## 1islea2023007 - EXECUTIVE SUMMARY

## Source details

**Canonical URL:** [1islea2023007 - EXECUTIVE SUMMARY](https://www.imf.org/-/media/files/publications/cr/2023/english/1islea2023007.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/cr/2023/english/1islea2023007.pdf.md)
- [Structured JSON version](/-/media/files/publications/cr/2023/english/1islea2023007.pdf.json)

---

### System-wide context and payment landscape
- The Icelandic financial system is "large, concentrated and interconnected - banks and Non-Bank Financial Institutions (NBFIs) - domestically and internationally."
- Structure:
  - "10 banks: 4 commercial banks and 6 savings banks."
  - "Three of the commercial banks (Arion banki, Íslandsbanki and Landsbankinn) together account for 95 percent of banking assets."
- Payment behavior and dependencies:
  - "Cash use is declining" and electronic payment reliance is increasing.
  - "98% of respondents who shop at points of sale on a weekly basis or more often use electronic payment instruments" (Gallup survey, spring 2022 for the CBI).
  - "Almost all (98.6%) electronic payments at point of sale are card payments, of which 37.8% are digital cards stored in a smart device."
  - "Only 1.4% of electronic payments are made by other means, including online bank transfers and buy-now-pay-later schemes."
  - Debit and credit card transactions rely on international communications with Visa and Mastercard; NASDAQ CSD operates securities settlement offshore.
  - "Cash is still widely available and accepted" and CBI will continue to provide cash as "the only fallback in payment system crisis."

### Recent operational and cyber incidents; threat environment
- Historical incidents and operational notes:
  - A "significant DDoS attack in August 2021 disrupted the functioning of two of the three main providers of card services and the availability of electronic identification (eID) services used for authentication."
  - "Most payment services were recovered within two hours."
  - Since the attack, commercial banks "have diversified DDOS protection provision and increased capacity."
  - In Summer 2022 a large bank's website "was copied, harvesting log in details, and resulting in some loss for customers"; the bank "compensated customers for any losses."
  - Core payment system upgrades by banks have caused some service disruptions, but "this disruption has not been significant."
  - Winter storms can cause power outages in remote areas, temporarily disrupting connectivity.
- Threats and vulnerabilities:
  - Threats are "growing" with increased levels of DDoS and social engineering (phishing) attacks.
  - Iceland’s dependence on international connectivity for debit and credit card processing "introduces a significant vulnerability into the payment system."
  - Decisions by two major acquirers (now known as Teya and Rapyd) to rely on Visa and Mastercard "have reduced the operational independence of the Icelandic financial system."
  - CBI is "investigating alternative domestic retail payment solutions" for significant disruptions.
  - With cash currently the only available fallback, CBI should "work with payment system providers and retail stores to refine contingency plans and test how cash will be distributed and used in a crisis situation."

### Governance, strategy, and coordination
- National cyber strategy and finance-sector gap:
  - MoHESI published a revised Icelandic National Cybersecurity Strategy in "February 2022" and an action plan in "November 2022," covering 2022-2037; "this is not sector specific."
  - "There is no dedicated cyber security strategy for the finance sector."
  - Recommendation: "MoF and CBI to produce a financial sector specific cyber security strategy, clearly setting out the roles and responsibilities of each party."
- Oversight bodies and forums:
  - The Financial Stability Committee ("the Committee") of the CBI has a "broad remit" and "represents an opportunity to take a leading role in operational resilience with regard to cyber security risk."
  - Recommendation: "The Financial Stability Committee to consider developing a cyber and operational risk agenda in support of its broad financial stability objective, with appropriate involvement of the Financial Stability Council."
  - CERT-IS (part of the Electronic Communications Office of Iceland, ECOI, under MoHESI) "has recently received additional resources and an expanded remit."
  - MoHESI leads the Cyber Security Council, which includes CBI and MoF.
  - CBI’s SURF is a public/private collaboration forum on cyber and operational risk where MoF and CERT-IS participate; arrangements for formal cooperation between financial sector authorities and the private sector are "in development."
  - Recommendation: "MoF and relevant authorities to continue to consolidate cyber security efforts and coordination at government level and to emphasize the importance of the services CERT-IS offers to all sectors, and the financial sector in particular."

### Contingency planning, incident management, and exercises
- Leadership and coordination gaps:
  - "There is some confusion about who would lead the financial sector’s response to a major cyber or operational incident."
  - The Financial Stability Council (MoF and CBI) is "tasked with formal contingency response for the finance sector."
  - The common coordination plan is "under collective revision at the level of experts in CBI’s SURF."
  - Recommendation: "MoF and CBI to expedite revision of the common coordination plan for the financial sector in the event of a major incident."
- Exercises and preparedness:
  - CERT-IS led a cyber security scenario 'table-top' exercise (ransomware scenario) at the request of CBI and SURF; participants "found it to be very valuable" and there is appetite for more.
  - Recommendation: "CBI, SURF and CERT-IS to arrange further and regular cyber security scenario exercises to strengthen cooperation and coordination, expanding the range of financial institutions and government agencies involved."
- Contingency planning specifics:
  - SURF’s working group led by RB is drafting a common coordination plan envisaging RB acting as a common incident response center for financial sector institutions.
  - The supervisory contingency plan (Financial Service Response Plan) has not been updated since the FSA–CBI merger on 1 January 2020 and is under review.
  - Review finding: early draft coordination plan includes CBI, the largest banks, and a savings bank, but excludes government agencies — leadership and inclusion should be clarified.

