## 1itaea2026007

## Source details

**Canonical URL:** [1itaea2026007](https://www.imf.org/-/media/files/publications/cr/2026/english/1itaea2026007.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/cr/2026/english/1itaea2026007.pdf.md)
- [Structured JSON version](/-/media/files/publications/cr/2026/english/1itaea2026007.pdf.json)

---

### Executive summary — digital transformation and cyber risk landscape
- Digital payments surpassed cash transactions since 2022.
- 64 percent of Less Significant Institutions (LSIs) and Nonbank Financial Intermediaries (NBFIs) use cloud solutions.
- The insurance sector reports 96 percent cloud adoption; digital channels are the primary interface for most policyholders.
- In 2024, 35 major cyberattacks occurred and three of them resulted in estimated losses exceeding EUR 2 million each.
- Payment fraud losses reached EUR 246 million.
- Fraud accounts for only a marginal share of total payment transactions (around 0.003 percent in value).
- Rising incidents include fraud, ransomware, phishing, distributed denial-of-service (DDoS) attacks, supply chain vulnerabilities, and data breaches.
- A sharp increase of operational incidents in 2024 highlighted the risk from relying on third-party service providers to deliver financial services.

### Institutional and legal framework
- Main financial sector cybersecurity supervisors: Banca d’Italia (BdI), CONSOB, COVIP, IVASS, and the Ministry of Economy and Finance (MEF).
- Majority collaborate with the National Cybersecurity Agency (ACN) and participate in CERTFin.
- Financial sector entities classified as critical fall under ACN pursuant to the National Cybersecurity Perimeter Law (2019).
- System-wide response and recovery actions coordinated through CODISE; CODISE liaises with CERTFin for technical analysis and support.
- The National Cybersecurity Cell (NCS) is the main interministerial coordination body for cyber crises.
- Italy’s National Cybersecurity Strategy aligns with EU frameworks; a financial sector cybersecurity strategy launched in 2020.
- DORA implemented in 2025; regulatory framework complemented by NIS2 (transposed), Critical Entities Resilience Directive (CER), and national regulations.
- ICT service providers (except if qualified as small or micro companies) fall within the scope of NIS2.

### Threat intelligence, incident reporting, and supervision practices
- CERTFin: central hub for sector-specific intelligence; CERTBI and ACN (via CSIRT Italia) share actionable indicators.
- Under BdI’s framework, number of major cyberattacks on banks and payment/e-money institutions increased from 10 to 35 incidents between 2020 and 2024.
- For FMIs and payment systems, BdI-supervised entities reported 78 operational incidents during 2020–2024: 53 related to payment systems and 25 to FMIs (including TVs); 7 classified as cyber incidents (all DDoS).
- ACN data: incidents doubled between 2023 and 2024 (from 81 to 178 cyber incidents); financial sector among top ten targeted.
- Early DORA reporting (first six months): BdI received 27 cyber-attack notifications (breakdown: 13 data exfiltration/manipulation; 10 supply-chain attacks; 9 ransomware/data encryption; 6 social engineering/phishing; 5 identity theft; 4 DDoS; 3 other types).
- CERTFin: around 7,700 fraudulent International Bank Account Numbers reported during 2024, a 230 percent increase from 2023; more than 400 alerts shared on merchant lists.
- Consumer complaints (2024): BdI received over 730 complaints related to suspected scam (6 percent of the total amount), a 32 percent increase over 2023; ABF managed 4,123 disputes regarding scams in 2024 (20 percent of Ombudsman’s litigation).

### Capacity development and organizational changes
- BdI created a new unit for oversight of third-party service providers and outsourcers and reinforced business continuity and cyber resilience via a specialized unit.
- BdI, CONSOB, and IVASS implemented recruitment plans for IT and cybersecurity experts; staff participate in Joint Examination Teams (JETs) under DORA.
- Training: internal specialist courses, external programs at European supervisory authorities, and professional certifications.
- Staffing levels:
  - BdI: 40 staff with ICT/cyber expertise in Banking and Financial Supervision, 30 in Payments and FMIs, and 20 in Information Technology.
  - CONSOB: 15 staff dedicated to cyber and ICT risk supervision and internal cybersecurity.
  - COVIP: 26 staff with cross-functional expertise (no centralized cyber risk supervision function).
  - IVASS: 4 staff for supervision and one IT department expert; relies on external consultants and BdI staff.

### Cyber mapping and financial stability analysis
- BdI outsourcing census (2020 pilot): over 10,500 contracts, 2,500 direct providers, and more than 1,000 sub-providers.
- Structured periodic reporting framework on outsourcing for directly supervised entities; collection of DORA-mandated Register of Information (ROI).
- Systemic operator identification methodology (BdI, CONSOB, IVASS) uses substitutability and operational thresholds; methodology being updated to align with DORA.
- BdI developing a model to analyze cyber risk transmission channels (operational, financial, and confidence contagion).
- Recommendations include leveraging DORA ROI to create cyber maps at firm and sectoral levels and conducting quantitative assessments of liquidity and settlement risks from failure of common critical third-party service providers.

