Background

1. On 1 October 2018, the FCA fined Tesco Personal Finance plc (Tesco Bank) £16.4 million for failures relating to a cyber-attack. Over a 48-hour period in November 2016, cyber criminals stole £2.26 million from more than 8,000 of Tesco Bank’s 131,000 personal current account customers.
2. The incident received significant press attention at the time. Nearly two years later the FCA has delivered its verdict that, in summary, Tesco Bank should have done more both before the attack and in response to it.
3. These attacks are a growing threat and we are seeing a big increase in requests for advice and assistance in this area. This is also driven by GDPR (see below).
4. The fine was heavily discounted from £33,562,400 which the FCA states that it would have imposed were it not for mitigation credit (to reflect co-operation and remedial action and a discount for early settlement).
5. The fine sends a strong message to the market about the FCA’s stance on cyber security breaches, and the importance it places on firms taking such threats seriously. It also reminds the market to put in place proper systems and controls to

1. mitigate the risk of an attack arising in the first place; and
2. limit any harm to customers in the event of an attack.

6. Mark Steward, Executive Director of Enforcement and Market Oversight at the FCA, said:

“… the FCA has no tolerance for banks that fail to protect customers from foreseeable risks. In this case, the attack was the subject of a very specific warning that Tesco Bank did not properly address until after the attack started. This was too little, too late.”

Key rules and breaches

1.   Principle 2 of the FCA’s Principles for Businesses requires firms to conduct their business with due skill, care and diligence. The FCA found that Tesco Bank had breached Principle 2 because it failed to exercise due skill, care and diligence:

1. in the design and distribution of its debit cards;
2. to configure specific authentication and fraud detection rules;
3. to take appropriate action to prevent the foreseeable risk of fraud; and
4. to respond to the November 2016 cyber-attack with sufficient rigour, skill and urgency.

2.   The Final Notice explained Tesco Bank had been warned of the risk of attack in November 2015. While Tesco Bank made changes to its credit cards to mitigate this risk, it did nothing in relation to its debit cards.

Debit card issues

3.   The FCA also

1. expressed concern that Tesco Bank decided its debit cards would not be contactless but then did not configure its authorisation and fraud analysis systems to decline such transactions.
2. found to have not taken sufficient steps to prevent mimicked transactions (which formed a key part of the attack). For example, some of the cards in circulation had sequential card numbers, making things easier for the attackers.
3. found that Tesco Bank’s response to the attack had also been insufficient.

1. It took 21 hours for the financial crime team to speak to the fraud strategy team as a result of failure to follow set procedures.
2. The fraud strategy team then failed to take effective action and did not properly monitor the action they had taken.
3. Crucially this included a coding error which meant that the preventative action did not work to block transactions. External experts eventually had to be called in and identified this.

d. In addition, crucially Tesco Bank’s systems could not deal with the volume of customers trying to contact the bank which    heightened concerns rather than enabling the bank to deliver appropriate reassurance.

Key takeaways

1. Cyber-crime is a growing threat; it is difficult to anticipate and plan for but this does not mean it can be ignored.
2. Firms need to give cyber breaches proper consideration and develop and test appropriate protections and contingency plans. These should be tailored to different parts of the business where they present different risks.
3. A key lesson from the Tesco Bank Final Notice is that contingency plans must be able to deal with

1.  attacks that occur on non-working days (cyber attackers often attack on weekends or out of hours)
2. It may also be necessary to take external advice from cyber security experts in preparing these plans.
3. Following an attack it is also critical to conduct root cause analysis to understand and address the vulnerabilities which made the attack possible in the first place.

4. there are also important lessons from a governance perspective (another hot topic with the Senior Managers and Certification Regime (SMCR) due to apply to insurers from December 2018 and all FCA-authorised firms from December next year).

1. The FCA comments in its press release that a financial institution’s board is ultimately responsible for setting an appropriate cyber crime risk appetite and ensuring the institution’s cyber crime controls are sufficiently resilient to anticipate and reduce the risk of a successful attack.

5. cyber security is something which is (for banks) and will be relevant to some individual senior managers (in particular, Risk and Operations)

1. In this instance the FCA found Tesco Bank had in place an appropriate approach to risk management but does not appear to be taking action against senior individuals.
2. it is also worth bearing in mind that any senior manager who holds the SMF24 Chief Operations Function will be subject to a duty of responsibility and needs to be able to satisfy the FCA that they have taken “reasonable steps”, in relation to the systems and technology of the firm, to mitigate the likelihood of an attack happening in the first place.

6.  Although Tesco Bank is not a premium listed firm and the UK Corporate Governance Code does not strictly apply to it, the FCA nonetheless noted that

1. “the code sets the context for examining Tesco Bank’s approach to the governance of the risk of financial crime and, more particularly, the risk of cyber crime”.

7. This approach is one which other firms may also wish to take into consideration when considering whether they have done enough. Firms (and any individual with responsibility for oversight of cyber security-related aspects of risk, technology and operations) need to consider and satisfy themselves that:

1. they have adequate procedures;
2. those procedures are adequately tested and withstand those tests;
3. staff are properly trained and know how to recognise and respond to a crisis; and
4. there is appropriate insurance in place.

GDPR impact

1. This case was decided under applicable FCA requirements as is typically the case in the financial services sector.
2. However, the market also needs to take account of GDPR which applies to personal data.
3. GDPR mandates an expanded duty to ensure appropriate security is in place. This includes pseudonymisation, encryption, assurance as to data confidentiality, integrity, availability and resilience of systems.
4. GDPR also requires regular testing, assessment and evaluation of risk.
5. There are also new legal duties to notify the competent Supervisory Authority (eg. the ICO) and data subjects of personal data breaches.
6. The ICO can fine up to 4% of annual turnover for poor data security and 2% of annual turnover for failure to notify as required.

Conclusion

1. It is expected that future incidents affecting authorised firms to be determined by the FCA, but the ICO is likely to step in where the FCA does not. In any event, firms should comply with notification duties under both regimes if applicable.