### Supervisory arrangements and practices
- Supervisory resources and roles:
  - Operational risk experts in CBI are "experienced and well regarded by financial institutions, but more resources are needed to provide adequate coverage of this increasingly important area."
  - CBI is the sole authority supervising cyber and operational risks in the financial sector.
  - Four departments within the Central Bank focus on supervision of regulated entities (Banking Department; Pension and Insurance Department; Markets Department; Financial Market Infrastructure Oversight Unit).
  - Operational and cyber risk expertise at CBI is limited:
    - Two FTEs in the Bank division and one FTE within Pension and Insurance focus on operational risk; one of these experts focuses on cyber risk.
    - One FTE within the Financial Market Infrastructure focuses on cyber risk within the CBI’s core payment system (MBK and RB).
- Supervision approach and limitations:
  - Supervision is highly dependent on self-assessments by regulated entities and independent third-party reviews.
  - No on-site cyber security examinations have been performed at banks.
  - Insurance supervision completed a third on-site inspection on operational risk with an ICT focus; a fourth is expected early in 2023.
  - CBI has decided to implement the TIBER-EU penetration testing program; Iceland’s version is called TIBER-IS.
  - Supervisors conducted a 2019 exercise to identify critical operations and critical third-party providers; results may be out of date.
- Regulatory guidance:
  - In March 2019 the FSA issued Guidelines No. 1/2019 on risks due to Information Systems Operated by Supervised Entities; these guidelines are non-enforceable and summarise legislation extant in early 2019.
  - New regulations since 2019 include PSD2 and the Digital Operational Resilience Act (DORA).
  - Recommendation: "Supervisory guidelines on ICT systems to be subject to regular review and updating, in particular in respect of Payment Systems Directive 2, the Digital Operational Resilience Act (DORA) and the Basel Principles for Operational Resilience."
- Critical operations and incident trend reporting:
  - Supervisors should "regularly revise the list of critical operations and critical service providers for internal use and for presentation to the Financial Stability Committee and Financial Stability Council."
  - "No formal summary or trend reports are created summarizing cyber and operational incidents and trends."
  - Recommendation: "CBI is encouraged to enhance its incident dashboard by summarizing cyber incidents and examining trends."
- Resource augmentation recommendation:
  - "CBI to gradually increase the resources for specialist supervision of operational, ICT and cyber risk at regulated firms and should use the power to appoint external auditors to augment its limited internal resources for cyber risk reviews."
  - "CBI should commence on-site examination of operational, ICT and cyber risk at regulated firms to obtain fuller picture on cyber preparedness, starting with the systemically important institutions and widening coverage as increased resources for specialist supervision allow."

### Payment infrastructure and operations (MBK and RB)
- MBK participants and importance:
  - Participants of MBK: CBI, the domestic commercial and savings banks, and two foreign financial institutions (Euroclear and Clearstream).
  - MBK is Iceland’s most systemically important FMI.
- RB role and technical arrangements:
  - Technical operation and monitoring outside opening hours of the system’s gross settlement component are outsourced to Reiknistofa bankanna (RB), a joint venture owned by the CBI and the commercial banks.
  - RB provides the technical interface between commercial banks and CBI’s two clearing and settlement systems:
    - RTGS: broadly for payments greater than 10 million ISK; operates between 8 AM and 5 PM.
    - EXP (instant payment system): operates 24 hours.
  - RB infrastructure:
    - Two data centers both in Iceland: one hosted at the CBI, the other at a remote location; each has an on-site data backup.
    - A third database site is maintained with a 24-hour delay for data integrity issues.
    - Regular switching takes place between the two primary data centers rather than a fixed primary/secondary arrangement.
    - Standard cyber controls over access and network separation are in place.
- Modernization and hosting:
  - Recent modernization program (near completion):
    - Implementing a new RTGS and instant payment system (MBK), completed in October 2020.
    - Updating commercial banks’ deposit systems, last bank finished in February 2022.
    - Decommissioning the old mainframe system in February 2023.
    - Outcome: considerably enhanced cyber and operational resilience of the payment infrastructure.
  - RTGS development and hosting:
    - Developed by Perago/SIA (now merged into Nexi Payments SpA, a company based in Milan).
    - Updated by RB using source code developed by Nexi.
    - Production software is all hosted within Iceland, with the same redundancy arrangements as RB.
    - RTGS also processes cash net settlement transactions five times a day for Nasdaq CSD.
  - Card scheme settlement:
    - Visa and Mastercard settle transactions on a net basis with the CBI acting as a settlement agent.
    - MBK web is an overlay allowing banks to monitor positions and manually initiate transactions, with very limited capacity.
  - Cross-border ISK payments:
    - Wholesale payments: flow via SWIFT to RTGS.
    - Retail payments: flow via a proprietary format the domestic banks use.
  - SEPA participation:
    - Iceland is a participant in the Single Euro Payments Area (SEPA).
    - Larger banks that participate are SEPA-compliant for cross border payments in Euros.
    - Systems underlying SEPA (STEP2-T and RT1) fall under the oversight of the European Central Bank (ECB), including for cybersecurity.

### Dependencies, systemic risks, cash fallback, and practical limitations
- International processing dependencies:
  - All Icelandic credit and debit card payments operate through Visa and Mastercard, both of which process transactions outside Iceland.
  - Offshore processing creates dependence on international communications infrastructure running through submarine cables to Europe.
    - As at the start of March 2023 there are three such submarine cables, all operated by state-owned electronic communications service provider, Farice ehf.
    - Submarine cables are exposed to cyber and physical attacks and underseas geothermal activity; Farice is subject to security requirements enforced by the ECOI.
  - Historical precedent: during the Icelandic financial crisis of 2008/9 Visa and Mastercard refused to settle in Icelandic Krona, highlighting the risk of dependence on non-domestic payment system providers.
  - The two major acquirers (now known as Teya and Rapyd) later chose to rely on Visa and Mastercard processing for both credit and debit cards, eliminating the contingency fallback of a domestic system that existed in 2008/9.
  - Central securities depository: Nasdaq CSD processes all transactions remotely in Sweden, adding to dependence on communications technology.
- Cash as contingency:
  - Cash is legal tender for all payments.
  - CBI can ensure a large enough supply of notes and coins to be used for necessary spending if electronic retail payments are interrupted.
  - RB is the critical service provider relied upon for distribution of cash as a fallback currency.
  - ATM and eID:
    - Most domestic commercial banks have adopted a new ATM solution that does not require a payment card for cash withdrawals, using the domestic eID system for customer identification.
    - The eID system relies on effective electronic communications and power but does not rely on Visa and Mastercard processing systems.
  - Practical concerns about cash as fallback:
    - A CBI working group (reported March 2022) found RB’s contingency plan for cash distribution robust, but raised concerns about stores’ ability to accept cash, especially during power or communication failures.
    - Many points-of-sale use electronic payment terminals instead of cash registers, limiting their ability to accept cash.
    - During a referenced DDOS attack, a minority of customers made direct bank transfers, but authorities do not see this as a robust fallback—time-consuming and incompatible with many self-checkout setups.
    - Large-scale distribution and acceptance of cash as a fallback is untested; a large-scale switch to cash may uncover unexpected difficulties.
    - During the DDOS event, consumers queued at ATMs and not all cards worked; one large bank questioned the feasibility of large-scale cash distribution; not all retailers can accept cash at scale, if at all.
- Strategic responses:
  - Domestic retail payment system:
    - Work on adopting a domestic retail payment system is being expedited, encouraged by CBI and the National Security Council.
    - Implementation discussions will be referred to a Forum for the Future to shape vision and priorities for core financial market infrastructure development. Forum membership: Central Bank, RB, deposit-taking financial institutions, and the MoF.
  - Review findings: dependencies on international connectivity and foreign payment systems introduce vulnerabilities; CBI is investigating alternatives for a domestic retail payment solution as a fallback.