### Cyber regulatory framework and supervisory practices
- DORA and Legislative Decree No. 23/2025 designate BdI, CONSOB, IVASS, and COVIP as competent authorities; DORA applicable from 17 January 2025.
- NIS2 transposed through Legislative Decree No. 138/2024; CER transposed through Legislative Decree No. 134/2024.
- DORA is lex specialis relative to NIS2 and CER for entities subject to DORA.
- PSNC (Decree Law No. 105/2019) applies fully only to banks and FMIs considered critical and governmentally identified.
- DORA does not cover payment systems and schemes and related technological infrastructure providers; these are covered by sector-specific BdI oversight regulation (9 November 2021) and ECB SIPS recast regulation (EU/2025/1355) and Eurosystem oversight policy.
- Common control frameworks used: ISO/IEC 27000 series; NIST-CSF; COBIT; ITIL; ISAE 3402 Type II; ISO/IEC 22301:2019; CIS Controls; ENISA Guidelines; TIBER-IT.
- Supervisory activity: 196 on-site examinations on LSIs covering cybersecurity as part of operational risk for 2022-2024 and first half of 2025; four ICT service providers subject to full-scope inspections during this period and another ongoing to be finalized by end of 2025.
- BdI ICT risk rating scale: 1 (Satisfactory), 2 (Broadly satisfactory), 3 (Broadly unsatisfactory), 4 (Unsatisfactory).
- Remediation and enforcement: post-DORA dedicated enforcement actions and sanctions may be applied; potential sanctions under PSNC or NIS2 can reach fines up to EUR 10 million or 2 percent of global turnover.

### Response, recovery, and testing
- Exercises and testing:
  - National exercises organized by BdI within CODISE; CERTFin organizes industry-wide exercises (REDFin), red teaming, and table-top simulations (average of two table-top exercises annually in 2023–2024).
  - European participation: BdI participated in 2024 SSM Cyber Resilience Stress Test involving 109 banks (all Italian SIs), 28 extensively tested with on-site visits.
  - Since 2022, eleven voluntary TLPTs conducted: five banks, one ICT provider, two e-money institutions, three insurance undertakings.
- DORA testing requirements:
  - Entities in scope must establish a structured testing program (risk-based) including vulnerability assessments and penetration testing.
  - A subset must conduct advanced testing (TLPT) at least once every three years (criteria in Commission Delegated Regulation (EU) 2025/1190).
  - CSDs and CCPs must perform vulnerability assessments prior to deployment or redeployment of applications, infrastructure components, and ICT services supporting critical or important functions.
- CODISE coordinates crisis communication and acts as main contact point for cross-border cyber crises.
- Playbooks: CERTFin updates playbooks for ransomware and DDoS scenarios; BdI internal playbooks define roles and emergency communication templates.
- Recommendation: continue cyber stress testing including supply chain attack scenarios and use TLPT results for continuous improvement of response and recovery plans.

### Information sharing and incident reporting
- CERTFin: cyber information and intelligence sharing arrangement for the whole financial sector; bilateral cooperation agreements with peer CERTs and networks.
- Multiple MoUs: CERTBI–ACN; BdI with Carabinieri; BdI with Dipartimento della Pubblica Sicurezza.
- DORA incident reporting (from 17 January 2025): unified European framework; single competent authority per supervised entity type to receive reports.
- Reporting formats: ESAs developed Excel (XLSX) and JSON formats; Italian entities currently use XLSX.
- Data collection in accordance with Commission Delegated Regulation (EU) 2024/1772 and Commission Delegated Regulation (EU) 2025/301 and Implementing Regulation (EU) 2025/302.
- CSIRT Italia maintains a national cross-sectoral database of cyber incident notifications.
- Early DORA reporting statistics: as of October 2025, no cyber incidents reported by entities operating payment systems or FMIs within DORA’s scope; one incident on a TV reported end of October.
- Recommendation: improve information sharing on cyber risk supervision and evaluate onboarding COVIP to CERTFin; establish MoUs to share capacity-building and supervisory information.

### Cyber deterrence and law enforcement cooperation
- Cybercrime regulation embedded in the Italian Criminal Code and aligned with EU directives and international conventions.
- ACN/CSIRT Italia coordinates with law enforcement; ACN signed three MoUs with law enforcement for information sharing.
- BdI and IVASS cooperate with law enforcement to detect, investigate, and prosecute cyber criminals.
- CERTFin collaborates with Italian National Police; Poste Italiane and Ministry of the Interior agreements to strengthen cybersecurity for public services.

### Key policy implications and recommended focus areas
- Continued investment in governance, capacity development, information sharing, industry-wide exercises, and advanced testing to safeguard financial stability and consumer protection.
- Emphasize mitigation of service disruptions from operational and cyber incidents and cyber-enabled fraud, which could grow in scale and sophistication.
- Financial authorities should exercise sanctioning powers, as needed, for non-compliance with cyber risk related regulations.
- Specific supervisory and oversight recommendations (excerpted):
  - Revise the cyber strategy for the financial sector and enhance cyber governance practices across organizations. (¶17 to ¶20) — Timing: NT; Responsible Authorities: BdI, CONSOB, COVIP, IVASS
  - Operationalize cyber mapping. (¶33) — Timing: NT; Responsible Authority: BdI
  - Assess the financial stability implications of cyber risk caused by a disruption to a third-party service provider. (¶34) — Timing: NT; Responsible Authority: BdI
  - Complete cyber resilience assessments for the remaining FMIs and CSPs based on the proportionality principle with ongoing monitoring on a periodical basis to induce action. (¶61) — Timing: I; Responsible Authorities: BdI, CONSOB
  - Complement offsite inspections and ongoing monitoring of cyber risks with audit and testing reports by independent parties for LSIs and NBFIs. (¶61) — Timing: I; Responsible Authority: BdI
  - Increase the focus on cyber risks during on-site inspections in supervised entities (LSIs, NBFIs, FMIs, CSPs) and give close attention to new entrants. (¶61) — Timing: NT; Responsible Authorities: BdI, CONSOB
  - Conduct thematic cybersecurity reviews for the insurance and pension sectors. (¶61) — Timing: I; Responsible Authorities: COVIP, IVASS
  - Promote operational resilience to effectively manage operational risks that may arise from disruptions from cyberattacks and technology failures, and exercise enforcement powers, as needed, for non-compliance with cyber risk related regulations. (¶61) — Timing: NT; Responsible Authorities: BdI, CONSOB, COVIP, IVASS
  - Continue cyber stress testing exercises with supervised entities (LSIs, NBFIs, FMIs) to test exit strategies from third-party service providers. (¶71) — Timing: NT; Responsible Authorities: BdI, CONSOB, COVIP, IVASS
  - Use results from advanced security testing methods for the continuous improvement of cyber response and recovery plans. (¶71) — Timing: MT; Responsible Authorities: BdI, CONSOB, IVASS
  - Improve information sharing with respect to cyber risk supervision and evaluate onboarding the Pension Fund Supervisory Commission to CODISE and CERTFin. (¶71, ¶87) — Timing: NT; Responsible Authorities: BdI, COVIP, IVASS
  - Support ongoing staff training on cyber risk supervision and oversight and reallocating resources for on-site cyber risk supervision. (¶93) — Timing: I; Responsible Authorities: BdI, CONSOB, COVIP, IVASS

