CBC Governor: Cyber risk and data security “by far” the biggest threat for banks

Central Bank of Cyprus (CBC) Governor Christodoulos Patsalides said that cyber risk and data security are by far the biggest threat for banks right now, which he said must adapt quickly to identify and address evolving challenges effectively.

Addressing the 12th Banking Forum & FinTech EXPO in Nicosia, Patsalides outlined the CBC’s strategic vision and priorities. “In an ever-evolving global and digital economy, we are committed to leading the way in fostering a resilient, innovative, and sustainable financial sector for Cyprus,” he said. “Our agenda focuses on embracing digital transformation, ensuring robust governance, addressing societal and environmental challenges, and safeguarding financial stability.”

The CBC’s key priorities include advancements in the digital economy, the evolving role of digital payments, the potential introduction of a digital euro, and the regulatory frameworks that ensure responsible governance and societal considerations in our financial systems. “Through these efforts, we aim to strengthen Cyprus' position as a dynamic player within the European financial landscape,” Patsalides said.

According to the governor, the Cyprus economy has shown resilience and adaptability despite the consecutive significant geopolitical challenges, including the ongoing conflicts in Ukraine and the Middle East. With a robust growth rate well above the EU average and a strong fiscal position, Cyprus has been consistently posting surpluses that have bolstered public finances. “As a result, international rating agencies have upgraded their ratings well within the investment grade, highlighting our sound economic management, fiscal discipline, and reforms in the banking sector,” he said.

Banking sector in Cyprus has built up remarkable resilience and robustness

As for the banking sector, Patsalides said this has built up remarkable resilience and robustness despite a series of unprecedented and successive crises in recent years. The sector's solvency, as indicated by the Common Equity Tier 1 (CET1) ratio, rose to 23.5% in the third quarter of 2024, achieving its highest level on record and significantly surpassing the European average of 16.0%. Additionally, the Liquidity Coverage Ratio (LCR)—a key indicator of credit institutions' capacity to withstand severe liquidity stress—reached 336% in September 2024. “This level exceeds the regulatory minimum of 100% by more than threefold and stands well above the European average of 161.4%,” the CBC Governor explained. The non-performing loan (NPL) ratio fell to 6.5% in the third quarter of 2024, marking its lowest level since 2014, when the NPL definition was standardised across the EU.

However, Patsalides said there is no room for complacency as macroeconomic uncertainty, geopolitical risks, and emerging threats like cyber and climate risks grow. “Banks must adapt quickly to identify and address these evolving challenges effectively. Moreover, technological advancements bring about a new landscape in which banks are called upon to compete. The pursuit of an appropriate business model is key,” he stressed.

Digital economy and global digital trends

Looking to the future, the governor said the digital economy will be a defining feature of global trends. “Technology has the ability to sustain and improve our standards of living and the long-term productivity of our economy,” he said.

Examples of innovative technologies used in financial services (usually referred to as FinTech) include artificial intelligence, cloud computing, digital wallets, big data analytics and biometrics. These technologies have been applied to improve customer service, automate payments, reengineer business processes, detect suspicious activity, and assist with customer profiling and digital onboarding.

However, said Patsalides, “we are yet to see the realisation of potential in other promising new technologies such as distributed ledger technology (DLT), smart contracts and tokenisation”.

Cyber risk and data security “by far” the biggest threat for banks

Cyber risk and data security continue to be by far the most prominent driver of operational risk for banks, said Patsalides. Technological advances with increased sophistication, growing reliance on digital solutions, but also growing capabilities of cyber offenders, have all resulted in enhanced risk exposure for banks, including vulnerability to sophisticated cyber-attacks, he pointed out. “Cyber risk is often driven by geopolitical risk, thus raising overall risk to a much higher level. Supervising these risks remains one of our priorities.”

To take full advantage of the potential of innovative technologies responsibly while managing risks, common supervisory and regulatory approaches are essential, said Patsalides. The EU has introduced key legislation such as DORA, PSD3, FiDA, MiCAR, and the AI Act, which aim to strengthen financial sector resilience and boost consumer and investor confidence by guiding responsible innovation. “Recognising the evolving market dynamics, the Central Bank of Cyprus has established an Innovation Hub to foster dialogue with fintech stakeholders and support domestic financial innovation,” he said.

Digital payments in Cyprus

For the CBC Governor, a key element of the digital economy is the rapid rise of digital payments. “We find ourselves in an era where digital transformation is reshaping economies, and Cyprus is no exception,” said Patsalides. “One of the most prominent trends is the proliferation of digital payments, which now capture around 96% of cashless payments. At the same time, preference for cash payments is shrinking, as evidenced by a remarkable decline of 11% since 2022 that placed Cyprus at the top of euro area countries. Cypriots use cards 1.3 times more frequently than their European peers, while our contactless card payments capture more than half of all card payments consistently since 2022. This reflects the readiness of local businesses to accept cards and to opt for terminals that embed Near-Field-Technology.”