### Information sharing, cooperation, and exercises
- International and regional participation:
  - CBI participates in workstreams of the European Banking Authority, European Securities and Markets Authority and European Insurance and Occupational Pensions Authority on a best effort basis.
  - Oversight Department cooperates and meets annually with other Nordic/Baltic central banks, including on cyber issues.
  - Member of the BIS Innovation Hub Nordic Centre in Stockholm; CBI has an employee there.
  - Participates in the BIS Innovation Network and the annual Nordic in Finance Cyber Conference.
- SURF and NF-CERT:
  - SURF (established Summer 2021) led by the CBI includes MoF, the three systemically important Icelandic commercial banks, Nasdaq CSD, Kauphöll Íslands, CERT-IS, RB and Finance Iceland.
  - SURF mandate: formulate a common vision on promoting resilience, coordinate actions at times of operational disruptions, and organize emergency cooperation and joint emergency plans.
  - CBI is a member of NF-CERT; NF-CERT provides threat intelligence, specialist technical support for incident handling, response coordination and networking opportunities.
  - CERT-IS has expanded remit and resources; aims to conduct regular exercises with sectoral groups and act as a contact point for international cooperation.
- Exercises and lessons:
  - CERT-IS organised an extensive exercise in October (last October) with a supply chain/ransomware scenario affecting ATMs and point of sale terminals; lessons were discussed at SURF’s December 2022 meeting.
  - Financial institutions found the CERT-IS led cyber exercise valuable and want more; procedural difficulties and lessons learned were identified.
- Recommendation: "MoF and relevant authorities to continue to consolidate cyber security efforts and coordination at government level and to emphasize the importance of the services CERT-IS offers to all sectors, and the financial sector in particular."

### Key recommendations (excerpted)
- Payment systems, schemes and instruments
  - 1. "CBI to work with payment service providers and retail stores to refine contingency plans and test how cash will be distributed and used in a crisis." — Paragraph 15; Responsible: CBI; Timing: I (Immediate)
- Financial sector cyber security oversight
  - 2. "MoF and CBI to produce a financial sector specific cyber security strategy, clearly setting out the roles and responsibilities of each party." — Paragraph 22; Responsible: MoF/CBI; Timing: I
  - 3. "The Financial Stability Committee to consider developing a cyber and operational risk agenda in support of its broad financial stability objective, with appropriate involvement of the Financial Stability Council." — Paragraph 22; Responsible: CBI/MoF; Timing: I
  - 4. "MoF and relevant authorities to continue to consolidate cyber security efforts and coordination at government level and to emphasize the importance of the services CERT-IS offers to all sectors, and the financial sector in particular." — Paragraph 28; Responsible: MOF; Timing: ST (Short term)
  - 5. "MoF and CBI to expedite revision of the common coordination plan for the financial sector in the event of a major incident." — Paragraph 36; Responsible: CBI/MoF; Timing: I
  - 6. "CBI, SURF and CERT-IS to arrange further and regular cyber security scenario exercises to strengthen cooperation and coordination, expanding the range of financial institutions and government agencies involved." — Paragraph 36; Responsible: CBI/CERT-IS; Timing: ST
- Supervisory arrangements and practices
  - 7. "Supervisory guidelines on ICT systems to be subject to regular review and updating." — Paragraph 38; Responsible: CBI; Timing: I
  - 8. "CBI to gradually increase the resources for specialist supervision of operational, ICT and cyber risk at regulated firms and should use the power to appoint external auditors to augment its limited internal resources for cyber risk reviews." — Paragraph 42; Responsible: CBI; Timing: ST
  - 9. "CBI should commence on-site examination of operational, ICT and cyber risk at regulated firms to obtain fuller picture on cyber preparedness, starting with the systemically important institutions and widening coverage as increased resources for specialist supervision allow." — Paragraph 52; Responsible: CBI; Timing: ST
  - 10. "CBI to regularly revise the list of critical operations and critical service providers for internal use and for presentation to the Financial Stability Committee and Financial Stability Council." — Paragraph 52; Responsible: CBI; Timing: I
  - 11. "CBI is encouraged to enhance its incident dashboard by summarizing cyber incidents and examining trends." — Paragraph 54; Responsible: CBI; Timing: I
- Timing legend:
  - I Immediate (within 1 year)
  - ST Short term (within 1-2 years)
  - MT Medium Term (within 3−5 years)

*Source: EXECUTIVE SUMMARY and relevant sections, 1islea2023007*

### EXECUTIVE SUMMARY __________________________________________________________________________ 4

### 1islea2023007 - EXECUTIVE SUMMARY

### System-wide context and payment landscape
- The Icelandic financial system is described as "large, concentrated and interconnected - banks and Non-Bank Financial Institutions (NBFIs) - domestically and internationally."
- Structure:
  - There are "10 banks: 4 commercial banks and 6 savings banks."
  - "Three of the commercial banks (Arion banki, Íslandsbanki and Landsbankinn) together account for 95 percent of banking assets."
- Payment behavior and dependencies:
  - "Cash use is declining" and electronic payment reliance is increasing.
  - "98% of respondents who shop at points of sale on a weekly basis or more often use electronic payment instruments" (Gallup survey, spring 2022 for the CBI).
  - "Almost all (98.6%) electronic payments at point of sale are card payments, of which 37.8% are digital cards stored in a smart device."
  - "Only 1.4% of electronic payments are made by other means, including online bank transfers and buy-now-pay-later schemes."
  - Debit and credit card transactions rely on international communications with Visa and Mastercard; NASDAQ CSD operates securities settlement offshore.
  - "Cash is still widely available and accepted" and CBI will continue to provide cash as "the only fallback in payment system crisis."