*Source: IMF staff summary of Chapter 8 (Italy).*

### EXECUTIVE SUMMARY __________________________________________________________________________ 5

### EXECUTIVE SUMMARY

### Digital transformation and cyber risk landscape
- Digital payments surpassed cash transactions since 2022.
- 64 percent of Less Significant Institutions (LSIs) and Nonbank Financial Intermediaries (NBFIs) use cloud solutions.
- The insurance sector reports 96 percent cloud adoption, and digital channels are now the primary interface for most policyholders.
- In 2024, 35 major cyberattacks occurred and three of them resulted in estimated losses exceeding EUR 2 million each.
- Payment fraud losses reached EUR 246 million.
- Fraud accounts for only a marginal share of total payment transactions (around 0.003 percent in value).
- Rising incidents include fraud, ransomware, phishing, distributed denial-of-service (DDoS) attacks, supply chain vulnerabilities, and data breaches.
- A sharp increase of operational incidents in 2024 highlighted the risk from using and depending on third-party service providers to deliver financial services.

### Institutional and legal framework
- Main financial sector cybersecurity supervisors include Banca d’Italia (BdI), National Commission for Companies and the Stock Exchange (CONSOB), Pension Fund Supervisory Commission (COVIP), Institute for the Supervision of Insurance (IVASS), and the Ministry of Economy and Finance (MEF).
- Majority of these institutions collaborate with the National Cybersecurity Agency (ACN) and participate in the Computer Emergency Response Team for the Financial Sector (CERTFin).
- Financial sector entities classified as critical fall under the supervisory authority of ACN pursuant to the National Cybersecurity Perimeter Law (adopted in 2019).
- In operational crises (including ICT and cyber incidents), system-wide response and recovery actions are coordinated through CODISE, the unit for business continuity, which liaises with CERTFin for technical analysis and support.
- The National Cybersecurity Cell (NCS) is the main interministerial coordination body to deal with cyber crisis including those impacting different sectors.
- Italy’s National Cybersecurity Strategy aligns with EU frameworks and emphasizes sectoral Computer Security Incident Response Teams (CSIRTs) and Information Sharing and Analysis Centers (ISACs).
- A cybersecurity strategy for the financial sector was launched in 2020.
- The Digital Operational Resilience Act (DORA) was implemented in 2025.
- The regulatory framework is complemented by NIS2 (transposed into national jurisdiction), Critical Entities Resilience Directive (CER), and national regulations; ICT service providers (except if qualified as small or micro companies) fall within the scope of the NIS2.

### Threat intelligence, incident reporting, and supervision practices
- The threat landscape is assessed using intelligence from global, national, and supervisory sources.
- CERTFin acts as a central hub for sector-specific intelligence; CERTBI and ACN (through CSIRT Italia) share actionable threat indicators.
- Incident reporting frameworks show a sharp increase in cyberattacks and operational incidents; CSIRT Italia maintains a national cross-sectoral database of cyber incident notifications.
- Authorities monitor payment fraud and operational disruptions and emphasize robust incident response and recovery plans.
- Around 196 on-site cybersecurity examinations on LSIs were performed in the past three years as part of the inspection of operational risk in full scope inspections.
- Supervisory strategy has focused on ICT third-party service providers due to high interdependency with LSIs and NBFIs.
- Most Financial Market Infrastructures (FMIs), including Trading Venues (TVs), and critical service providers (CSPs), but not all, have undergone cyber resilience assessments.
- Supervisory practices include offsite and on-site inspections, thematic reviews, and the use of control frameworks (ISO/IEC, NIST, COBIT).
- Authorities apply proportionality in oversight, tailoring inspection depth to risk exposure and systemic relevance.
- Advanced security testing is mandated for entities meeting DORA criteria.
- Financial authorities participate in national, European, and international cybersecurity crisis management exercises (CODISE, G7-CEG, EU-SCICF, CERTFin).
- Incident reporting templates and protocols are standardized under DORA.

### Capacity development and organizational changes
- Financial authorities have created specialized units, internal committees, and advanced training programs to strengthen cyber risk supervision capabilities.
- BdI created a new unit for the oversight of third-party service providers and outsourcers, and reinforced business continuity and cyber resilience through another specialized unit.
- BdI, CONSOB and IVASS implemented recruitment plans for IT and cybersecurity experts; staff participate in Joint Examination Teams (JETs) as part of the DORA oversight framework.
- Training options include internal specialist courses, external programs at European supervisory authorities, and professional certifications.

### Policy implications and recommended focus
- Continued investment is essential in governance, capacity development, information sharing, industry-wide exercises, and advanced testing to safeguard financial stability and consumer protection.
- Emphasis should be placed on mitigating service disruptions from operational and cyber incidents and cyber-enabled fraud, which could grow in scale and sophistication.
- Financial authorities should step in and exercise sanctioning powers, as needed, for non-compliance with cyber risk related regulations.

