FMA warns:

IT risks in finance mostly from third-party providers

FMA Executive Director Eduard Müller sees the reasons for the problems in the outsourcing of many services.

According to an analysis by the Financial Market Authority (FMA), digital risks for financial institutions in Austria mainly come from third-party service providers. Two thirds of serious IT incidents come from external providers, according to the regulator.

In contrast, the dreaded hacker attacks only account for around four percent of ICT incidents in the financial sector, said FMA Executive Director Eduard Müller at the Club of Economic Journalists on Wednesday. According to the FMA analysis, external system errors, which are mostly attributable to purchased services from external providers, account for three quarters of serious incidents in the ICT sector.

"Digitalization is complex, so a lot of things are outsourced," says Müller. These are often "trivial causes that can have huge consequences". Müller cited a mobile network failure as an example, which can lead to telebanking no longer being possible due to the failure of the banks' SMS services.

Cloud solutions harbor concentration risks
The increasing use of cloud solutions - which mostly come from non-European providers - is also increasing dependencies. In the meantime, 95% of the institutions supervised by the FMA already use such solutions. This creates "enormous concentration risks", said Müller.