Developing a Progressive IT Risk Management Regime in the ADGM

[Music] okay hi good afternoon everyone so my name is zre I'll be walking you through some of our thinking around it risk management here in the adgm um it's an important factor I mean this morning sorry this afternoon we started off this risk Forum with an address on cyber security and the question then is yes cyber secur is very important it's an it's an outside in perspective in terms of protecting you from external threats but when we talk about it risk we're talking about the broader domain of it where it's not just about external threats but also internal threats and your operational resilience as well very good example is earlier this year there was an outage by the company called crowd strike which I'm sure some of you were affected many of your companies would have been affected this was not a Cyber attack on a cyber security company this was plain and simple a lapse in an internal control that led to an outage of a system that is used by almost everybody around the world and especially the impact to those of you who are using Windows as part of your day-to-day operations so when we talk about it we're not just talking about external threats and from a cyber security perspective also talking about internal resilience and practices as well so broadly what we have observed here in the adgm are that companies typically fall within four buckets when it when we're talking about their technology implementations on the extreme left the pointer is not very strong but you can see that on the extreme left what we are talking about are companies that build and develop their own systems they have full control over their technology and what this means is that they can make a decision on where their strategy is going to lead them to how it's going to support the business how they're going to run their operations and as we go further to the right what we will see is the level of control reduces the next bucket of ENT ities that we see are typically companies that rely on their group for it pro uh Services some control is available in terms of how they're going to manage the relationship with their group it functions or with their head office to to decide what kind of functions they need to supplement the services within the local context the next bucket are typically companies that are based here but they Outsource it to external companies they have greater control in that they can decide where they want to go but ultimately they are subject to the availability of functions and features in the marketplace and on the extreme right and this is something that we are seeing a lot more of within the region and definitely here within the AG adgm are companies that have a very lean footprint in technology and this lean footprint in technology is because many web services are available they have sliced up the entire Financial ecosystem they have sliced up every single aspect of banking every single aspect of um Securities trading every single aspect of insurance business business and they' have come up very tailor made solutions that you can just subscribe to on a monthly subscription rather than paying thousands of dollars or millions of dollars in licensing fees now why is this important to appreciate this is important to appreciate because as a regulator we must understand what is happening in the market if we don't we will not be able to tailor make our regulations to be fit for purpose and fit for the market so having an understanding of this is vital for us to to think about what's happening now why is this happening to begin with now 10 years ago a major concern among Regulators was the transition from traditional it implementations with on premises infrastructure in data centers to Cloud Computing Services provided by cloud service providers 10 years ago many of these cloud service providers were were not very mature but now in 2024 many of them have a plethora of services and functionalities that will enable you to secure your implementations and build very resilient systems that can provide services to your customers today what we are seeing is another step going Beyond cloud service cloud computing what we see are many companies leveraging on these very modular web services to deliver services to customers as well as automate their internal processes the traditional view of a regulator imposing strict requirements and strict rules in the world of it is going to change and it has to change because if you are relying on web service provider where you subscribe cribe online to some monthly subscription plan you don't have full control in terms of how they are deploying the IT services so what this means as a regulator when we want to tell our firms that you need to make sure your it environment is robust we need to think about what kind of controls that financial institutions have over these web service providers so as but at the same time we also see as the new fintech companies that get licenses they may start off with web services but over time they wish to build more proprietary proprietary applications because they can't find the right fit of a solution in the market and what happens what we see is they transition slowly back to the left and they start building their own systems so while we have to address what's happening on the right we also have to keep our framework in tandem with the developments that are more traditional and where software development is still practiced so what we have done is 3 weeks ago we published a finalized version of the it risk management guidance and this guidance covers a broad spectrum of it domains now you might think that this document might be really Technical and difficult for people to understand but what we have done is with tailor made it such that different people within the organization can look at this document and appreciate the the elements that are relevant to their work so for example if you're a CEO if you're a board member if you're a compliance team member or even even in the legal team the first section on establishing a culture on it risk management is relevant to you because we're talking about governance we're talking about risk management we're talking about third party management these are not technical topics but of course if you're member of the IT team you want to delve into what are the best practices that I should adopt to build my systems to run my operations then of course the second and the third chap uh sections are relevant to you and if you are a more Forward Thinking institution you want to implement a Technologies and blockchain Technologies like we saw here today there's a robot suddenly appearing in the panel then the fourth section is relevant to you because we provide a list of best practices for you to build governance models to manage these new and emerging Technologies now of course setting out a best practice guidance is not enough over the years the FSR has published multiple guidance on different topics we're talking about mitigating cyber threats uh delivering robo advis Services apis Biometrics blockchains and cloud computing best practice guidance that are already out there but fundamentally in order for us to raise the Baseline of security controls within the adgm we cannot rest on our laws and depend on something that was written almost 10 years ago when the industry was still growing and the fintech culture was still growing so in 2025 we will be publishing a new set of rules to strengthen our requirements around it it risk cyber security risk and contributing to the overall framework of operational resilience which is something that even International standard setting bodies are moving towards so looking forward it's something that the fsra is seriously looking into and as we grow we definitely want to continue to provide a very safe and secure environment for financial institutions as well as protect the interests of our customers clients as well as investors thank you oh [Music]