In the same vein, he said, e-commerce is exhibiting gradual expansion, manifested by online purchases via cards almost doubling over a six-year period to 28% of the total of card payments. “It is indeed remarkable that the use of mobile phones for online purchases has almost reached one quarter of the total, outperforming the EU average which stands at 16%,” said Patsalides.

As of 9 January, instant payments have become a reality for all banking participants in Cyprus. This signifies that account-to-account payments can be effected at the speed that people demand in the digital and social media age: transmission within 10 seconds, with immediate access to funds on a 24/7/365 basis, as opposed to the current 1-2 days waiting time. Consumers and businesses will reap the benefits in the months to come, according to the governor.

E-money payments are gaining traction

E-money payments are gaining traction, driven by opportunities in fintech, e-commerce, and digital payments, said Patsalides. Having licensed four electronic money institutions this year, the Central Bank of Cyprus now supervises 27 electronic money institutions and 11 payment institutions.

“As part of our broader strategic agenda, we are committed to drawing on international experience in supporting the Central Bank of Cyprus in refining its approach for regulating, licencing and supervising Electronic Money Institutions (EMIs) and Payment Institutions (PIs) in Cyprus,” said Patsalides.

In December, the CBC, announced the establishment of a comprehensive licensing and supervisory strategy for these institutions. To develop this strategy, the CBC appointed an international consultancy firm whose experts, in collaboration with CBC staff, conducted an analysis of the sector and its inherent risks.

The objective of the new strategy is to pursue the prudent and sustainable growth of the sector, Patsalides explained. The aim, he said, is to enhance and enrich the licensing processes for institutions applying to participate in the sector; strengthen the supervision of institutions by implementing a risk-based supervisory approach for each institution and enriching supervisory tools; and adopt best practices for the operation of the sector.

To achieve these objectives, a Division for the Supervision of Electronic Money and Payment Institutions is being established, which will henceforth undertake the prudential supervision of the sector.

Negotiations continue in Brussels over digital euro

Providing an update on the digital euro, Patsalides said that as legislative negotiations continue in Brussels, the Eurosystem is progressing through the first part of the preparation phase for the digital euro, focusing on calibrating the holding limits without compromising financial stability or bank intermediation as the banks will retain their role vis-à-vis their customers. “The ECB continues to rapport with the market, with specific holding entitlements to be defined later,” he said. “The rulebook formulation, developed with stakeholder input, will set standards for future digital euro distributors, leveraging existing frameworks for cost efficiency and allowing flexibility for innovation. Consumers and businesses prioritise functionalities like conditional payments and effortless bill-splitting, guiding expectations for future services.”

Moving on to the platform and infrastructure preparations, he said the ECB is now selecting candidates from its recent application process and plans to enhance engagement with distributors to ensure readiness for the potential issuance and successful distribution of the digital euro, if and when the decision to issue is made.

ESG Regulatory Landscape: Governance, Society, and Climate Change

“As we embrace these innovations, we remain steadfast in our commitment to strong governance,” said Patsalides. “Governance, a core pillar of ESG, is crucial in enhancing transparency, accountability, and ethical standards in financial institutions. Strong governance enables sound lending decisions, reduces conflicts of interest, and ensures compliance with regulations including the updated Directive on Corporate Sustainability and ESG provisions in the recently enacted CRD 6, protecting institutional reputation and minimising financial risks.”

He said the Central Bank of Cyprus actively engages in thematic reviews, stress tests, and in-depth analyses led by the European Central Bank to assess institutions' preparedness on climate risk and its integration into their strategy, governance, risk management and disclosures. This supervision helps ensure credit institutions speed up their preparations to manage ESG risks while meeting necessary sustainability and resilience standards. Additionally, the smaller institutions, directly supervised by the CBC, were requested to develop implementation plans, with specific milestones, in order to advance the management of climate related risks, in line with the ECB’s 13 supervisory expectations which stipulate how banks should integrate climate and environment risks into their business models and strategies, governance and risk appetite.

The CBC has also set up internally a Sustainability Team, aiming to support the CBC in addressing climate change in line with its mandate to maintain price stability, safeguard financial stability, supervise banks and support the general economic policy of the State, while also contributing to the target of net zero carbon emissions, and the continuation of strong governance.

Concluding, Patsalides said: “The strategic vision of the Central Bank of Cyprus is built on the pursuit of price stability and financial stability in its capacity as the macroprudential authority of the country. By embracing the digital economy, ensuring robust governance, and addressing climate change, we are positioning Cyprus as a forward-looking financial hub in Europe. Together, we will navigate the challenges and opportunities of the future, ensuring stability and prosperity for all.”