The fintech sector is a critical component of the UK and US financial ecosystems, and a prime target for cyberattacks. Robust digital resilience frameworks and stringent cybersecurity reporting requirements are therefore essential. This article provides a high-level overview of the cybersecurity and digital resilience reporting requirements that fintech companies must adhere to in the UK and US.
UK reporting requirements
The UK has established a regulatory landscape to ensure digital resilience and cybersecurity within the fintech sector. Key regulations include the UK General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications Regulations (PECR), the Network and Information Systems Regulations 2018, and the Product Security and Telecommunications Infrastructure Act (PSTIA).
-
UK General Data Protection Regulation (UK GDPR): Articles 33 and 34 of the UK GDPR require data controllers to report personal data breaches to the Information Commissioner’s Office (ICO) without undue delay, and where feasible, no later than 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. If the personal data breach is likely to result in a high risk to the rights and freedoms of individuals, the data controller must also inform the data subjects without undue delay.
-
Privacy and Electronic Communications Regulations (PECR): PECR mandates that providers of public electronic communications services report any personal data breach (unless they can demonstrate appropriate technical and organisational measures were in place to protect the data) to the ICO without undue delay. They must also report a breach likely to adversely affect the personal data or privacy of a subscriber or user to the affected individual.
-
Network and Information Systems Regulations 2018: These regulations require operators of essential services (OES) to report incidents that have a significant impact on the continuity of the essential services provided by the OES to the relevant competent authority without undue delay and no later than 72 hours after becoming aware. Relevant digital service providers (RDSPs) must report any incident having a substantial impact on the provision of specified digital services provided by the RDSP to the ICO without undue delay and no later than 72 hours of becoming aware.
-
Product Security and Telecommunications Infrastructure Act (PSTIA): PSTIA requires manufacturers to report failure to comply with a relevant security requirement relating to the product as soon as possible/practicable to the relevant enforcement authorities and, subject to specified conditions, customers. Importers and distributors must report becoming aware of a product compliance failure and others in the supply chain depending on where in the supply chain the failure occurs.
US reporting requirements
In the US, cybersecurity reporting requirements for fintech companies are primarily governed by a mix of federal and state regulations, with specific requirements often depending on the type of financial institution and the data involved. Key federal regulations include those enforced by the Federal Trade Commission (FTC), the Securities and Exchange Commission (SEC), and sector-specific regulations like the Gramm-Leach-Bliley Act (GLBA).
-
Federal Trade Commission (FTC): The FTC enforces data security standards under Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices in commerce. While there isn’t a federal data breach notification law that applies universally, the FTC has brought enforcement actions against companies for failing to provide reasonable security for sensitive consumer data, which has effectively led to many companies implementing breach notification practices.
-
Securities and Exchange Commission (SEC): The SEC has specific rules for publicly traded companies, including many fintech firms, regarding the disclosure of cybersecurity risks and incidents. These rules emphasize the need for timely disclosure of material cybersecurity incidents.
-
Gramm-Leach-Bliley Act (GLBA): The GLBA includes the Safeguards Rule, which requires financial institutions to develop, implement, and maintain a comprehensive information security program to protect customer information. This includes requirements for reporting security incidents to regulatory agencies and, in some cases, to customers.
It’s also important to note that many US states have enacted their own data breach notification laws, which impose additional requirements on companies, including fintech firms, that handle the personal information of state residents. These state laws vary significantly and add complexity to the compliance landscape.
The fintech sector in both the UK and the US operates under increasing scrutiny regarding digital resilience and cybersecurity. Both regions have established regulatory frameworks that mandate specific reporting requirements for various incidents, ranging from personal data breaches to cybersecurity incidents and product vulnerabilities. Fintech companies must navigate these complex landscapes, implement robust security measures, and ensure compliance to maintain the security and integrity of the financial ecosystem.
