The European Central Bank (ECB) has revealed plans to carry out a cyber resilience stress test on 109 directly supervised banks in 2024. The primary objective of this test is to assess the banks' capacity to respond and recover from a potential cyberattack.
As per the ECB's website, "cyber resilience" is characterized as "the ability to protect electronic data and systems from cyberattacks as well as to resume business operations quickly in case of a successful attack." The ECB regards cyberattacks as a significant risk for banks, financial institutions, and financial market infrastructure. The bank further explains that, "Given the high level of interconnectedness within the financial sector, they can also pose a threat to the stability of the overall financial ecosystem."
A 2021 report by the International Monetary Fund titled "The Global Cyber Threat," highlights an incident where hackers targeted Bangladesh’s central bank in 2016. They attempted to steal $1 billion by exploiting weaknesses in the SWIFT financial system. Despite most transactions being blocked, the hackers managed to abscond with $101 million. The report indicates that, "The heist was a wake-up call for the finance world that systemic cyber risks in the financial system had been severely underestimated."
According to an ECB press release, it intends to simulate a cyberattack that would disrupt each bank's daily business operations. This approach aims at testing established response and recovery measures such as emergency procedures and contingency plans, and assessing how swiftly they can return to normal operations. Post-test evaluations will be conducted by supervisors on how well their respective banks withstood the cyberattack. The ECB announced that it will incorporate these results into its 2024 Supervisory Review and Evaluation Process which will enable bank supervisors to discuss outcomes and insights gained from this exercise.
In another press release issued by the ECB, it was noted that stress tests are conducted annually and participate biennially in an EU-wide test organized by the European Banking Authority. Previous tests have examined various risks, including interest rate risk, liquidity risk, and climate risk.