After Arkéa’s Cyber Heist, Are Moroccan Banks Safe?
Cyber Attack Raises Concerns Over Bank Security: The Case of Crédit Mutuel Arkéa
The embezzlement of over 100 million euros from Crédit Mutuel Arkéa has reignited concerns regarding banks’ ability to withstand cyberattacks. In Morocco, the central bank, Bank Al-Maghrib, has progressively strengthened its cybersecurity requirements. However, how far do the regulator’s checks extend, and what tests do financial institutions undergo?
The banking sector is now faced with a new example of the sophistication of cyberattacks. At Crédit Mutuel Arkéa, more than 100 million euros were siphoned off through a cyber intrusion involving a third-party service provider. Beyond the staggering amount, this incident raises a question that extends to all financial institutions: Are security measures sufficient to prevent an attack that can bypass standard protections and gain access to payment systems?
In Morocco, Bank Al-Maghrib is acutely aware of this threat. Since 2016, the central bank has been strengthening its oversight framework. Credit institutions are now required to conduct intrusion tests on their information systems, create a cybersecurity risk map, and annually submit the results of these exercises to the regulator.
This oversight is not limited to the banking infrastructures alone. A directive issued in 2022 that governs the use of cloud services also imposes security requirements for service providers, access management, and the continuity of outsourced services. This is particularly relevant given the operational methods observed in the Arkéa case.
Does Bank Al-Maghrib Subject Banks to Cyber Stress Tests?
This question is worth addressing. In its 2024 banking supervision report, Bank Al-Maghrib noted that it carried out 18 thematic verification missions across nine banks, including a focus on cybersecurity. The regulator also indicated that it has implemented a dedicated dashboard to monitor cybersecurity indicators at these institutions and analyze the results of intrusion tests.
Moreover, technological risk is incorporated into the Supervisory Review and Evaluation Process (SREP), which allows the regulator to assess the risks faced by institutions, particularly regarding governance and internal control.
However, it’s important to clarify that these evaluations should not be confused with cyber stress tests. Traditional prudential exercises primarily assess banks’ resilience to economic and financial shocks. They do not necessarily evaluate institutions’ preparedness to address fund misappropriations resulting from vulnerabilities exploited by a third-party provider.
A New Regulatory Framework in the Works
It is precisely in this realm that Bank Al-Maghrib aims to strengthen its framework. On October 22, the Credit Institutions Committee issued a favorable opinion on a directive dedicated to digital operational resilience. This text includes enhanced requirements for incident detection, cyberattack management, monitoring of critical IT service providers, and operational resilience testing.
The objective is to verify not only banks’ capabilities to prevent attacks but also their ability to maintain operations and restore services when an incident occurs.
One question remains: do current measures suffice to gauge the resilience of the entire banking system against a significant attack, particularly if multiple institutions rely on the same technological provider? The risk extends beyond the cybersecurity of a single bank; it now touches upon the continuity of payments, the flow of funds, and ultimately, the trust in the financial system.