### Recommendations on Cybersecurity Risk Supervision and Oversight (Table 1)
- 1. Revise the cyber strategy for the financial sector and enhance cyber governance practices across organizations. (¶17 to ¶20) — Timing: NT; Responsible Authorities: BdI, CONSOB, COVIP, IVASS
- 2. Operationalize cyber mapping. (¶33) — Timing: NT; Responsible Authority: BdI
- 3. Assess the financial stability implications of cyber risk caused by a disruption to a third-party service provider. (¶34) — Timing: NT; Responsible Authority: BdI
- 4. Complete cyber resilience assessments for the remaining FMIs and CSPs based on the proportionality principle with ongoing monitoring on a periodical basis to induce action. (¶61) — Timing: I; Responsible Authorities: BdI, CONSOB
- 5. Complement offsite inspections and ongoing monitoring of cyber risks with audit and testing reports by independent parties for LSIs and NBFIs. (¶61) — Timing: I; Responsible Authority: BdI
- 6. Increase the focus on cyber risks during on-site inspections in supervised entities (LSIs, NBFIs, FMIs, CSPs) and give close attention to new entrants. (¶61) — Timing: NT; Responsible Authorities: BdI, CONSOB
- 7. Conduct thematic cybersecurity reviews for the insurance and pension sectors. (¶61) — Timing: I; Responsible Authorities: COVIP, IVASS
- 8. Promote operational resilience to effectively manage operational risks that may arise from disruptions from cyberattacks and technology failures, and exercise enforcement powers, as needed, for non-compliance with cyber risk related regulations. (¶61) — Timing: NT; Responsible Authorities: BdI, CONSOB, COVIP, IVASS
- 9. Continue cyber stress testing exercises with supervised entities (LSIs, NBFIs, FMIs) to test exit strategies from third-party service providers. (¶71) — Timing: NT; Responsible Authorities: BdI, CONSOB, COVIP, IVASS
- 10. Use results from advanced security testing methods for the continuous improvement of cyber response and recovery plans. (¶71) — Timing: MT; Responsible Authorities: BdI, CONSOB, IVASS
- 11. Improve information sharing with respect to cyber risk supervision and evaluate onboarding the Pension Fund Supervisory Commission to CODISE and CERTFin. (¶71, ¶87) — Timing: NT; Responsible Authorities: BdI, COVIP, IVASS
- 12. Support ongoing staff training on cyber risk supervision and oversight and reallocating resources for on-site cyber risk supervision. (¶93) — Timing: I; Responsible Authorities: BdI, CONSOB, COVIP, IVASS

*Source: EXECUTIVE SUMMARY, ITALY — INTERNATIONAL MONETARY FUND*

### INTRODUCTION

### INTRODUCTION

### Digital transformation and adoption
- The Italian financial sector is undergoing digital transformation, with significant investments in innovative technologies.
- Lending, savings, deposits, and payments have attracted the most financial resources, with web and mobile platforms being the most widely adopted solutions.
- AI and application programming interfaces (APIs) are increasingly used, following the adoption of digital platforms.
- Digital transformation is especially evident in payments and insurance, with over 3.5 billion electronic transactions recorded in the first quarter of 2025.
- Cash usage has declined; digital payments now surpass cash at physical points of sale.
- Cyber insurance offerings have risen over 22 percent year-on-year, reflecting growing demand for digital risk coverage.

### Third-party and cloud dependency
- Financial institutions in Italy increasingly depend on third-party service providers, especially for cloud services, and this trend is expected to grow.
- Two hundred and fifty LSIs and NBFIs (64 percent of the total) use cloud services, mainly for software-as-a-service, with some use for infrastructure and platform services.
- Ninety six percent of the Italian insurance market reported using cloud computing, with many outsourcing essential activities to cloud providers.
- Migration to cloud services remains limited for systemically important FMIs, but multi-cloud and hybrid-cloud adoption is expected to increase.
- Some trading venues (TVs) have outsourced critical functions to cloud providers.
- An Italian central securities depository (CSD) is developing a cloud-based data lake for the ECB-led T2S Recovery Project.

### Cyber and operational risks
- Cyber and operational risks are a major and growing concern due to digital transformation in the Italian financial sector.
- Key cyber threats in 2024 included fraud (AI/deepfake scams), ransomware, social engineering/phishing, DDoS attacks, supply chain attacks, and data theft.
- BdI’s incident reporting framework showed a rise in cyberattacks from 2022 to 2024.
- In 2024, 35 major cyberattacks occurred, and three of them resulted in estimated losses exceeding EUR 2 million each.
- Payment fraud losses reached EUR 246 million.
- Fraud accounts for only a marginal share of total payment transactions (around 0.003 percent in value) and was broadly in line with averages in the European Union.
- There was a sharp increase in operational incidents in 2024, highlighting the risk of widespread payment disruptions from reliance on third-party service providers.
- The threat landscape is shifting rapidly, with increasingly advanced AI models dramatically lowering the barriers to discovering and exploiting cyber vulnerabilities.

### Objective, scope, and exclusions of the note
- Objective: to assess the cybersecurity risk supervision and oversight arrangements in the financial sector.
- Scope includes review of governance and strategy, cyber threat landscape, cyber mapping, cyber regulatory framework and supervisory practices, response and recovery, information sharing, incident reporting, cyber deterrence, and capacity development.
- Coverage: banking, insurance, securities, and pension fund sectors under the responsibilities of the main financial authorities in Italy.
- Coverage includes cybersecurity risk supervision and oversight arrangements for LSIs, NBFIs, and FMIs, including TVs, where Italian financial authorities serve as the competent authority or lead authority.
- Assessment exclusion: the cyber resilience of supervised entities is not covered in the scope of this technical note.

