Data Security and Compliance for Banking and Financial Services Institutions - Part 1

From bartering to banknotes to Bitcoins—the history of money is inextricably tied to the history of the banking sector. And for as long as banks hold these valuable assets in their custody—whether in the form of Personally Identifiable Information (PII), Bitcoin, or digital currency—they will have a target on their backs.

In the most recent World Retail Banking Report, 57% of consumers stated preferring online banking to traditional branch banking, and 55% of respondents now prefer using mobile banking apps to stay on top of their finances, up from 47% in the pre-pandemic era.

That said, personal and financial information has a hard time staying private in the digital ecosystem. It’s like making a Faustian bargain: convenience in exchange for potential vulnerability.

Hence, the banking sector that’s been pooling resources on digitization must apply their camaraderie in a different field: privacy and data security.

Banking, Compliance, and the Changing User Mindset

The technical prowess of the modern-day financial service providers has enabled them to create a confidence level amongst their users wherein they consider them a viable alternative to traditional banking.

For financial services, privacy and data security are not just a key competitive advantage but a prerequisite for existing in the business.

Hence, abiding by international, regional, and industry-specific regulatory compliances for personal and financial data is an absolute must—either as data controllers or data processors.

There is also a user mind shift aspect to that.

If you’ve noticed, Apple now asks user permission before tracking their activities, Google is working on a plan to disable the various tracking techs in their chrome browser, and Facebook’s army of engineers are burning the midnight oil on developing a new ad tech that doesn’t rely on users' personal data.

These developments indicate a changing user mindset. The new tech-savvy user is not particularly eager to share his personal information online.

This more pragmatic and realistic generation of consumers wants to know the intent behind collecting their private data, how it is being managed, and how safe it is.

They want to be in control of how and when their personal data can be used.

Top Three Compliances for the Financial Sector

It can be tough for the banking personnel to be on top of all the regulations the banking sector must comply with. Moreover, when it comes to their citizens' data, these regulatory requirements vary starkly across different geographies.

If a bank operates in, for example, India and UK, a one-size-fits-all approach to data protection would not work, as India and UK define data compliance differently.

There are three major international security standards in banking for financial institutions:

1. PCI DSS
   
   The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that any organization that stores, processes, or transmits cardholder data maintains a secure environment for that sensitive data.
   • Standards specifying requirements for handling and protecting credit card data.
   • Penalties- $5000- $10,000 per month
     
2. ISO/ IEC 27001
   
   ISO 27001 (formally known as ISO/IEC 27001:2005) is a specification that outlines the requirements for Information Security Management System (ISMS). An ISMS is a framework of policies, processes, and procedures that helps an organization manage its information security risks.
   • Not mandatory but highly recommended.
   • No penalties. Can assist with GDPR compliance.
     
3. SWIFT CSP
   
   Society for Worldwide Interbank Financial Telecommunication (SWIFT) is a Belgian cooperative society providing services related to the execution of financial transactions and payments between banks worldwide. Financial organizations that use SWIFT services must comply with SWIFT Customer Security Program (CSP) requirements. The framework outlines requirements to ensure data protection, access management, and responding to incidents.
   

Local Guidelines, Laws, and Directives for the Financial Sector

Apart from the above-listed top three international regulatory compliances, there are more such regulations that vary in terms of requirements on a region-to-region basis. Let’s explore the most well-known:

1. SOX
   
   The Sarbanes-Oxley (SOX) act of 2002 is a law passed by the U.S Congress to protect investors from financial scams.
   • The SOX framework outlines security best practices for avoiding fraudulent financial transactions through a system of internal checks.
   • Mandatory for all public companies—including those in the financial sector.
   • Non-compliance can lead to penalties up to $5 million and imprisonment up to 20 years.
     
     
2. GLBA
   
   Under the Gramm-Leach-Bliley Act (GLBA), a federal law in the United States, organizations collecting and processing financial data, (ex: financial services companies and universities that process student loans) must meet a set of privacy regulations and provide customers with complete transparency into how their data is stored, processed, and secured.
   • Non-compliance can lead to a civil penalty of up to $10,000 per violation.
   • Imprisonment up to 5 years.
     
     
3. FINRA
   
   The Financial Industry Regulatory Authority (FINRA) oversees US-based broker-dealer firms, registered brokers, and trade of financial assets.
   • Non-Compliance can lead to suspensions and hefty fines.

In the End

You can make use of these twelve best practices for banking and financial cybersecurity compliance to get a complete view of your organization’s most critical data and systems and protect them with the right cybersecurity controls.

Stay tuned for the second part of this blog series where we lay down the data security best practices that can help you abide by these laws and remain on top of your data security game.

Fortanix has been working with some of the most prominent names in the banking and financial industry and helping them secure their data through data security services that include but are not limited to data encryption, key management, tokenization, FIPS 140-2 L3 grade HSMs and an array of other data security services.

You can read more about our data security capabilities in the Fortanix Data Security Manager Solution Brief here.

Want to know more? Feel free to reach out to us.

Interested in a free trial? Click here.