Senior management of FIs will monitor the implementation of this framework on an ongoing basis and the board of directors will review the implementation process on a quarterly basis, the SBP said. According to BPRD Circular No. 05 of 2017, the evolving role of technology and automation in the banking/financial services sector is becoming increasingly complex. A growing number of Banks/DFIs/Microfinance Banks are leveraging technology to offer innovative products, efficient services and venture into new business models.
As technology becomes an integral part of the business and operations of FIs, such technology usage and dependence, if not properly managed, may heighten technology risks. Therefore, with a vision to provide baseline technology governance and risk management principles to the FIs, State Bank of Pakistan has developed a framework on "Enterprise Technology Governance & Risk Management in Financial Institutions".
The framework has been developed after extensive consultation with both internal & external stakeholders. Earlier on March 14, 2017, the draft of the framework was published for public consultation. The framework is based on principles of international standards and best practices for technology governance and risk management including cyber security.
The framework will apply to all FIs which includes commercial banks (public and private sector banks), Islamic banks, Development Finance Institutions (DFIs), and Microfinance Banks (MFBs). According to SBP, this framework shall be integrated with the FIs'' overall enterprise risk management program to identify, measure, monitor and control technology risks. The framework is not "one-size-fits-all" and its implementation needs to be risk-based and commensurate with the size, nature and types of products/services offered and complexity of technology operations of individual FI.
Further, FIs shall exercise sound judgement in determining the applicable provisions relevant to their technology risk profile while implementing this framework. The FIs may follow a phased approach towards implementation of the framework starting with a gap analysis between their current status and this framework, development/update of the policy framework, on-the-ground implementation and compliance reporting.
It aims to provide enabling regulatory environment for managing risks associated with the use of technology. The instructions aims to enhance the proactive environment in FIs to various aspects of the information technology, security, operations, audit and related domains and to create overall safe and secure technology operations in FIs that will benefit and enhance the confidence of all the stakeholders.
Copyright Business Recorder, 2017