What challenges do banks and insurance companies face?
The financial institutions and insurance companies are subject to pressure to change from two sides. On one side stands the ever-increasing networking and digitalization, on the other new regulations, laws, and enhanced regulatory requirements. For banks this is done by BAIT and SREP, for insurance companies by VAIT and for both of them by the DSGVO.
With the "Banking Supervisory Requirements for IT" (BAIT), BaFin has specified the "Minimum Requirements for Risk Management" (MaRisk) in the area of IT risks. With the "Insurance Supervision Requirements for IT" (VAIT), it now also includes insurance companies and specifies for them the provisions on business organisation in the Insurance Supervision Act (ISA). Both BaFin requirements include the topics IT governance and information risk management.
The ECB also specifies "homework" for financial institutions in the "Supervisory Review and Evaluation Process" (SREP). The SREP affect risks due to information, communication, and technology (ICT). In general these identified deficiencies must be remidied within a certain period of time.
The General Data Protection Regulation (DSGVO) applies to almost all areas that processes personal data. For instance, it applies to payments or the processing of employee data.
