Daily Dash: European Supervisory Authorities Unveil Second Batch Of DORA Standards

• EU Authorities Unveil New DORA Standards
• CHAPS Payments Disrupted By Global Issue
• Contactless Payments Surge As Debit Card Insertions Decline In Netherlands
• Indonesia, South Korea Sign MoU To Enhance Cross-Border Payments
• Nordea Indicted In Denmark's Largest Ever Criminal Money Laundering Case
• BaFin Orders Solaris To Address Money Laundering And Risk Management Issues
• SMEs In Ireland Lose Nearly €10m To Email-Related Scams In 2023
• UK Court Sets Dates for FCA 'Finfluencer' Trials
• US Regulators Fine Citigroup $135.6m Over Persistent Risk Management And Data Governance Failures

EU Authorities Unveil New DORA Standards

The European supervisory authorities (EBA, EIOPA and ESMA) have released the second batch of policy products under the Digital Operational Resilience Act (DORA). 

This new package includes four final draft regulatory technical standards (RTS), one set of implementing technical standards (ITS) and two guidelines.

The new standards focus on establishing a clear reporting framework for ICT-related incidents and threat-led penetration testing, along with requirements for an oversight framework to ensure secure financial services. 

These guidelines have been adopted by the boards of supervisors of the three authorities and the final draft technical standards have been submitted to the European Commission for review. The remaining RTS on subcontracting will be released soon.

CHAPS Payments Disrupted By Global Issue

A global payments issue is affecting the Bank of England's Clearing House Automated Payment System (CHAPS) service, leading to delays in high-value and time-sensitive transactions, including some house purchases, the central bank said on Thursday (July 18). 

“We are mindful of the impact this is likely to have and are working closely with a third party supplier, industry and other authorities to resolve the issue as promptly as possible,” the Bank of England said.

Customers with concerns about CHAPS payments scheduled for July 18 were advised by the Bank of England to contact their bank or payment service provider for assistance. 

“Retail payment systems are unaffected so people and businesses can continue to use cash points, card payments and bank transfers as normal,” the central bank said. 

Contactless Payments Surge As Debit Card Insertions Decline In Netherlands

The shift towards contactless payments continues to accelerate in the Netherlands, where the number of debit card insertions has dropped by 125m over the past 12 months. 

According to data from the Dutch Payments Association, contactless payments, whether via debit card or smartphone, increased by 308m during the same period.

In June 2024, 93 percent of all PIN payments were contactless, up from 90 percent a year earlier.

This shift towards contactless is being driven by increased consumer confidence in the payment method, particularly for larger transactions, the association said.

For example, using contactless for larger transactions reduces the risk of fraud through “shouldering” — where a fraudster watches the consumer enter his or her PIN. 

Additionally, in May 2024, a record-breaking number of debit card payments was made, with more than 506m transactions totaling €13.1bn, surpassing the previous record set in June 2023.

Indonesia, South Korea Sign MoU To Enhance Cross-Border Payments

The central banks of Indonesia and South Korea have signed a memorandum of understanding (MoU) on improving interoperability of cross-border payments between the two countries.

The MoU serves as a basis for the two countries to work with partners in the private sector to implement a framework for cross-border payments connectivity.

The two central banks said the MoU will strengthen the digital economy and will significantly benefit the tourism sector of each country.

“The MoU is expected to create cheaper, faster, more inclusive and more transparent cross-border payments between Indonesia and South Korea,” said Bank Indonesia.

Nordea Indicted In Denmark's Largest Ever Criminal Money Laundering Case

Danish bank Nordea has been charged with “extensive violations” of the country’s anti-money laundering (AML) laws, following a special investigation into its dealings with Russian clients.

Between 2012 and 2015, according to the National Unit for Serious Crime (NSK), Nordea processed transactions worth DEK26bn ($3.7bn) for Russian customers, despite indications of money laundering activity.

“In NSK's opinion, Nordea did not investigate the bank's Russian customers' transactions sufficiently, and Nordea disregarded warnings about transactions to exchange offices in Copenhagen,” the agency said.

Responding to the indictment, Nordea said it “does not agree” with the NSK’s assessment, but it expects to be fined for weak AML controls nonetheless.

