FSB recommends Spain further enhance cyber resilience of its financial sector to address rising challenges

• Peer review finds Spanish authorities have placed significant focus on enhancing cyber resilience of the financial sector and have good practices in place.
• However, growing digitalisation of the financial sector and the evolving cyber risk landscape call for continuing improvements to address rising challenges.
• The FSB recommends that Spanish authorities develop a comprehensive threat landscape, leverage best practices, and establish a national analysis of registers of information and a single national channel for incident reporting.

The Financial Stability Board (FSB) today published its second Peer Review of Spain, examining the country's efforts to enhance cyber resilience in the financial sector and mitigate financial stability risks arising from operational incidents and cyber-attacks.

The review finds Spanish authorities have placed significant focus on enhancing the cyber resilience of the financial sector, including preparations to meet the enhanced expectations under the European Union Digital Operational Resilience Act (DORA). While Spain has implemented good practices, growing digitalisation of the financial sector and the evolving cyber risk landscape warrant on-going enhancements to address rising challenges.

The review recommends that Spanish authorities:

• develop a comprehensive mapping of the cyber threat landscape that could provide the industry and authorities themselves with intelligence to inform decision-making;
• leverage best practices to bring enhanced consistency and maturity to cyber resilience across agencies, for example through cross-sectoral working groups and information-sharing mechanisms under the oversight of the Spanish Macroprudential Authority;
• develop a national analysis of existing registers of information to identify critical third-party providers in Spain, assess concentration risks and define a strategy to address domestically critical third parties;
• establish a single national channel for incident reporting that automatically shares data with relevant authorities, as well as intergovernmental working groups, playbooks and drills to enhance crisis preparedness.

"Cyber incidents can pose systemic risks, disrupting critical financial services and eroding market confidence," said Jane Magill, Executive Director of General Insurance and Banking at APRA and Chair of the Spain peer review. "Detailed examination of a jurisdiction's approach provides benefits to all jurisdictions that are constantly looking to enhance their response to this risk."

Notes to editors

Recognising the potential systemic risks posed by cyber incidents and the reliance on third-party providers, in 2023 the FSB published a Toolkit for enhancing third-party risk management and oversight, as well as recommendations to support harmonised incident reporting and information sharing among authorities. To build a practical understanding of implementation of these recommendations and other regulatory efforts to enhance cyber resilience, the FSB has conducted peer reviews of Spain (published today) and the Netherlands (forthcoming) and their efforts to enhance the cyber resilience of their financial systems.'

FSB member jurisdictions have committed to undergo periodic peer reviews to evaluate their adherence to international financial standards. To fulfil this responsibility, the FSB has established a regular programme of country and thematic peer reviews of its member jurisdictions. As part of this commitment, Spain volunteered to undergo a peer review in 2025. A schedule of country peer reviews, as well as all completed peer review reports, are available on the FSB website.

The FSB coordinates at the international level the work of national financial authorities and international standard-setting bodies and develops and promotes the implementation of effective regulatory, supervisory, and other financial sector policies in the interest of financial stability. It brings together national authorities responsible for financial stability in 24 countries and jurisdictions, international financial institutions, sector-specific international groupings of regulators and supervisors, and committees of central bank experts. The FSB also conducts outreach with approximately 70 other jurisdictions through its six Regional Consultative Groups.

The FSB is chaired by Andrew Bailey, Governor of the Bank of England. The FSB Secretariat is located in Basel, Switzerland and hosted by the Bank for International Settlements.