Revised Banking Super­visory Require­ments for IT

On August 16, 2021, the revised “Super­visory Require­ments for IT in Financial Insti­tu­tions” (BAIT) were published in the BaFin circular. The circular imple­ments the “Guide­lines on security measures for opera­tional and security risks under the PSD2” and the EBA’s “Guide­lines on ICT and security risk management” at national level. Along with this, the “Minimum Require­ments for Risk Management” (MaRisk) and the “Payment Services Super­visory Require­ments for the IT of Payment and Electronic Money Insti­tu­tions” (ZAIT) were also amended.

Tougher require­ments for credit institutions

With the amendment of the BAIT, credit insti­tu­tions are faced with new and more stringent require­ments. In particular, there are three new chapters.

One signif­icant change is the increased consid­er­ation of opera­tional IT security. With a separate and new chapter, this is moving further into focus. The imple­men­tation of the specified require­ments practi­cally requires the operation of a security infor­mation and event management system (SIEM). This also includes the estab­lishment and operation of a Security Opera­tions Center (SOC). Opera­tionally, regular checks must be carried out, such as deviation analyses (“gap analyses”), vulner­a­bility scans, penetration tests and the simulation of attacks (“red teaming”). The new require­ments result in the estab­lishment of a profes­sional cyber security infra­structure and extensive, independent internal infor­mation security structures.

IT emergency management also has its own new chapter. In this chapter, the require­ments are consol­i­dated with those from section AT 7.3 of MaRisk in order to obtain uniform national require­ments. In addition, the require­ments regarding emergency planning and precau­tions, BCM, disaster recovery, and backup strategies, including the involvement of service providers, are being tightened up or made more precise.

The third new chapter is the chapter on management with payment service users, which origi­nates from the amended ZAIT. This describes require­ments for insti­tu­tions to actively support and advise their payment service users on security-related risks, partic­u­larly on the issue of fraud.

Mastering new challenges hand-in-hand

The changes pose major challenges for the insti­tu­tions affected. This concerns in particular the required know-how and the limited resources on the market. We gladly advise and support you in the imple­men­tation of the regulatory require­ments for infor­mation security as well as in the prepa­ration of required evidence.