### Conceptual framework and international standards
- The review is guided by the IMF conceptual framework analyzing supervision activities aimed at building resilience: identification of the threat landscape; mapping of the cyber and financial network; creation of coherent regulation; conduct of supervisory assessment; set-up of formal information sharing and reporting mechanisms; adequacy of response and recovery; and preparedness of supervisory agencies.
- The framework is complemented with material developed by international standard-setting bodies and regulatory good practices, including:
  - BCBS Principles for Operational Resilience (March 2021)
  - BCBS Revision of the Principles for the Sound Management of Operational Risk (March 2021)
  - BCBS Cyber Resilience: Range of Practices (December 2018)
  - CPMI-IOSCO Guidance on Cyber Resilience for FMIs (June 2016)
  - CPMI-IOSCO Principles for FMIs (April 2012)
  - FSB Enhancing Third-Party Risk Management and Oversight (December 2023)
  - G7 Fundamental Elements for Third Party Cyber Risk Management in the Financial Sector (October 2022)

### Sources and methodology
- The review is based on both public and non-public sources of information, including:
  - written documentation from responses to the pre-mission questionnaire on cybersecurity risk supervision and oversight,
  - inspection reports,
  - relevant laws and regulations,
  - regulatory guidance,
  - discussions with authorities and relevant stakeholders.

### Governance and strategy: main authorities and responsibilities
- Several financial authorities are responsible for addressing cyber risk: BdI (including UIF), CONSOB, COVIP, IVASS, and MEF.
- Roles and focus areas:
  - BdI
    - supervises cyber risk as part of the operational risk for banks (LSIs), NBFIs (e.g. investment firms, managers of alternative investment funds, management companies, e-money institutions, payment institutions, account information service providers, crypto-asset service providers, issuers of asset-referenced tokens, crowdfunding service providers), FMIs, payment systems and scheme operators and supporting technological and infrastructure providers, wholesale trading venues for government bonds and multilateral trading facilities for euro denominated deposits.
    - shares supervisory responsibilities with CONSOB for some entities according to respective supervisory powers (e.g. issuers of asset-referenced tokens, investment firms, crypto-asset service providers, management companies and managers of alternative investment funds, crowdfunding service providers, TVs for wholesale markets in government securities, CSDs, and central counterparties (CCPs)).
  - CONSOB
    - supervises cybersecurity of TVs, CCPs, and CSDs either exclusively (for trading venues other than wholesale markets in government securities) or with the BdI.
  - COVIP
    - supervises pension funds, including occupational pension funds, insurance-based personal plans and open pension funds.
  - IVASS
    - supervises ICT and cyber risks for insurance and reinsurance undertakings, insurance intermediaries, reinsurance intermediaries, and ancillary insurance intermediaries.
  - MEF
    - defines national financial policies and regulatory strategies, including digital and cyber resilience; contributes to interministerial coordination and oversees legislative alignment; serves as sectoral authority for the Directive on Security Network and Information Security (NIS) and for Critical Entities Resilience Directive (CER) for the financial sector, supported by Banca d’Italia and CONSOB.
  - UIF
    - integrates cyber threat indicators into anti-money laundering and counter-terrorism financing activities, and shares insights with law enforcement and supervisory bodies.

*Source: INTRODUCTION, 1itaea2026007 - INTRODUCTION*

### 8. The coordination mechanism among financial authorities is based on the national

### 8. The coordination mechanism among financial authorities is based on the national

### Coordination mechanism and institutional arrangements
- System-wide responses and recovery actions in operational crises (including those derived from ICT and cyber incidents) are coordinated through CODISE:
  - CODISE is the unit for business continuity of the Italian financial marketplace, chaired by the BdI and participated by CONSOB and major financial operators.
  - Other relevant stakeholders, including the MEF and IVASS, can be invited on a case by case basis.
  - Responsibilities: coordinate system-wide responses and recovery actions; promote sector-wide business continuity and crisis management exercises; enhance operational and cyber resilience of the financial system.
- The coordinating mechanism involves ACN and CERTFin and, when needed, other public and private institutions.
- The National Cybersecurity Cell (NCS) is the main interministerial coordination body at technical and operational level, supporting the President of the Council of Ministers and including the MEF.
  - Tasks: promote prevention and preparedness for potential cyber crises; activate alert procedures; ensure structured dialogue among institutions (including BdI); coordinate responses to incidents with significant effects on critical infrastructures, essential services, or national security.
- MEF designated as the NIS sectoral authority; CER sectoral authority for the financial sector, supported by BdI and CONSOB.
- NIS2 national transposition foresees multiple Prime Minister Decrees structuring collaboration of ACN with the Italian DPA, national CER authorities, national DORA authorities and NIS sectoral authorities.

### Cyber governance for the financial sector
- National Cybersecurity Strategy (2022-2026) aligns with EU frameworks (2020 EU Cybersecurity Strategy, NIS1 Directive, EU's Strategic Compass).
  - Complements: Implementation Plan that includes establishment of sectoral CSIRTs and an ISAC network.
  - Ensures banks, FMIs and other financial institutions participate in national cyber security and resilience ecosystem and comply with National Cybersecurity Perimeter Regulation (PSNC) and NIS2.
  - Two Memoranda of Understanding: ACN–CERTBI and ACN–CERTFin to strengthen collaboration and threat intelligence sharing.
- BdI Strategic Plan 2023-2025 includes cyber resilience as a key component with two major action plans.
- BdI and CONSOB joint cybersecurity strategy (launched 2020) to implement the Eurosystem Cyber Resilience Strategy (adopted 2017; revised 2024).
  - Joint action plan areas: regulation and supervision; public-private cooperation; training and awareness; common oversight tools such as CROE and TIBER‑IT (TIBER-EU TLPT national implementation).
  - Since 2017 FMIs supervised by BdI and national retail payment systems included in ECB-led biennial cyber resilience survey; in 2025 survey extended to PISA entities.

