Skip to main content
OCC Flag

An official website of the United States government

OCC Bulletin 2016-18 | June 7, 2016

Cybersecurity of Interbank Messaging and Wholesale Payment Networks: FFIEC Statement

To

Chief Executive Officers of All National Banks, Federal Branches and Agencies, and Federal Savings Associations; Technology Service Providers; Department and Division Heads; All Examining Personnel; and Other Interested Parties

Summary

The Federal Financial Institutions Examination Council (FFIEC), on behalf of its members,1 today issued the attached statement, in light of recent cyber attacks, to remind financial institutions of the need to actively manage the risks associated with interbank messaging and wholesale payment networks. Financial institutions should review their risk management practices and controls over information technology (IT) and wholesale payment systems networks, including authentication, authorization, fraud detection, and response management systems and processes. The statement emphasizes that participants in interbank messaging and wholesale payment networks should conduct ongoing assessments of their ability to mitigate risks related to information security, business continuity, and third-party provider management.

Note for Community Banks

This guidance is applicable to all OCC-supervised institutions that use interbank messaging and wholesale payment networks either directly or through service providers.

Highlights

In accordance with existing regulatory expectations and FFIEC guidance, national banks and federal savings associations should take appropriate risk mitigation steps, including

  • conducting ongoing information security risk assessments.
  • performing security monitoring, prevention, and risk mitigation.
  • protecting against unauthorized access.
  • implementing and testing controls around critical systems regularly.
  • managing business continuity risk.
  • enhancing information security awareness and training programs.
  • participating in industry information-sharing forums.

Further Information

Please contact the Operational Risk Division at (202) 649-6550.

 

Bethany A. Dugan
Deputy Comptroller for Operational Risk


1 The FFIEC comprises the principals of the following: The Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, National Credit Union Administration, Office of the Comptroller of the Currency, Consumer Financial Protection Bureau, and State Liaison Committee.

Related Link

Topic(s):