In November the European Banking Authority, which exercises overarching authority over banking regulators in the European Union, published guidelines to govern the way in which firms ought to be managing risks relating to information and communication technology and security. The UK's Financial Conduct Authority has today decided to adopt them.

All credit institutions, investment firms and payment service providers are expected to make every effort to comply with the guidelines by 30 June when they enter into force. The increasing digitisation of the financial sector and an upswell of connections between financial institutions make those institutions’ operations vulnerable to internal and external risks to ICT and security that can compromise their operations. The EBA's guidelines call for "sound internal governance, information security requirements, ICT operations, project and change management and business continuity management."

The guidelines for security measures to offset operational and security-related risks that the EBA released in accordance with the EU's second Payment Services Directive (PSD2) in 2017 have been fully integrated into the new guidelines and will be repealed on 30 June.