### Recent operational and cyber incidents; threat environment
- Historical incidents and operational notes:
  - A "significant DDoS attack in August 2021 disrupted the functioning of two of the three main providers of card services and the availability of electronic identification (eID) services used for authentication."
  - "Most payment services were recovered within two hours."
  - Since the attack, commercial banks "have diversified DDOS protection provision and increased capacity."
  - In Summer 2022 a large bank's website "was copied, harvesting log in details, and resulting in some loss for customers"; the bank "compensated customers for any losses."
  - Core payment system upgrades by banks have caused some service disruptions, but "this disruption has not been significant."
  - Winter storms can cause power outages in remote areas, temporarily disrupting connectivity.
- Threats and vulnerabilities:
  - Threats are "growing" with increased levels of DDoS and social engineering (phishing) attacks.
  - Iceland’s dependence on international connectivity for debit and credit card processing "introduces a significant vulnerability into the payment system."
  - The decision by two major acquirers (now known as Teya and Rapyd) to rely on Visa and Mastercard "have reduced the operational independence of the Icelandic financial system."
  - CBI is "investigating alternative domestic retail payment solutions" for significant disruptions.
  - With cash currently the only available fallback, CBI should "work with payment system providers and retail stores to refine contingency plans and test how cash will be distributed and used in a crisis situation."

### Governance, strategy, and coordination
- No sector-specific cybersecurity strategy:
  - MoHESI published a revised Icelandic National Cybersecurity Strategy in "February 2022" and an action plan in "November 2022," but "this is not sector specific."
  - "There is no dedicated cyber security strategy for the finance sector."
  - Recommendation: "MoF and CBI to produce a financial sector specific cyber security strategy, clearly setting out the roles and responsibilities of each party."
- Role of oversight bodies and forums:
  - The Financial Stability Committee ("the Committee") of the CBI has a "broad remit" and "represents an opportunity to take a leading role in operational resilience with regard to cyber security risk."
  - Recommendation: "The Financial Stability Committee to consider developing a cyber and operational risk agenda in support of its broad financial stability objective, with appropriate involvement of the Financial Stability Council."
  - International and regional cooperation: CBI participates in Nordic information sharing fora.
  - CERT-IS (part of the Electronic Communications Office of Iceland, ECOI, under MoHESI) "has recently received additional resources and an expanded remit."
  - MoHESI leads the Cyber Security Council, which includes CBI and MoF.
  - CBI’s SURF is a public/private collaboration forum on cyber and operational risk where MoF and CERT-IS participate; arrangements for formal cooperation between financial sector authorities and the private sector are "in development."
  - Recommendation: "MoF and relevant authorities to continue to consolidate cyber security efforts and coordination at government level and to emphasize the importance of the services CERT-IS offers to all sectors, and the financial sector in particular."

### Contingency planning, incident management, and exercises
- Leadership and coordination gaps:
  - "There is some confusion about who would lead the financial sector’s response to a major cyber or operational incident."
  - The Financial Stability Council (MoF and CBI) is "tasked with formal contingency response for the finance sector."
  - The common coordination plan is "under collective revision at the level of experts in CBI’s SURF."
  - Recommendation: "MoF and CBI to expedite revision of the common coordination plan for the financial sector in the event of a major incident."
- Exercises and preparedness:
  - CERT-IS led a cyber security scenario 'table-top' exercise (ransomware scenario) at the request of CBI and SURF; participants "found it to be very valuable" and there is appetite for more.
  - Recommendation: "CBI, SURF and CERT-IS to arrange further and regular cyber security scenario exercises to strengthen cooperation and coordination, expanding the range of financial institutions and government agencies involved."

### Supervisory arrangements and practices
- Supervisory resources and methods:
  - "Operational risk experts in CBI are experienced and well regarded by financial institutions, but more resources are needed to provide adequate coverage of this increasingly important area."
  - Recommendation: "CBI to gradually increase the resources for specialist supervision of operational, ICT and cyber risk at regulated firms and should use the power to appoint external auditors to augment its limited internal resources for cyber risk reviews."
- Reliance on self-assessment and third-party reviews:
  - Supervision is "highly dependent on self-assessments by the regulated entities themselves and independent reviews carried out by third parties."
  - The lack of on-site visits and/or robust challenge of third-party assertions "increases the risk that weaknesses are missed."
  - Recommendation: "CBI should commence on-site examination of operational, ICT and cyber risk at regulated firms to obtain fuller picture on cyber preparedness, starting with the systemically important institutions and widening coverage as increased resources for specialist supervision allow."
- Regulatory and guidance updates:
  - Many regulations governing ICT systems were summarized in guidelines issued by the Icelandic Financial Supervisory Authority (FSA), but these "cover legislation extant in early 2019."
  - Recommendation: "Supervisory guidelines on ICT systems to be subject to regular review and updating, in particular in respect of Payment Systems Directive 2, the Digital Operational Resilience Act (DORA) and the Basel Principles for Operational Resilience."
- Critical operations and third-party providers:
  - Supervisors conducted an exercise in 2019 to identify critical operations and critical third-party providers.
  - Recommendation: "CBI to regularly revise the list of critical operations and critical service providers for internal use and for presentation to the Financial Stability Committee and Financial Stability Council."
- Incident trend reporting:
  - "No formal summary or trend reports are created summarizing cyber and operational incidents and trends."
  - Recommendation: "CBI is encouraged to enhance its incident dashboard by summarizing cyber incidents and examining trends."

