Greece’s financial regulator wants to know not just when a major cyberattack happens, but exactly how much it costs. The Bank of Greece has introduced a framework requiring a broad range of financial companies to quantify the economic impact of serious cybersecurity and information-technology incidents.
The rules, effective since Sept. 24, implement guidelines from the European Supervisory Authorities under the European Union’s Digital Operational Resilience Act, known as DORA.
The move reflects a broader shift in European financial supervision: Cyber incidents are increasingly being treated as measurable financial risks rather than merely technical failures.
ΔΙΑΒΑΣΤΕ ΕΠΙΣΗΣ
For banks, the Greek framework doesn’t cover the country’s large systemic lenders, which fall under the European Central Bank’s Single Supervisory Mechanism. Instead, it applies to so-called Less Significant Institutions supervised directly by the Bank of Greece, including CrediaBank, Optima bank, VivaBank, Aegean Baltic Bank and several cooperative lenders.
Its reach extends well beyond banking. Payment and electronic-money institutions, account-information service providers, insurers and reinsurers, certain insurance intermediaries, occupational pension funds and Greece’s Deposits and Loans Fund also fall within its scope.
For every incident classified as “major” under DORA, companies will have to calculate gross costs and losses separately, as well as any financial recoveries. The aim is to produce an annual tally showing the economic footprint of serious digital disruptions.
Companies can’t simply make broad estimates. Calculations should start with amounts already recorded in financial statements or regulatory reports, including relevant accounting provisions. Other available information can be used when precise figures aren’t available.
The framework also recognizes that the financial consequences of cyber incidents don’t necessarily end when systems come back online. Costs from incidents reported in previous years can be included if they continue to have a measurable impact, while later revisions to estimated losses will be recorded in the year they are made.
The Bank of Greece has also established a standardized reporting template, to be submitted upon request. It will detail each major incident, gross costs and losses, and financial recoveries.
