UK regulator the FCA has reviewed how wholesale banks and asset managers manage their cybersecurity risks.  Consultancy EY says the FCA’s findings are a ‘loud alarm call’ for the asset management industry.

EY said in a statement that given the £8 trillion in assets under management, regulatory scrutiny should be no surprise for the sector even if it is a somewhat niche sector.

In the conclusion to the FCA’s report, the regulator said many firms need to do more to ensure that board and management committee cybersecurity decisions are based on careful consideration of the cyber risks arising from the nature, scale and complexity of the firm’s activities and risk profile.

Given that many UK-based asset managers have international footprints and are involved in investment in various different asset classes this seems a clear message to the sector.

The FCA also found that cyber security awareness is lower in firms that do not have a cyber-specific strategy and proportionate cyber risk framework, where cyber is not part of their broader risk management framework, and where their incident response plans take little account of non-technical consequences such as the impact to their reputation, clients and markets more broadly.

EY viewed the key finding was that boards and senior management still need more information on the specific risks for their individual businesses.

Steve Holt, financial services cyber solutions leader at EY, said in a statement: “ Interestingly, the regulator also asked whether firms are doing enough to link cyber risk with conduct issues, such as market abuse and financial crime.

“By embedding a security conscious culture, the firms could reduce both their conduct and cyber risks. More worryingly, incident response plans were found to be lacking in impact assessment on customers, reputational damage and the broader market impact.”