Cybersecurity is rapidly becoming more expensive. The Central Bank will ask banks whose risk management system is not good enough to increase their capital / E. Razumny / Vedomosti

If a bank does not consider it right and important for itself to regulate operational risk, part of which are information security risks, then the bank must pay for it," warned Artem Sychev, Deputy Head of the Main Department of Information Security and Information Protection of the Central Bank. Either the bank deals with security, or creates reserves or increases capital for the amount of the existing risk, he explained. He added that this corresponds to the approach of the Basel Committee, and the issue is being worked out with the supervisory block of the Central Bank. Thus, for bankers, increasing the level of security acquires a specific price.

However, the banks surveyed refused to assess their own expenses in connection with the surcharge. Representatives of VTB and Gazprombank did not comment on this.

"Under Basel II, regulators have the right to demand greater capital adequacy when identifying risk management shortcomings," confirmed Deputy Chairman of the Central Bank Vasily Pozdyshev. As for the creation of reserves, this is a more complex issue, because reserves can only be created for identified risks, he said: "We do not practice the approach of "create several billion reserves in general," I myself am not a supporter of creating general reserves, they can only be required for each specific asset or if there is a high probability that the risk will materialize, for example, in the event of a lawsuit against the bank."

And the approach related to the capital surcharge is already included in the second component of Basel II, Pozdyshev pointed out; for systemically important banks this will come into effect on January 1, 2017, and for the rest – from 2018. Pozdyshev considers the capital surcharge to be a simpler solution to the issue than creating reserves.

Half a billion a week

Fraudsters are trying to withdraw 450-500 million rubles per week, clarified Deputy Chairman of the Board of Sberbank Stanislav Kuznetsov.

The risks associated with information security are significant – several bankers told Vedomosti that there were cases when a bank lost capital as a result of an attack.

The professionalism of cybercriminals is growing, and the internal IT structures of banks are growing proportionally with it, and external vendors are coming up with new programs, notes Kirill Lyubentsov, a member of the board of directors of Binbank. “Naturally, we will comply with the requirements,” he emphasizes, “But I think now is not the time to put pressure on banks with an additional burden on capital, especially on IT security.” Whether this is done through reserves or by calculating the additional burden on capital is not important – the capital will be reduced in any case, Lyubentsov adds. A representative of UniCredit Bank says that they would prefer a surcharge.

To combat fraud, the Central Bank plans to legally oblige all banks to conduct anti-fraud monitoring of transactions, Sychev said. At the end of 2015, banks began to introduce innovative services, fraudsters studied them and began to use them to steal funds, he points out, the result is that in January-August 2016, the number of unauthorized transactions for the transfer of funds of individuals amounted to more than 1.6 billion rubles, of which in the third quarter - only 400 million rubles.

According to him, since the beginning of the year, fraudsters have tried to steal 5 billion rubles from legal entities (including banks) and individuals, of which 2.7 billion rubles have been stolen. The FSB Information Security Center estimated the damage to banks from the infection of automated workstations with malicious software at 10 billion rubles. The Central Bank expects a surge in attacks on banks by the end of the year.

The state of information security of banks is variable, since new schemes are constantly emerging, says Dmitry Konovalov, head of the anti-fraud department at SAS for Russia and the CIS.

According to him, hackers are now willing to invest time and resources in preparing a serious attack that will ultimately bring big profits, and petty theft from individuals is no longer so interesting. The scale of the cyber threat problem has reached such a level that new, more obvious steps are being proposed to move to specific actions on risk management, he summarizes.

Cybersecurity costs capital