Third-party risks emerge from direct relationships between financial institutions and their vendors or service providers, fourth-party risks arise from the subcontractors of these third parties. Do your supplier relationships look a little like the image, and do you really understand who is dependent on who?

Regulators cannot possibly stay ahead of cybercriminals and it’s simply not realistic to expect them to. Regulations can lag years behind criminal innovation, and like the picture I asked our AI to create for this post, we face an indestructible enemy. If you’re C-suite, start thinking about the regulatory requirements for security as the floor, and then ask yourself “how much do we need to invest to stand up?”

As I said in my post last week: “The operational resilience requirements in the UK share common objectives with the EBA guidelines for Information and Communication Technology (ICT) security risk management, and the requirements laid down by DORA in the EU.” It made sense to me to follow up with a piece on the EBA guidelines.

Ensuring that firms can prevent, respond to, recover, and learn from operational disruptions is something worth investing in.

In recent months, the FCA have sent out Dear CEO letters to the wholesale broking and payments sector. In these letters they highlighted (amongst other things) AML deficiencies within both sectors

The implementation date for open products is fast approaching, with firms required to implement the rules for open products and services (those open to new sale or renewal) by end July 2023.