### Key recommendations (excerpted from Table 1)
- Payment systems, schemes and instruments
  - 1. "CBI to work with payment service providers and retail stores to refine contingency plans and test how cash will be distributed and used in a crisis." — Paragraph 15; Responsible: CBI; Timing: I (Immediate)
- Financial sector cyber security oversight
  - 2. "MoF and CBI to produce a financial sector specific cyber security strategy, clearly setting out the roles and responsibilities of each party." — Paragraph 22; Responsible: MoF/CBI; Timing: I
  - 3. "The Financial Stability Committee to consider developing a cyber and operational risk agenda in support of its broad financial stability objective, with appropriate involvement of the Financial Stability Council." — Paragraph 22; Responsible: CBI/MoF; Timing: I
  - 4. "MoF and relevant authorities to continue to consolidate cyber security efforts and coordination at government level and to emphasize the importance of the services CERT-IS offers to all sectors, and the financial sector in particular." — Paragraph 28; Responsible: MOF; Timing: ST (Short term)
  - 5. "MoF and CBI to expedite revision of the common coordination plan for the financial sector in the event of a major incident." — Paragraph 36; Responsible: CBI/MoF; Timing: I
  - 6. "CBI, SURF and CERT-IS to arrange further and regular cyber security scenario exercises to strengthen cooperation and coordination, expanding the range of financial institutions and government agencies involved." — Paragraph 36; Responsible: CBI/CERT-IS; Timing: ST
- Supervisory arrangements and practices
  - 7. "Supervisory guidelines on ICT systems to be subject to regular review and updating." — Paragraph 38; Responsible: CBI; Timing: I
  - 8. "CBI to gradually increase the resources for specialist supervision of operational, ICT and cyber risk at regulated firms and should use the power to appoint external auditors to augment its limited internal resources for cyber risk reviews." — Paragraph 42; Responsible: CBI; Timing: ST
  - 9. "CBI should commence on-site examination of operational, ICT and cyber risk at regulated firms to obtain fuller picture on cyber preparedness, starting with the systemically important institutions and widening coverage as increased resources for specialist supervision allow." — Paragraph 52; Responsible: CBI; Timing: ST
  - 10. "CBI to regularly revise the list of critical operations and critical service providers for internal use and for presentation to the Financial Stability Committee and Financial Stability Council." — Paragraph 52; Responsible: CBI; Timing: I
  - 11. "CBI is encouraged to enhance its incident dashboard by summarizing cyber incidents and examining trends." — Paragraph 54; Responsible: CBI; Timing: I
- Timing legend used in table:
  - I Immediate (within 1 year)
  - ST Short term (within 1-2 years)
  - MT Medium Term (within 3−5 years)

*Source: EXECUTIVE SUMMARY, 1islea2023007*

### 6.      CBI operates the country’s interbank payment system, MBK, key elements of which are

### 6.      CBI operates the country’s interbank payment system, MBK, key elements of which are

### Payment infrastructure and operations
- Participants of MBK: CBI, the domestic commercial and savings banks, and two foreign financial institutions (Euroclear and Clearstream).
- MBK is Iceland’s most systemically important FMI.
- Technical operation and monitoring outside opening hours of the system’s gross settlement component are outsourced to Reiknistofa bankanna (RB), a joint venture owned by the CBI and the commercial banks.
- RB provides the technical interface between commercial banks and CBI’s two clearing and settlement systems:
  - RTGS: broadly for payments greater than 10 million ISK; operates between 8 AM and 5 PM.
  - EXP (instant payment system): operates 24 hours.
- RB infrastructure:
  - Two data centers both in Iceland: one hosted at the CBI, the other at a remote location; each has an on-site data backup.
  - A third database site is maintained with a 24-hour delay for data integrity issues.
  - Regular switching takes place between the two primary data centers rather than a fixed primary/secondary arrangement.
  - Standard cyber controls over access and network separation are in place.
- Recent modernization program (near completion):
  - Implementing a new RTGS and instant payment system (MBK), completed in October 2020.
  - Updating commercial banks’ deposit systems, last bank finished in February 2022.
  - Decommissioning the old mainframe system in February 2023.
  - Outcome: considerably enhanced cyber and operational resilience of the payment infrastructure.
- RTGS development and hosting:
  - Developed by Perago/SIA (now merged into Nexi Payments SpA, a company based in Milan).
  - Updated by RB using source code developed by Nexi.
  - Production software is all hosted within Iceland, with the same redundancy arrangements as RB.
  - RTGS also processes cash net settlement transactions five times a day for Nasdaq CSD.
- Card scheme settlement:
  - Visa and Mastercard settle transactions on a net basis with the CBI acting as a settlement agent.
  - MBK web is an overlay allowing banks to monitor positions and manually initiate transactions, with very limited capacity.
- Cross-border ISK payments:
  - Wholesale payments: flow via SWIFT to RTGS.
  - Retail payments: flow via a proprietary format the domestic banks use.
- SEPA participation:
  - Iceland is a participant in the Single Euro Payments Area (SEPA).
  - Larger banks that participate are SEPA-compliant for cross border payments in Euros.
  - Systems underlying SEPA (STEP2-T and RT1) fall under the oversight of the European Central Bank (ECB), including for cybersecurity.

### Dependencies and systemic risks
- All Icelandic credit and debit card payments operate through Visa and Mastercard, both of which process transactions outside Iceland.
- Offshore processing creates dependence on international communications infrastructure running through submarine cables to Europe.
  - As at the start of March 2023 there are three such submarine cables, all operated by state-owned electronic communications service provider, Farice ehf.
  - Submarine cables are exposed to cyber and physical attacks and underseas geothermal activity; Farice is subject to security requirements enforced by the ECOI.
- Historical precedent:
  - During the Icelandic financial crisis of 2008/9 Visa and Mastercard refused to settle in Icelandic Krona, highlighting the risk of dependence on non-domestic payment system providers.
  - At that time, Icelandic debit card systems were operated domestically and continued to operate.
  - The two major acquirers (now known as Teya and Rapyd) later chose to rely on Visa and Mastercard processing for both credit and debit cards, eliminating the contingency fallback of a domestic system that existed in 2008/9.
- Central securities depository:
  - Nasdaq CSD processes all transactions remotely in Sweden, adding to dependence on communications technology.

