Fintech is particularly vulnerable to cybersecurity threats because it combines high-value financial assets, digital-first infrastructure and rapid software development life cycles, which adversaries are targeting.
So says Joe McCann, CEO of Intercept Technologies (Intercept Fintech), which provides cybersecurity, cyber resilience, risk management and transformation services to fintech companies (credit institutes, payment institutes, electronic money institutes, crypto-asset service providers), both in Ireland and internationally.
Intercept supports fintech firms on their digital transformation journey with the Digital Operational Resilience Act (DORA), which covers ICT risk management, incident reporting, resilience testing and third-party risk oversight. It is also increasingly helping crypto-asset service providers comply with the Markets in Crypto-Assets Regulation (MiCA), which is the EU’s uniform legal framework that regulates crypto-asset issuers, public offerings and service providers across member states.
“We support these firms with the regulatory landscape in relation to cybersecurity, anti-money laundering, countering financial terrorism, payment card industry (PCI) regulations, and ISO 27001 and data protection, which ensures good security standards,” McCann explains. “We also help them maintain their compliance, their cybersecurity posture and their services with our managed annual IT services to support them.”
READ MORE
McCann notes that Intercept can find itself working with firms that are headquartered anywhere. “We are an Irish business, but with international delivery, so we deliver services in the UK, Ireland, Spain, Italy, Lithuania, and also Malta and further afield,” he says. “Our industry is international, because when you talk about fintech regulation and cyber, you are processing data on behalf of EU subjects, even if you are not located here. It doesn’t matter whether you’re American, European or Asian, you still need to protect all your data subject.”
Just as fintech companies can operate from anywhere, cyber attacks know no borders, McCann warns. But not only must organisations be wary of malicious actors, there is also an increased compliance burden thanks to enhanced legislation in this area.
“We help fintech firms implement appropriate and proportionate technical organisational measures for firms to help them achieve authorisation and compliance with the Central Bank of Ireland and/or any other regulators,” says McCann.
Real-time monitoring for the early detection of threats is one of the services Intercept provides. “We help firms stay one step ahead of the adversary at all times by using our next-generation threat intelligence, which includes deep-web and dark-web monitoring.”
Some fintech firms are lagging behind on cybersecurity but the potential impact of a cyber attack cannot be understated, McCann warns. “It’s the difference between having a business and not having a business,” he says. From supply chain disruption to extended downtime, the result can be catastrophic.
Fintech firms are utilising AI to innovate and develop new products and services but, in parallel, AI is increasingly being used by bad actors to circumvent standard cybersecurity measures. An already heavily targeted sector, the rise of AI and machine learning has taken that to new heights.
“AI has completely changed the game in terms of the scale and the scope of the threat,” McCann says. “AI has the consequence of more sophisticated cyber attacks taking place in firms and thus more regular outages occurring in firms.” Firms that do not have the appropriate governance in place under the EU AI Act are particularly vulnerable − not that it has entered full force, he adds.
“The last thing firms are thinking about is what compliance they need to follow with AI, because they’re using AI as a tool to empower them, but they’re not in some cases compliant with the EU AI Act, be it due to resourcing, time or understanding.”
Yet awareness in this space is growing. “Because we are in such a heightened geopolitical time, with cyber warfare continuing to target fintechs, the Central Bank of Ireland has written to CEOs of crypto asset service providers and other fintechs to ask them what they are doing to counter the impact of cyber attacks from adversaries,” McCann notes.
The Central Bank has also brought in PCF-49, the need for a preapproved chief information officer (CIO) in high-risk firms under its Fitness and Probity regime. “Private fintech companies are now on the front line,” says McCann. “The CIOs of fintech companies weren’t trained to deal with the impact of geopolitics but now the C-suite find themselves at war with cyber adversaries.”
