The Russian Central Bank received powers to regulate the issues of cybersecurity in all organizations in credit and financial sphere, Deputy Head of the Central Bank’s security department Artem Sychev told reporters, TASS reports.
Regulatory documents, previously issued by the Central Bank in the field of cybersecurity were mandatory for execution only in banks, but since October, insurance, microfinance and other supervised organizations will also fall under the Central Bank's supervision.
"We have now received the opportunity to establish the relevant requirements, which we will have to agree with the Federal Security Service and the Federal Service for Technical and Export Control," Sychev said.
In late June, Russian President Vladimir Putin signed amendments to the law "On the national payment system" and related by-laws. In particular, amendments to the law on the Central Bank authorized the regulator, in agreement with the Federal Security Service and the Federal Service for Technical and Export Control, to establish mandatory requirements for protection of information for both banks and non-credit financial organizations.
Since October 2018, banks will have to assess the risks of unauthorized money transfers and develop their own criteria for such transfers. The Central Bank, in turn, will develop and by that time publish its criteria for potentially fraudulent transactions.
According to Sychev, operations involving transfers of funds from a legal entity's account to many personal accounts in other regions fall into the "questionable" category, as well as transactions with "unusual" purpose of payment.
Banks will also have to implement mechanisms to block such transactions and make changes to existing contracts with customers. If there are signs of unauthorized transfer of funds, banks are required to suspend execution of the payment for up to two days and request confirmation from the client.
The law also includes the procedure for banks for situations when customers themselves report fraudsters gaining access to managing their accounts.