### Observations and recommendations (coordination and governance)
- Findings:
  - CODISE serves as a dedicated unit to coordinate operational crises and sector-wide crisis management exercises.
  - Financial sector cyber resilience strategy focuses on FMIs and TVs and is aligned with the Eurosystem’s regional framework.
  - DORA sets uniform requirements across governance, Board oversight, ICT risk management, third-party risk management, incident reporting, operational resilience testing, and continuous improvement.
- Key recommendation:
  - Revise the cyber strategy for the financial sector to include the remit of all four DORA authorities and align with forthcoming revision of the national cybersecurity strategy.
  - Consider reinforcement of cooperative initiatives addressing payments and digital fraud involving law enforcement and the telecommunications authority.
  - Regular evaluation of cyber governance arrangements including: (i) reporting lines ensuring functional independence; (ii) designation of an independent function including a senior executive (e.g. CISO) relative to risk profile; (iii) greater involvement of senior management and Board members and use of applicable metrics.
  - Encourage Board members to participate in industry-wide cyber exercises that include decision-making scenarios.

### Identification of cyber threat and fraud landscape
- Sources and sharing:
  - BdI integrates strategic, tactical, and operational-level intelligence from institutional counterparts, sharing communities, commercial CTI providers, international publications, and incident reports.
  - Bilateral agreements: BdI–ACN for actionable threat intelligence and IOCs; agreements with law enforcement and financial intelligence units.
  - Memberships: FS-ISAC, TI, FIRST, CIISI-EU.
- CERTFin role:
  - Central hub for exchange of cyber threat information across financial entities and supervisory bodies.
  - Produces sector-specific intelligence: semiannual Threat Landscape Report, monthly security bulletins, Annual Report on Cybersecurity and Fraud.
- Incident reporting trends (pre-DORA and early DORA period):
  - Under BdI’s framework, number of major cyberattacks on banks (SIs and LSIs) and payment and e-money institutions increased from 10 to 35 incidents between 2020 and 2024.
  - For FMIs and payment systems, BdI-supervised entities reported 78 operational incidents during 2020–2024, including 53 related to payment systems and 25 to FMIs (including TVs). Of these, 7 were classified as cyber incidents, all related to malicious DDoS attacks.
  - IVASS received 12 reports of major cyberattacks from supervised entities during 2018 to 2025 involving ransomware, data exfiltration, and incidents involving servers third-party service providers.
  - CONSOB did not receive reports of any major cyber-attacks from its supervised entities.
  - ACN data: financial sector among top ten sectors targeted; incidents doubled between 2023 and 2024 (from 81 to 178 cyber incidents).
- Payment fraud data (2024):
  - Fraudulent transactions using card payment: 63 percent of the total (bulk of payment frauds) and recorded a modest increase versus previous year.
  - Fraud estimated losses: credit transfers accounted for 63 percent of the total in 2024 and recorded a sharp increase on an annual basis (100 percent).
  - CERTFin: around 7,700 fraudulent International Bank Account Numbers reported during 2024, a 230 percent increase from 2023; more than 400 alerts shared on lists of merchants involved in fraudulent activities.
  - CERTFin observed more than 90 percent of fraud cases involved transactions finalized by the user with strong customer authentication, suggesting sophisticated payer-manipulation techniques.
- Consumer complaints (2024):
  - BdI received over 730 complaints related to suspected scam (6 percent of the total amount), a 32 percent increase over 2023.
    - 50 percent of cases involved theft of account login credentials, payment transaction authentication codes, or victim identification data to obtain loans or open bank accounts without knowledge.
    - Just over half of credential thefts via social engineering (smishing, vishing, phishing), sometimes combined with spoofing.
  - ABF managed 4,123 disputes regarding scams in 2024, representing 20 percent of Ombudsman’s litigation; most related to phishing, spoofing, smishing, and vishing.

### Cyber mapping and financial stability analysis
- Activities undertaken:
  - Mapping essential financial services; monitoring institutional and service provider interconnections (outsourcing and concentration risks); periodic surveys on Fintech; identifying vulnerabilities via supervisory activities; leveraging threat intelligence platforms and technological surveys.
- BdI outsourcing census and reporting:
  - 2020 pilot census: over 10,500 contracts, 2,500 direct providers, and more than 1,000 sub-providers.
  - Structured periodic reporting framework on outsourcing for directly supervised entities; collection of DORA-mandated Register of Information (ROI).
- Systemic operator identification methodology (BdI, CONSOB, IVASS):
  - Criteria: substitutability and operational thresholds; identifies real-time gross settlement systems, CSDs, CCPs, securities settlement systems, market access services relevant to liquidity, widely used retail payment services, and services supporting basic liquidity needs.
  - Methodology being updated to align with recent regulatory developments including DORA.
- BdI modeling:
  - Developing a model to analyze cyber risk transmission channels focusing on operational, financial, and confidence contagion; further work to develop indicators and modeling framework to assess cyber event impacts on the banking system.
- Observations and recommendations (mapping and stability):
  - Financial institutions must maintain cyber maps under DORA; FMIs (such as payment systems and schemes, and related technological infrastructure providers) are currently exempt from this requirement but cyber mapping is recommended for them given systemic importance.
  - Authorities encouraged to leverage DORA ROI to create cyber maps at firm and sectoral levels.
  - Quantitative assessments recommended to assess liquidity and settlement risks from failure of a common critical third-party service provider.

### Cyber regulatory framework and supervisory practices
- Legal and regulatory landscape:
  - DORA and the Legislative Decree No. 23/2025 designate BdI, CONSOB, IVASS, and COVIP as competent authorities for DORA compliance; DORA applicable from 17 January 2025.
  - NIS2 transposed through Legislative Decree No. 138/2024; CER transposed through Legislative Decree No. 134/2024.
  - DORA acts as lex specialis relative to NIS2 and CER for entities subject to DORA.
  - PSNC (Decree Law No. 105/2019) introduces reinforced cybersecurity framework for entities responsible for essential functions; applies fully only to banks and FMIs considered critical and governmentally identified on proposal of MEF.
  - DORA does not cover payment systems and schemes and related technological infrastructure providers; applicable regulatory framework for those is sector-specific (BdI oversight regulation 9 November 2021; ECB SIPS recast regulation (EU/2025/1355) and Eurosystem oversight policy).
- Organization of cyber supervision functions (examples):
  - BdI: cyber functions distributed across three Directorate Generals (Financial Supervision and Regulation; Payments and Market Infrastructures; IT; Planning, Organization and Accounting). CERTBI Division functions as BdI CERT.
  - CONSOB: Markets Supervision Division, Market Infrastructures Office, Post‑Trading Office, ICT and Artificial Intelligence Division.
  - IVASS: cyber responsibilities allocated across departments (Prudential Supervision for Insurance Companies; Conduct Supervision; Macro-prudential Supervision; IT resources).
  - COVIP: staff in Pension Funds Supervisory Department with cross-functional expertise.
- Standards and supervisory alignment:
  - Common frameworks used by entities: ISO/IEC 27000 series; NIST-CSF; COBIT; ITIL; ISAE 3402 Type II; ISO/IEC 22301:2019; CIS Controls; ENISA Guidelines; TIBER-IT.
  - BdI offsite supervision aligned with EBA Guidelines on ICT Risk Assessment under SREP and DORA provisions.
- Supervisory practices:
  - Offsite supervision covers ICT risk management, incident reporting, third-party risk management, payment services, emerging technologies, DORA readiness, and ITRQ analysis. LSIs’ IT risk classified as part of operational risk within SREP.
  - On-site examinations: full-scope inspections for LSIs and NBFIs; FMIs and payment systems supervised on-site when under prudential supervision; inspections tailored by risk-based and proportional approach.
  - On-site inspections of CSPs for payment systems have not been conducted to date except for entities already subject to prudential supervision.
  - BdI maintains structured database with DORA ROI and other data, though not all data structured.
- Supervisory metrics and processes:
  - BdI ICT risk rating scale: 1 (Satisfactory), 2 (Broadly satisfactory), 3 (Broadly unsatisfactory), 4 (Unsatisfactory).
  - IVASS and NBFIs use similar four-level or 0–4 scoring approaches.
  - For 2022-2024 and first half of 2025, there were 196 on-site inspections covering cybersecurity as part of operational risk assessments.
  - Four ICT service providers subject to full-scope inspections during this period; another full-scope inspection ongoing and to be finalized by end of 2025.
- Remediation and enforcement:
  - Follow-up processes: banks and NBFIs must submit action plans post-inspection; off-site supervision monitors remediation.
  - Sanctions: until DORA, deficiencies were considered within operational risk/organizational shortcomings; with DORA (national implementation March 2025) dedicated enforcement actions and sanctions may be applied.
  - Potential sanctions under PSNC or NIS2 can reach fines up to EUR 10 million or 2 percent of global turnover.

### Observations and supervisory recommendations (regulatory framework)
- Key recommendations:
  - Complete cyber resilience assessments for remaining FMIs and CSPs using proportionality; fold CROE assessments into overall entity assessments and monitor remedial actions periodically.
  - Complement offsite inspections with audit and testing reports by independent parties for LSIs and NBFIs (e.g., pooled audits, TLPT results relative to risk profile).
  - Increase focus on cyber risks during on-site inspections and give attention to new entrants; use proportionality to determine depth of investigations.
  - Conduct thematic cybersecurity reviews for insurance and pension sectors.
  - Promote operational resilience guided by BCBS Principles for Operational Resilience and PFMI for FMIs; exercise enforcement powers as needed for non-compliance with cyber risk regulations.
  - For systemically important FMIs oversight expectation: two-hours RTO.

### Response and recovery
- Exercises and testing:
  - National: BdI designs, organizes, and conducts exercises within CODISE in collaboration with CONSOB and stakeholders; exercises connected to G7-CEG.
  - European: BdI participates in yearly table-top exercises by ECRB; participated in 2024 SSM Cyber Resilience Stress Test involving 109 banks (all Italian SIs), 28 extensively tested with on-site visits.
  - International: BdI, CONSOB, and MEF participate in G7-CEG cybersecurity exercises; BdI contributes to organization, scenario design, and follow-up.
  - CERTFin organizes industry-wide exercises (REDFin methodologies), red teaming to table-top simulations; average of two table-top exercises annually in 2023–2024; 2025 first exercise involved about 10 financial entities.
  - IVASS and insurers participate in sectoral crisis management exercises; IVASS participated in March 2024 EIOPA two-phase walkthrough exercise.
- DORA testing requirements:
  - Entities in scope must establish a structured testing program (risk-based) including vulnerability assessments and penetration testing.
  - A subset of institutions identified by competent authorities must conduct advanced testing (TLPT) at least once every three years (criteria in Commission Delegated Regulation (EU) 2025/1190).
  - CSDs and CCPs must perform vulnerability assessments prior to deployment or redeployment of applications, infrastructure components, and ICT services supporting critical or important functions.
  - For all DORA-in-scope institutions, security requirements must be tested before deployment into production.
- TIBER-IT and TLPT:
  - TIBER-IT (jointly adopted 2022 by BdI lead, CONSOB, IVASS) is the national implementation of TIBER-EU for TLPT; aligned with DORA and Delegated Regulation (EU) 2025/1190.
  - Since 2022, eleven voluntary TLPT conducted: five banks, one ICT provider, two e-money institutions, three insurance undertakings.
- CODISE role in crises:
  - CODISE coordinates crisis communication among BdI, CONSOB, systemic operators, and other authorities; activated for systemic events and acts as main contact point for cross-border cyber crises.
  - CODISE enables structured, secure information exchange, early alerts, joint impact assessment, and conducts business continuity exercises at national and international levels.
- Playbooks and preparedness:
  - CERTFin regularly updates playbooks for scenarios (ransomware, DDoS) outlining preparedness, detection, response, recovery steps.
  - BdI internal incident management processes and playbooks define roles and emergency communication templates; IVASS follows BdI rules and playbooks under a collaboration protocol renewed every five years.
- Cyber resilience stress testing:
  - Cyber resilience stress testing for FMIs and PISA entities not yet conducted; tool part of revised Eurosystem Cyber Resilience Strategy to assess recovery capabilities.
  - DORA requires entities to prepare cyber maps of critical information and ICT assets, including third-party dependencies.

### Observations and response/recovery recommendations
- Continue cyber stress testing exercises including supply chain attack scenarios that test exit strategies for critical third-party relationships and cross-sectoral exercises with energy and telecoms.
- Use advanced security testing (e.g., TIBER-IT TLPT) results for continuous improvement of response and recovery plans; for systemically important FMIs oversight expectation is two-hour RTO and TLPT results can inform practicable remedial actions.
- Evaluate onboarding COVIP to CODISE given COVIP’s status as one of four DORA authorities.

### Information sharing and incident reporting
- Information sharing arrangements:
  - CERTBI focal point for collection, analysis and sharing related to BdI and IVASS IT-assets; CERTFin established as cyber information and intelligence sharing arrangement for whole financial sector.
  - CERTFin maintains bilateral cooperation agreements with peer organizations (Nordic Financial CERT, FS-ISAC Japan, FinCERT Jordan, FinCERT Kuwait).
  - BdI’s CIISI-EU role provides broad intelligence access; 4CB group exchanges cyber threat information to protect TARGET Services.
  - Multiple MoUs exist: CERTBI–ACN; BdI with Carabinieri military police; BdI with Dipartimento della Pubblica Sicurezza.
- DORA incident reporting (from 17 January 2025):
  - Unified European framework for reporting ICT-related incidents replaces previous frameworks.
  - Entities in scope must report major ICT-related incidents mandatorily and may voluntarily report significant cyber threats.
  - DORA designates a single competent authority per supervised entity type to receive reports; reports forwarded to other relevant authorities as required.
- Early DORA reporting statistics (first six months of DORA framework):
  - BdI received 27 cyber-attack notifications:
    - 13 data exfiltration/manipulation
    - 10 supply-chain attacks
    - 9 ransomware/data encryption
    - 6 social engineering/phishing
    - 5 identity theft
    - 4 DDoS
    - 3 other types
  - Targets: SIs (10), LSIs (5), payment institutions (2), e-money institutions (1).
  - Nine incidents reported by entities not previously subject to DORA: 8 asset management companies and 1 investment firm.
  - As of October 2025, no cyber incidents reported by entities operating payment systems or FMIs within DORA’s scope; one incident on a TV reported end of October.
- Reporting templates and data collection:
  - ESAs developed Excel (XLSX) and JSON formats; Italian entities currently use XLSX.
  - Data collected in accordance with Commission Delegated Regulation (EU) 2024/1772 and Commission Delegated Regulation (EU) 2025/301 and Implementing Regulation (EU) 2025/302.
  - CSIRT Italia maintains a national cross-sectoral database of cyber incident notifications and supports national situational awareness correlating incidents across sectors.

### Observations and information-sharing recommendations
- Improve information sharing on cyber risk supervision and evaluate onboarding COVIP to CERTFin:
  - Establish MoUs to share capacity-building and supervisory information related to cyber risk management.
  - Consider COVIP adhesion to CERTFin given COVIP is one of four DORA authorities and has common supervisory interests (e.g., pension services offered by banks and insurers).

### Cyber deterrence
- Cybercrime regulation embedded in the Italian Criminal Code and updated in line with EU directives and international conventions (e.g., Budapest Convention).
- ACN/CSIRT Italia coordinates with law enforcement; ACN signed three MoUs with law enforcement for information sharing on cyber incidents.
- BdI and IVASS cooperate with law enforcement and financial institutions to detect, investigate, and prosecute cyber criminals.
- CERTFin collaborates with Italian National Police; Poste Italiane and Ministry of the Interior agreements to strengthen cybersecurity for public services.

### Capacity development
- Institutional capacity-building:
  - BdI created/reinforced three specialized units: oversight of third-parties/outsourcers; ICT risk horizontal analysis; business continuity and cyber resilience.
  - Internal committees: Cybersecurity Committee and DORA Steering Committee; staff exchanges; recruitment of IT/cybersecurity experts.
  - Advanced training programs and staff participation in JETs under the DORA oversight framework.
  - Dedicated recruitment plans for IT/cybersecurity specialists at BdI, CONSOB, IVASS.
- Awareness and training:
  - Workshops, conferences, and public awareness campaigns by BdI, CONSOB, IVASS, CERTFin, and ACN (e.g., videos, television spots, weekly national radio segment, Navigati TV campaign).
  - BdI’s Corporate Academy and support for certifications and Master’s degrees; IVASS collaborates with BdI for internal training and offers yearly technical course catalogue.
- Staffing levels (cyber/ICT expertise):
  - BdI: 40 staff with ICT/cyber expertise in Banking and Financial Supervision, 30 in Payments and FMIs, and 20 in Information Technology.
  - CONSOB: 15 staff dedicated to cyber and ICT risk supervision and internal cybersecurity.
  - COVIP: 26 staff with cross-functional expertise but no centralized cyber risk supervision function.
  - IVASS: 4 staff for supervision and one IT department expert; relies on external consultants and BdI staff.
- Recommendation:
  - Support ongoing staff training on cyber risk supervision and oversight, pursue professional certifications, and reallocate resources to support on-site cyber risk supervision proportionate to entities’ risk profiles.

*Source: IMF staff summary of Chapter 8 (Italy).*

---


_Source: https://www.imf.org/-/media/files/publications/cr/2026/english/1itaea2026007.pdf_