Both Nordea and the NSK noted that no individuals have been charged as part of the case.

BaFin Orders Solaris To Address Money Laundering And Risk Management Issues

The German Financial Supervisory Authority (BaFin) has told credit institution Solaris SE to rectify significant deficiencies in its money laundering prevention and risk management systems. 

The order follows multiple audits that uncovered shortcomings in areas such as reporting, outsourcing management and IT infrastructure.

BaFin has set strict deadlines for the Berlin-based company to resolve its deficiencies, and says that a failure to meet these deadlines could result in punitive measures. 

The regulator’s intervention addresses deficiencies identified in audits conducted in 2020 and which it had highlighted for remediation in 2022. 

Despite the earlier instructions, some issues persisted, prompting BaFin to extend its oversight through the appointment of a special representative in December 2022. 

The representative's mandate has now been extended to ensure Solaris implements necessary reforms and restores proper business operations.

These measures, including the order to address deficiencies and the extension of the special representative's mandate, came into effect on July 6, 2024.

SMEs In Ireland Lose Nearly €10m To Email-Related Scams In 2023

Small and medium-sized businesses (SMEs) in Ireland lost €9.9m to email-related fraud in 2023, according to new figures from Irish financial crime initiative FraudSMART. 

This represents a nearly 25 percent increase compared with 2022, with average losses per incident amounting to €12,000.

The majority of these scams involved invoice redirection, where fraudsters send emails that appear to be from legitimate suppliers, requesting changes to bank account details.

In response to the statistics, Niamh Davenport, head of financial crime at Banking and Payments Federation Ireland, emphasised the severity of the issue, noting the devastating impact on SMEs. 

"These scams can create a false sense of security and are often only detected when it's too late,” she said. “SMEs are particularly vulnerable due to their limited resources and lower financial buffers."

Meanwhile, Peter Burke, the country’s business minister, highlighted the importance of fraud awareness.

"SMEs are the backbone of our economy, and it's crucial that they are aware of the risks posed by fraudsters and take necessary precautions,” he said.

UK Court Sets Dates for FCA 'Finfluencer' Trials

Nine individuals charged in an unauthorised forex trading scheme have been scheduled for trial. 

This comes after the Financial Conduct Authority (FCA) pressed charges against them due to their promotions via social media. 

Among those charged, Holly Thompson, Biggs Chris, Jamie Clayton, Lauren Goodger, Rebecca Gormley, Yazmin Oukhellou and Scott Timlin each pleaded not guilty to one count of issuing unauthorised communications of financial promotions. 

Additionally, Emmanuel Nwanze denied charges of providing unauthorised advice on buying and selling contracts for difference (CFDs), along with issuing financial promotions without authorisation.

Eva Zapico, another individual implicated in the scheme, did not enter a plea during the hearing. A subsequent plea hearing for Zapico has been scheduled for September 26, 2024.

In light of court scheduling constraints, trial dates have been fixed for February 1, 2027 and March 15, 2027 at Southwark Crown Court, which are the earliest available slots for the court to accommodate the complex case.

US Regulators Fine Citigroup $135.6m Over Persistent Risk Management And Data Governance Failures

Citigroup (Citi) has been fined a total of $135.6m by US regulators due to ongoing deficiencies in its risk management and data governance practices, despite a previous cease and desist order issued four years ago. 

“Citibank must see through its transformation and fully address in a timely manner its longstanding deficiencies,” said acting comptroller of the currency Michael J. Hsu. 

“While the bank’s board and management have made meaningful progress overall, including taking necessary steps to simplify the bank, certain persistent weaknesses remain, in particular with regard to data,” he said, adding that the amendment requires the bank to refocus its efforts on taking necessary corrective actions and ensuring appropriate resources are allocated for this purpose.

The Office of the Comptroller of the Currency (OCC) imposed a $75m fine and amended the existing order, while the Federal Reserve Board added a $60.6m fine for violating its 2020 enforcement action.

The original cease and desist order was issued by the OCC with a $400m fine in response to Citi's failure to address shortcomings in enterprise-wide risk management, compliance risk management, data governance and internal controls. 

This action was based on findings of unsafe banking practices stemming from Citi's long-standing deficiencies in establishing effective risk management and data governance programmes.