### Cash, contingency arrangements, and practical limitations
- Cash distribution:
  - Cash is legal tender for all payments.
  - CBI can ensure a large enough supply of notes and coins to be used for necessary spending if electronic retail payments are interrupted.
  - RB is the critical service provider relied upon for distribution of cash as a fallback currency.
- ATM and eID:
  - Most domestic commercial banks have adopted a new ATM solution that does not require a payment card for cash withdrawals, using the domestic eID system for customer identification.
  - The eID system relies on effective electronic communications and power but does not rely on Visa and Mastercard processing systems.
- Practical concerns about cash as fallback:
  - A CBI working group (reported March 2022) found RB’s contingency plan for cash distribution robust, but raised concerns about stores’ ability to accept cash, especially during power or communication failures.
  - Many points-of-sale use electronic payment terminals instead of cash registers, limiting their ability to accept cash.
  - During a referenced DDOS attack, a minority of customers made direct bank transfers, but authorities do not see this as a robust fallback—time-consuming and incompatible with many self-checkout setups.
  - Large-scale distribution and acceptance of cash as a fallback is untested; a large-scale switch to cash may uncover unexpected difficulties.
  - During the DDOS event, consumers queued at ATMs and not all cards worked; one large bank questioned the feasibility of large-scale cash distribution; not all retailers can accept cash at scale, if at all.

### Strategic responses, governance, and planned actions
- Domestic retail payment system:
  - Encouraged by CBI and the National Security Council, work on adopting a domestic retail payment system is being expedited.
  - Implementation discussions will be referred to a Forum for the Future to shape vision and priorities for core financial market infrastructure development.
  - Forum membership: Central Bank, RB, deposit-taking financial institutions, and the MoF.
- Review findings on dependencies:
  - Dependencies on international connectivity and foreign payment systems introduce vulnerabilities into the payment system.
  - The decisions by the two major acquirers (Teya and Rapyd) to rely on Visa and Mastercard have reduced operational resilience and potential financial stability.
  - In the event of significant disruption to debit and credit card systems, alternative methods (cash and/or direct bank transfers) have drawbacks and rely on internet connectivity.
  - CBI is investigating alternatives for a domestic retail payment solution as a fallback.

### Recommendations (operational contingency)
- CBI should work with payment service providers and retail stores to refine contingency plans and test how cash will be distributed and used in a crisis.
  - This requires cross-sectoral contingency planning, especially regarding electronic communications and power, in addition to finance.
  - Contingency plans should be tested and revised on a regular basis.

### Financial sector cyber security oversight — strategy, cooperation, and coordination
- National strategy:
  - MoHESI published a revised Icelandic National Cybersecurity Strategy in February 2022 and a supporting action plan in November 2022.
  - The revised strategy covers the years 2022-2037.
  - The vision: “Icelanders enjoy security on the Internet based on strong security culture, reliable cyber security and law enforcement, active cooperation, national and international, and comprehensive legislation that supports innovation and progress in Internet service.”
  - Two objectives: (i) competence with and use of cyber security technology, and (ii) a secure internet environment.
  - Action plan lists tasks for specified Government ministries and institutions; actions assigned to the MoF are predominantly administrative and do not mostly relate specifically to the finance sector.
  - The strategy is to be reviewed every three years and the action plan is expected to be a living document re-evaluated regularly.
- Cyber governance forums:
  - The previous (2015) strategy envisaged a Cyber Security Council (CSC) and a Cyber Security Forum.
  - CSC serves as governmental forum on network and information security; CBI recently became an observer to the CSC.
  - The Cyber Security Forum never became operational; an alternative consultation forum between Government and private sector is being rolled out (see Information Sharing).
- Financial Stability Council and Committee:
  - Financial Stability Council: established by legislation (Act. No. 66/2014); formal co-operation forum of public authorities for financial stability; meets three times a year; aims to strengthen and preserve financial stability.
  - Council composition: Minister of Finance (chair) and Central Bank Governor; regular attendees include CBI Deputy Governor of Financial Stability, Director of Financial Stability Department; MoF Director General for Financial Services and Director General for Economic Affairs.
  - Financial Stability Committee: established in 2020; chaired by the Governor of the CBI; members include Deputy Governors and three independents appointed by the MoF; MoF represented by a non-voting member; Director of CBI's Financial Stability Department attends.
  - Committee tasks: assess system risk and prospects, discuss and define actions to strengthen and preserve financial stability, make comments to appropriate authorities, adopt administrative directives as laws stipulate, decide which supervised entities/infrastructure/markets are considered systemically important.
  - CBI informs the Committee about cyber risks and core banking system upgrade progress; the Committee has not to date directed comments towards any authority in respect of cyber risk.

### Review findings on cyber strategy and committee role
- There is no dedicated cyber security strategy for the finance sector.
- Roles of authorities for cyber security can be gleaned from legislation or implied, but no central document sets out how they collectively safeguard financial sector cyber security.
- A clearly articulated finance-sector strategy would:
  - Set out respective roles and responsibilities of CBI, Government Departments, and others in strengthening finance sector cyber security.
  - Clarify interagency cooperation and coordination arrangements.
  - Clarify incident reporting and information sharing arrangements.
  - Set out clear responsibilities in the event of an incident.
- SURF (Collaboration Forum on the Operational Security of Financial Infrastructure) potential:
  - SURF’s remit includes preparing a common vision on promoting resilience of critical infrastructure network and information systems and could provide a basis for a finance sector-specific strategy.
  - The mission is not aware SURF has started to act on this part of its mandate.
- Committee role:
  - The Financial Stability Committee has not extended reach to include policies and recommendations for operational and cyber resilience.
  - The Committee’s remit presents an opportunity to take a leading role in operational resilience and cyber risk mitigation.
  - CBI updates the Committee on cyber risks, but no actions have been directed by the Committee on cyber risk.

### Recommendations (cyber governance)
- MoF should work together with the CBI to produce a financial sector specific cyber security strategy, clearly setting out the roles and responsibilities of each party.
- The Financial Stability Committee should consider developing a cyber and operational risk agenda in support of its broad financial stability objective, with appropriate involvement of the Financial Stability Council.

