Source: in-cyprus.philenews.com
Cybersecurity, operational resilience and accountability at board level are increasingly important to maintaining trust in digital financial services, experts told the Forbes Cyprus Next Gen Banking & Fintech Summit in Limassol on Tuesday, warning that preventing cyberattacks alone was no longer sufficient.
As banks and fintech companies become more dependent on cloud services, external technology suppliers and artificial intelligence, they must ensure that critical financial services can continue operating during disruptions and that responsibility for managing risks remains clearly defined, the panellists said.
The discussion, titled Trust and Security in Digital Finance, brought together Solon Houtris, Chief Information Security Officer at XM, Nicholas Kattirtzis, Head of Advisory – GRC at Odyssey Cybersecurity, and Andreas Michaelides, Partner at Scordis, Papapetrou & Co LLC.
Moderating the panel, Ioannis Georgoulas, Chairman of the Cyprus Association of Electronic Money and Payment Institutions (ACEMPI), identified trust as the central issue for financial services.
He said maintaining confidence in the banking sector required institutions to address two major categories of risk: credit risk and technology risk.
XM: Outsourcing does not remove responsibility
Houtris warned that financial institutions remain responsible for the security of their operations even when they depend on external technology providers.
“Outsourcing or delegating an operation does not also outsource or transfer the risk or the regulatory obligation,” he said.
He explained that banks and fintech businesses increasingly relied on cloud providers, software vendors and other external partners, making effective oversight of those relationships essential.
Security assessments should begin before contracts are signed and continue throughout the business relationship, he said.
Companies should also establish contractual safeguards, monitoring procedures and contingency plans to deal with security failures or the sudden loss of a supplier.
Houtris warned that the development of artificial intelligence was making this task more complex, as financial institutions increasingly depended on AI models, automated systems and additional technology providers.
He also highlighted the speed of modern cyberattacks, arguing that security teams needed greater automation to detect threats and respond before attackers could compromise other parts of an organisation’s network.
Odyssey: Services must continue during cyber incidents
Kattirtzis said the EU’s Digital Operational Resilience Act (DORA) had changed the approach financial institutions should take towards cybersecurity.
Rather than concentrating solely on protecting computer systems, organisations needed to demonstrate their ability to withstand disruptions, recover from incidents and continue providing essential services.
“It’s not simply about restoring the IT system. It’s about making sure that the service continues,” he said.
He argued that financial institutions must test their recovery capabilities rather than relying exclusively on documented procedures and assurances that their systems were secure.
Management should know how long critical services could remain unavailable, how quickly they could be restored and whether recovery targets had been met during testing.
Kattirtzis also stressed the importance of maintaining evidence of security controls and coordinating regulatory compliance requirements to reduce the administrative burden on cybersecurity teams.
Legal risks and directors’ responsibilities
Michaelides focused on the legal consequences of cybersecurity failures, warning that companies and their directors could face scrutiny over whether they had exercised adequate oversight before an incident occurred.
“The company and the board will be judged on what they did or what they failed to do before the incident,” he said.
He argued that board members should actively question those responsible for cybersecurity, ensure their concerns and decisions were recorded, and understand the protection offered by cyber insurance policies.
Michaelides also highlighted Cyprus’s legislative arrangements for implementing DORA, saying that domestic legislation addressing enforcement and penalties had not yet been enacted.
He warned that breaches of cybersecurity obligations could expose businesses and, in certain circumstances, individuals to significant legal consequences once the relevant provisions were in place.
Following an attack, prompt reporting to the appropriate authorities, preservation of evidence and careful management of insurance obligations were essential, he added.
Read more: