Cybersecurity Measures and Transaction Applications
Overview
In response to customer information leaks caused by unauthorized access, the Financial Services Agency asked financial institutions and others to review their cybersecurity measures and thoroughly verify identities in non-face-to-face transactions. The method of accepting images of identity documents will be discontinued on April 1, 2027, and, in principle, replaced by reading information from IC chips. The agency called for prompt action without waiting for the effective date.
Key points
- Review measures, including third-party risk management and incident response arrangements.
- Recheck images of identity documents and customers' faces.
- Accelerate the transition to reading IC chip information without waiting for the image submission method to be discontinued.
Overview
Unauthorized access to customer-facing services and business systems exposed on the internet has occurred repeatedly, resulting in cyber incidents in which customer information, including images of identity documents such as driver's licenses, was leaked.
The Financial Services Agency called on financial institutions and others to continue taking measures suited to their size and characteristics under the leadership of management, taking into account relevant guidelines and short-term response requests.
Impact
Financial institutions and others are expected to take steps to prevent the fraudulent use of financial services and preserve trust in those services.
Details
Review measures in light of alerts from the National Cybersecurity Office of the Cabinet Secretariat and publicly disclosed information about the causes and methods of attacks. If measures are inadequate, promptly take steps commensurate with the risks.
When verifying identities remotely, thoroughly check the images of identity documents and customers' faces for anything unusual. The thickness of identity documents and photographs of the customers themselves have also traditionally been among the items to check.
An amendment to the Enforcement Regulations of the Act on Prevention of Transfer of Criminal Proceeds will discontinue the method of accepting images of identity documents from the effective date and, in principle, switch to reading IC chip information, which is more effective at preventing fraud. The Financial Services Agency called for action as soon as practicable, without waiting for the effective date.