BA KO ES F GH A NA N T. 1 9 5 7 LAUNCH OF THE CYBER SECURITY DIRECTIVE FOR FINANCIAL INSTITUTIONS A SAFER DIGITAL FINANCIAL INDUSTRY SPEECH BY DR. MAXWELL OPOKU-AFARI, FIRST DEPUTY GOVERNOR, BANK OF GHANA BANK OF GHANA HEAD OFFICE, ACCRA OCTOBER 22, 2018 Honorable Minister of Communications, Mrs. Ursula Owusu-Ekuful, Second Deputy Governor, Bank of Ghana, Members of the Board, Bank of Ghana, Heads of Banks, Members of the Ghana Association of Bankers, Members of the Ghana Association of Savings and Loans, Members of the Ghana Association of Microfinance Institutions, Members of the Chartered Institute of Bankers, Staff of Bank of Ghana, Distinguished Members of the Press, Ladies and Gentlemen, all protocols observed. 1. Good afternoon Ladies and Gentlemen. It is a pleasure to welcome all of you to the Bank of Ghana and I deem it a great honour for having such august audience joining us for this special occasion. As we are all aware, today marks another significant milestone in the history of Ghana’s financial sector as we launch the Cyber Security Directives for Financial Institutions. 2. After careful consideration on issues regarding cyber security and its implications on financial intermediation, the Bank chose the theme “A Safer Digital Financial Industry” to launch the Cyber Security Directives for two main reasons. First, we envisage that this theme will shape the strategic direction in terms of cyber security of the banking industry and to the larger extent, the entire financial sector. And secondly, it signals the collective efforts of stakeholders to address the canker of cyber threat and all other actions that exploit vulnerabilities of the financial systems and processes. 3. Currently, technology is intertwined with our everyday lives. It is re-defining business interconnectedness processes, between promoting countries and greater peoples, enhancing skill development and innovation, and more broadly, breaking down perceived barriers in every sector. In the banking sector, for instance, technology has taken a center stage in the financial intermediation process. Recently, key developments within the intermediation process include the growing importance of FinTechs in delivering financial services as well as the introduction of electronic payment platforms to enhance interoperability. In effect, the continuous role played by technology has had considerable impact on the operations of financial institutions and ultimately driven policies aimed at promoting financial inclusiveness for growth and poverty reduction. 4. In all of these developments, financial services remains critical and the Bank of Ghana has established, as a major policy priority, the development of a sound financial system with strong individual component institutions. The idea is to position the sector as a major growth driver, to support an inclusive broad-based economy with the full implementation of new higher minimum capital requirements by the end of this year. We know that banks are working strenuously to meet this requirement which would help establish a banking industry that is well capitalized to support the much needed economic transformation Ghana needs. 5. As the Bank of Ghana pursues this objective, alongside strengthening the regulatory and supervisory environment to restore confidence and promote stability and integrity of the banking sector, it is important that we also take concrete steps towards implementing cyber security measures to combat financial crime. Through the Bank’s monitoring systems, we have observed the daily attempts by cyber criminals to bypass security controls and exploit vulnerabilities within the cyber and information security defenses of financial systems. We cannot ignore the fact that the increasing use of technology with its attendant interconnectedness has enabled some of these challenges. 6. Globally, risks associated with cybercrime on financial systems have increased, notable among them are the financial disruptions arising from cyber-incidents in Bangladesh and Malaysia. Indeed, cyber-attacks have the potential to pose systemic risk by disrupting business operations within the financial sector. For Ghana, the threat is growing. A recent study in 2016 disclosed that there were more than 400,000 Malware incidents, 44 million Spam incidents, and 280,000 Bot incidents within Ghana’s financial industry. 7. With this background and the complexities associated with the advancement of technology, it is imperative that the Bank of Ghana takes steps to counter these threats to ensure the integrity and operational security of the financial system. It is in this regard that the Bank of Ghana has developed the Cyber Security Directive for Financial Institutions. The objectives of this Directive are to ensure an uninterrupted financial intermediation process through a robust and resilient financial sector and also to boost the trust and confidence of consumers in the banking industry. 8. Ladies and Gentlemen, we will all agree that the resilience of the financial sector is largely dependent on the soundness of financial institutions and the robustness of the financial market infrastructure. The Cyber Security Directive for Financial Institutions does not fall short of addressing these objectives. Among others, the Directive seeks to establish the conduct and operational guidelines for the cyber and information security environment. Specifically, it sets out procedures for governance, risk management, internal audit, asset management, cyber defense, and cyber response, among others. 9. All of us in the industry have key roles to play in the implementation of this Directive. One unique characteristic of this directive is the required active involvement of senior management executives and boards of financial institutions. All banks are to appoint a Cyber and Information Security Officer (CISO) who would advise senior management and the board on cyber security issues, and also formulate adequate measures to manage cyber and information security risks. 10. A key component of the measures to be deployed by the CISO is the training and education of all stakeholders. Colleagues, it takes an individual to click on an email attachment for a virus to be introduced into the system of an organization, but the whole organization and sometimes the entire nation may also suffer the unintended consequences of this singular action. Therefore, another crucial element of the Directive is the creation of an enabling framework for the efficient information sharing among stakeholders, for example between financial institutions and regulators, and among financial institutions as well. 11. In line with the National Cyber Security Awareness Month (NCSA) therefore, the Bank of Ghana is today, launching the Cyber and Information Security Directive for the financial industry. Subsequent to this launch, banks would be required to follow an implementation schedule to ensure that effective cyber security controls are in place to counter any threats of cybercrime. 12. Ladies and Gentlemen, as I conclude this speech, I would like to reiterate the need for collaboration among key stakeholders in the fight against cyber-crime. We need not only implement these Directives, but also collaborate with each other in the industry to overcome the threats of cybercrime. As bankers, we must incorporate cyber security in our daily activities and imbibe these Directives in the policies and procedures of our individual financial institutions. Cyber threat is continuously evolving, and as custodians of the financial sector, let us all embrace the Cyber Security Directive and work assiduously to ensure its success. 13. Thank you for the attention.