### Information sharing
- CBI international participation:
  - Participates in workstreams of the European Banking Authority, European Securities and Markets Authority and European Insurance and Occupational Pensions Authority on a best effort basis.
  - Oversight Department cooperates and meets annually with other Nordic/Baltic central banks, including on cyber issues.
  - Member of the BIS Innovation Hub Nordic Centre in Stockholm; CBI has an employee there.
  - Participates in the BIS Innovation Network and the annual Nordic in Finance Cyber Conference (first held in 2017, most recently held in Iceland).
- SURF (established Summer 2021):
  - Led by the CBI with members from MoF, the three systemically important Icelandic commercial banks, Nasdaq CSD, Kauphöll Íslands (the Stock Exchange), CERT-IS, RB and Finance Iceland.
  - SURF mandate:
    - Formulate a common vision on actions aimed at promoting resilience of critical infrastructure network and information systems.
    - Coordinate actions at times of operational disruptions that affect the financial system’s safety and efficiency.
    - Organize emergency cooperation and joint emergency plans, emphasizing strengthening cyber security defenses and resilience of the financial system against cyber-attacks.
  - SURF is an important cooperation venue; formal government preparedness remains the responsibility of MoF and CBI (and the Financial Stability Council) along with other relevant ministries and institutions.

*Source: CBI*

### 28.      In addition to SURF, which includes private sector members, CBI cooperates with

### 1islea2023007 - 28.      In addition to SURF, which includes private sector members, CBI cooperates with

### Cooperation and information sharing
- SURF includes private sector members; CBI participates and coordinates with Finance Iceland, which hosts monthly meetings between Chief Security Officers (CSOs) of the bigger banks and payment institutions. CSOs of major telecommunication companies and a representative from the police cyber-crime division also participate.
- A functional communication channel exists for Chief Information Officers of larger institutions.
- CBI is a member of the Nordic Financial Computer Emergency Response Team (NF-CERT):
  - NF-CERT allows members to share information and respond to threats in a coordinated manner.
  - CBI staff attend weekly online meetings and share Icelandic incident information with other Nordic countries.
  - Many Icelandic banks are direct NF-CERT members.
- CERT-IS has expanded from telecommunications to cover all significant sectors (operators of essential services and digital service providers). CERT-IS:
  - Aims to conduct regular exercises with sectoral groups, increase information sharing, and act as a contact point for the Icelandic government in international cooperation.
  - Requires certain socially and economically important entities to report incidents to CERT-IS, which has duties to share incident information and set up sectoral groups, including the financial sector.
  - At the time of review had held one meeting in its expanded format.

### Assessment of CERT-IS and NF-CERT
- Review findings:
  - Broad agreement that CERT-IS became much more effective since scope and resources expanded in 2021, but services lag behind the more established NF-CERT.
  - The functional communications channel is highly regarded, immediate and very helpful.
  - NF-CERT is most highly regarded as the longest established financial sector forum with wide reach; it provides threat intelligence, specialist technical support for incident handling, response coordination and networking opportunities.
  - CERT-IS provides threat intelligence and information sharing, with more limited assistance in incident handling given its resources.
- Recommendation (paragraph 32):
  - Authorities are encouraged to continue consolidating cyber security efforts and coordination across the administration and to emphasize the importance of CERT-IS services to all sectors, and the financial sector in particular.

### Contingency planning, incident management and exercising
- Current arrangements:
  - ECOI and CERT-IS have supporting coordination roles in cyber incidents, along with the National Commissioner of the Icelandic Police (NCIP) in case of an emergency under the Act on civil protection.
  - CBI coordinates with ECOI and CERT-IS on cyber incidents.
  - CERT-IS organised and executed an extensive exercise in October (last October) that included the Central Bank and financial sector members, including RB as an important service provider.
    - Scenario: a supply chain attack via an infected update to a fictional infrastructure system leading to a ransomware attack that made all ATMs and point of sale terminals inoperable.
    - Lessons learned discussed at SURF’s December 2022 meeting.
  - Coordination in a financial sector cyber incident requires involvement of CBI and, if serious, the MoF (and the Financial Stability Council).
  - ECOI/CERT-IS coordinated with other government agencies on the log4j vulnerability discovered in December 2021; they jointly decided to raise the civil defence risk level. SURF met to discuss measures taken by members.
  - SURF’s mandate includes coordinating actions during operational disruptions; a working group led by RB is drafting a common coordination plan for disruptions, envisaging RB acting as a common incident response center for financial sector institutions.
  - The FSA previously held coordination exercises tied to major upgrades to financial market infrastructures; these were operational and did not specifically address cyber-attacks.
  - The supervisory divisions of the CBI (ex FSA) have a contingency plan, the Financial Service Response Plan, currently under review to reflect the merger between the FSA and the Central Bank on 1 January 2020.
- Review findings:
  - Confusion exists about who would lead the financial sector’s response to a major cyber or operational incident.
  - The common coordination plan being developed by SURF’s working group should clarify leadership once formally issued by CBI and presented to MoF.
    - Early draft includes CBI, the largest banks, and a savings bank, but excludes government agencies.
  - In a major incident, MoF and MoHESI are highly likely to need involvement for coordination and communications.
  - Contingency plans should be developed for different scenarios and exercised.
  - Financial institutions found the CERT-IS led cyber exercise valuable and want more; procedural difficulties and lessons learned were identified.
  - The supervisory contingency plan has not been updated since the FSA–CBI merger three years ago; an out-of-date plan may prove ineffective.
- Recommendations (paragraphs 41–42):
  - MoF and CBI should expedite development and dissemination of an overarching strategy and contingency plan for the financial sector for major incidents, building on SURF’s common contingency plan; the supervisory contingency plan should be updated.
  - Authorities should arrange further cyber security scenario exercises, expanding the range of financial institutions and government agencies involved.

