US regulator warns on growing cyber risks for banking sector

In its semi-annual report the Office of the Comptroller of the Currency (OCC) has highlighted cyber risk as a key area of concern for banks and financial institutions, saying that it will make this theme a priority over the coming months. Amongst the specific risks faced by these institutions, the OCC highlights the increase in numbers and sophistication of bank malware and the sale of zero-day vulnerabilities, as well as increasingly sophisticated BEC ('business e-mail compromised') campaigns. The OCC points out that "business operating models are under increasing pressure as bankers seek to launch new products, leverage technology, reduce staffing, outsource critical activities, re-engineer business processes, and partner with firms unfamiliar with the bank regulatory environment."

The Office of the Comptroller of the Currency will make credit risk and cyber risk a focus over the coming months, the agency said in its Semiannual Risk Perspective report released today. The OCC noted an increase in threats from these areas, and added that strategic risk, compliance risk and interest rate risk are also key areas of concern.

According to the report, the persistent low interest rate environment has contributed to slow growth and low rates of return for banks, leading many to reassess risk tolerance and extend their reach for yield. At the same time, the industry has seen an easing of credit underwriting standards as banks fight to remain competitive, most noticeably in high-growth loan segments like commercial and industrial, indirect auto loans and multifamily commercial real-estate. These practices could leave the industry less prepared to absorb shocks or handle future economic uncertainties, the OCC warned.

Cyber crime also poses a threat to the financial industry as new threats continue to evolve, the agency said. Many banks are quickly adopting new preventive technologies or partnering with new vendors to protect themselves from fraud, and the report warned that risk management and control practices might not be keeping pace with the rapid changes in these areas, contributing to a heightened level of operational risk for banks of all sizes.