”.
Other headline findings from the Compliance Institute survey reveal that:
- More than half (54pc) of compliance professionals in the financial services sector have limited awareness of the new rules
- About one in eight (14pc) have no awareness of the new rules
- Less than half (46pc) are familiar with the new rules.
Mr Kavanagh added:
“Figures published by the Banking & Payments Federation Ireland (BPFI) earlier this year show there was a 26pc jump in fraudulent scams in the first six months of 2023. The particular scams involved here were authorised push payment (APP) fraud, involving online and mobile banking transfers, with victims conned out of a total of €8.6 million in the first half of 2023.
While the internet and tech are woven into the very fabric of our lives and have brought untold benefits to how we live our lives, they have also brought many dangers. And it’s incumbent on all financial institutions to educate themselves on – and take – the steps necessary to protect themselves and their consumers as much as possible from the dangers of cybercrime. The rules laid out under DORA have been designed with this objective in mind. We would hope that the next few months will see a bridge in the knowledge gap that currently exists around DORA and what it means for Irish organisations. It is important that all businesses and financial services organisations play their part and follow the lead of regulators so that they – and the wider economy – are in a position to withstand the growing incidence and severity of cybercrime.”