### Supervisory arrangements and practices — Legal and regulatory framework
- Current arrangements:
  - Laws and government orders relating to cyber and operational resilience for the financial sector are numerous and widespread, largely deriving from EU legislation transposed into local law as Iceland is a member of the European Economic Area.
  - Regulations cover governance of operational and ICT risk management; operational risk (outsourcing; incident reporting; business continuity management); information systems and security.
  - Relevant guidance includes ESAs guidance on ICT and outsourcing to cloud service providers and Annex F to the CPMI/IOSCO Principles for Financial Market Infrastructures Core Principles.
  - In March 2019 the FSA issued Guidelines No. 1/2019 on risks due to Information Systems Operated by Supervised Entities, applying to all supervised entities; they include provisions on management and responsibility, contingency requirements and business continuity plans, outsourcing, security – including cyber security – internal monitoring and incident notifications. These guidelines are non-enforceable; supervisory sanctions derive from underlying legislation.
- Review:
  - The guidelines summarise regulations extant in early 2019. Since then, new regulations include the revised Payment Service Directive (PSD2) and the Digital Operational Resilience Act (DORA); there has been significant regulatory interest in operational resilience.
  - Current guidelines already contain many of the principles in the Basel Principles for Operational Resilience.
- Recommendation (paragraph 45):
  - Supervisory guidelines on ICT systems should be reviewed and updated regularly, in particular regarding PSD2, the Digital Operational Resilience Act and the Basel Principles for Operational Resilience.

### Supervisory arrangements and practices — Roles and responsibilities
- Current arrangements:
  - The Central Bank is the only authority supervising cyber and operational risks in the financial sector.
  - Four departments within the Central Bank focus on supervision of regulated entities:
    - Banking Department: supervision of institutions under EBA regulatory framework.
    - Pension and Insurance Department: supervision of institutions under EIOPA (and pension funds not under any ESA framework).
    - Markets Department: supervision of institutions under ESMA and consumer issues.
    - Financial Market Infrastructure Oversight Unit (in Financial Stability Department): responsible for monitoring operational security of CBI’s RTGS infrastructure, including cyber security.
  - Operational and cyber risk expertise at CBI is limited, with very few experienced staff:
    - Two FTEs in the Bank division and one FTE within Pension and Insurance focus on operational risk; one of these experts focuses on cyber risk.
    - One FTE within the Financial Market Infrastructure focuses on cyber risk within the CBI’s core payment system (MBK and RB).
    - The two experts in Banking also provide support to experts in the other two areas.
- Review:
  - CBI’s operational risk experts are experienced and well regarded, but more resources are needed to provide adequate coverage.
  - Dependency on very few staff exposes CBI to key-person risk; with more staff CBI could introduce on-site examinations, probe deeper into self-assessments, and take a more judgement-based approach.
  - The supervisor has the power to appoint and instruct an ‘auditor’ (external specialist) to review a financial firm but has not used this power for cyber risk; other jurisdictions use this to augment internal resources and access specialized skills.
- Recommendation (paragraph 50):
  - CBI should gradually increase resources for specialist supervision of operational, ICT and cyber risk at regulated firms and consider using its power to appoint external auditors to augment limited internal resources for cyber risk reviews.

### Supervisory approach and practices — Supervision approach (banking, insurance, pensions)
- Current arrangements:
  - Cybersecurity is assessed as part of the Supervisory Review and Evaluation Process (SREP), undertaken annually for the large banks. During SREP supervisors consider:
    - Incidents reported in the previous year and how they were handled;
    - Results of vulnerability scans and penetration tests (the three large banks are expected to undertake annual red team exercises);
    - Scenarios applied for SREP stress testing (encouraging banks to explore possible future operational and cyber risk events);
    - Outcome of business continuity plan exercises, where cyber aspects are more frequently covered;
    - Code reviews for new applications and internet banking products.
  - Only systemic institutions are required to do yearly independent penetration testing; recommended for other institutions on a risk-based approach.
  - CBI has decided to implement the TIBER-EU penetration testing program and has notified the ECB; Iceland’s version is called TIBER-IS.
  - No on-site cyber security examinations have been performed at banks.
  - Insurance supervision completed a third on-site inspection on operational risk with an ICT focus; a fourth is expected early in 2023.
  - CBI published its Supervision Focus for 2022-2024, covering cyber security for the first time: “It will be ensured that the cyber defenses of important regulated entities are regularly tested with vulnerability scans and cyber-attack drills based on global recognized methodology”.
  - Supervisory work often takes the form of circulars and letters asking for information (e.g., location of remote data back-up sites in response to the Russia/ Ukraine conflict).
  - Supervised entities must deliver regular independent review reports assessing ICT and security risk management yearly or every three years based on size. Those under EBA Guidelines report based on those requirements; others report based on CBI Guidelines n. 1/2019.
  - Supervisors conducted a 2019 exercise to identify critical operations and critical third-party providers in connection with NIS Directive implementation; results may be out of date due to accelerating outsourcing.
- Review:
  - Supervision is highly dependent on self-assessments and independent third-party reviews; weaknesses in such reports are followed up but supervisors provide little challenge to other assertions, increasing the risk that cyber security weaknesses are missed.
  - Introduction of TIBER-style penetration testing by CBI is welcomed.
  - The list of critical operations and critical service providers is incomplete due to recent outsourcing and cloud use; supervisors may be unaware of concentrations and dependencies.
  - The list should be regularly revised, disseminated among supervisors and senior staff, and reported to the Committee and Council for consideration and action.
- Recommendations (paragraphs 61–62):
  - CBI should commence on-site examinations of operational, ICT and cyber risk at regulated firms, starting with systemically important institutions and widening coverage as resources increase.
  - CBI should regularly revise the list of critical operations and critical service providers for internal use and for presentation to the Financial Stability Committee and Financial Stability Council.

### Incident reporting
- Current arrangements:
  - The Supervisor uses an incident reporting framework based on EBA’s PSD2 incident reporting guidelines; cyber security incidents are included within the general category of security incidents in PSD2.
  - Reporting thresholds set by the EBA have been adjusted for the relatively small size of Icelandic financial institutions.
  - Expert judgement is used to determine whether an incident needs follow up due to insufficient response or systemic risk.
  - The three systemically important banks and Stock Exchange are obliged to report incidents to CERT-IS.
- Review:
  - No formal summary or trend reports are created to summarize cyber and operational incidents and trends.
  - Incident information is shared informally on regular cross-divisional meetings within banks, risking missed patterns.
- Recommendation (paragraph 65):
  - CBI is encouraged to enhance its incident dashboard by summarizing cyber incidents and examining trends.

*Source: 1islea2023007*

---


_Source: https://www.imf.org/-/media/files/publications/cr/2023/english/1islea2023007.pdf_