Skip to content
Indene
en

Inteligência de ameaças

Central Bank and European Regulators Point to Technology Provider as Weak Link

The August minutes of Comef and the ESAs' autumn report reach the same diagnosis: the financial system's risk increasingly lies with technology providers. Institutions can outsource services, but not responsibility or proof that their controls are effective.

By Rafael LimaCFO

5 min read

Rede de pontos ligados por traços finos sobre fundo escuro esverdeado, com um único nó verde aceso e o título The weakest link is under contract.
Rede de pontos ligados por traços finos sobre fundo escuro esverdeado, com um único nó verde aceso e o título The weakest link is under contract.

Within four weeks, the Central Bank and European financial supervisory authorities reached the same diagnosis: the system's fragility increasingly lies with technology providers. In the August minutes of the Financial Stability Committee, the Central Bank points out risks in the Banking as a Service ecosystem and promises to intensify supervision. On September 23, the ESAs reported that European banks view reliance on ICT providers as the biggest challenge. Both messages lead to the same conclusion: institutions can outsource services, but not responsibility or proof that the provider's controls are effective.

What the Sources Show

The minutes of the 66th Comef meeting, held on August 25 and 26, 2026, evaluated relevant cyber incidents that occurred in the National Financial System in 2026. The committee highlights financial fraud associated with these events, examines recent incidents in the payment arrangement receivables ecosystem, and cites operational risks in the Banking as a Service ecosystem. It demands stronger governance, risk management, and internal controls from participants in these ecosystems, and states that the Central Bank "will continue to intensify" regulatory and supervisory actions in these areas.

On the European side, the joint autumn report of the three supervisory authorities (EBA, EIOPA, and ESMA), published on September 23, 2026, dedicates an entire section to external dependencies, using data from the EBA's risk questionnaire with banks. Verizon's annual data breach report, published in May, shows the same trend outside the financial sector:

indicator number source
European banks that view reliance on ICT providers as the biggest challenge about 80% ESAs, with EBA data, 2026
Banks that view reliance on payment solutions as the second biggest risk about 60% ESAs, with EBA data, 2026
Data breaches involving a third party 48%, a 60% increase from the previous year Verizon DBIR, 2026
Breaches that started with vulnerability exploitation 31% Verizon DBIR, 2026

The same ESAs report notes that system failures, not attacks, account for most of the ICT incidents reported by the sector under DORA, the European Digital Operational Resilience Act. The recommendation is to monitor reliance on critical technology providers and pay special attention to services concentrated in a few providers, such as payment services.

Brazil already has a reference case. In July 2025, the Central Bank shut down the infrastructure of C&M Software, a provider that connects institutions without their own means of connection to the payment system, after an attack that moved funds from client institutions' reserve accounts. No end-customer accounts were affected, according to InfoMoney. On September 5, 2025, BCB Resolution No. 498 regulated the accreditation of these providers, known as PSTI.

The current rule for institutions is CMN Resolution No. 5,274, of December 18, 2025, with an adaptation period until March 1, 2026 (BCB Resolution No. 538, of the same date, amends the equivalent rule for payment institutions, brokers, and distributors). Regarding providers, it requires:

  • periodic review of access permissions, especially for outsourced employees;
  • multi-factor authentication for corporate network access from outside the institution;
  • prohibition of service providers accessing private keys used to sign messages;
  • treatment of communication services with the National Financial System Network as a relevant service, even when the provider processes messages;
  • annual, independent intrusion testing, with documented results and a correction plan.

The original resolution, CMN No. 4,893, continues to state that the institution is responsible for the reliability, integrity, availability, security, and confidentiality of relevant data processing, data storage, and cloud services it contracts. It also mandates retaining due diligence performed before contracting, the contract, and supplier monitoring records for five years.

What This Means Together

The sources describe the same movement from different angles. Attackers increasingly exploit the link that the institution does not operate: the connection provider, the Banking as a Service platform, the API gateway maintained by another company. The regulator responds in the only way it can, by holding the licensee accountable. Dependency has ceased to be a contractual issue and has become a supervisory issue.

For institutions regulated by the Central Bank, the consequence is practical. In documentary inspections, "the provider guarantees" is not evidence. The institution needs to show when it reviewed third-party access, what test validated its control, and what it did with the result. A questionnaire answered once a year by the provider itself is a declaration: it states what the provider claims, not what has been tested.

There is also a financial interpretation. Compromise by a critical third party is a loss scenario like any other, and its magnitude depends on two things that the institution can measure: what stops when the provider stops, and what the provider can access when compromised. A provider with access to settlement accounts and no independent testing does not carry the same weight as an office software provider, even if both are on the same third-party spreadsheet with the same rating.

The ESAs' observation about system failures completes the picture. Not every loss from a provider is an attack; many are due to unavailability. The business continuity plan must anticipate the critical provider's outage, and the continuity test must genuinely exercise this outage.

What to Do Now

  1. List providers that handle money, customer data, or the connection to the financial system (connection provider, Banking as a Service, message processing, cloud) and order them by the impact of an outage or improper access, not by contract value.
  2. Review who, at each provider, has access to your systems, whether that access requires multi-factor authentication, and when it was last reviewed.
  3. Confirm that no provider has access to the private keys used to sign messages on the National Financial System Network.
  4. Replace questionnaire responses with dated and sourced evidence: test results, access logs, intrusion test reports, continuity tests involving provider outages.
  5. Retain due diligence, contracts, and monitoring records for each relevant provider for five years: this is what the regulation requires to be available to the Central Bank.

In Indene's view, supplier control is factored into risk based on the confidence that its proof supports: declared, evidenced, or validated. The same standard applies to the institution's own controls. Read the methodology.

References

Topics

Keep reading

All news