Cyber risk is a mounting threat to the operations and credit profiles of financial institutions, and never more so than since the pandemic accelerated the shift to online banking. There have been no major interruptions to the operations of banks in GCC countries, however. For example, in Saudi Arabia, mortgage lending continued to expand at double-digit rates despite the digital shift. GCC banks laid the foundation for success over several years by investing in infrastructure and systems, including equipment and software, to minimize their exposure to cyber risk, while also benefiting from supportive regulatory frameworks and cyber risk requirements.

S&P Global Ratings believes GCC banks' exposure to cyber risk is manageable, assuming they continue to invest in cyber security and proactively manage risk, taking into consideration the evolving nature of threats. We note that GCC banks have reported only a handful of digital breaches and cyberattacks over the past decade. While some might have gone unreported, it is likely these were minor incidents given the absence of significant losses in financial reports and the banks' relatively low operational risk capital charges.

Our view of manageable cyber risk for GCC banks is supported by data from cyber security specialist Guidewire. It estimates that the region's top 19 banks (for which data was available) would suffer an average 7.5% fall in net income and a 0.6% decline in equity, based on figures from the end of 2021, under a high-severity cyber incident; at the same time, the banks' average operational risk capital charge was 3.6% of total equity. We believe the data suggests that GCC banks appear to have sufficient operational risk capital to cover losses related to cyber risk. We do not incorporate Guidewire's simulation in our capital analysis, though it provides us with insight that is useful as we consider risk management. We note that Guidewire doesn't incorporate the possible impact of a cyber incident on a bank's business position, associated revenue loss potential due to reputation damage, or cyber ransom. We consider those factors as part of our credit rating analysis.

How Cyber Risk Affects Our Analysis Of Banks

We incorporate banks' exposure to cyber risk in our assessment of their risk profile and management. Cyberattacks have the potential to harm banks' credit profiles through reputation damage as well as monetary loss. In the event of a large-scale attack on a systemic bank or several large institutions, we could foresee governments taking measures to stabilize the sector. In our analysis of banks' creditworthiness, we consider the impact of cyber risks on the banking system as well as at individual banks. Our systemwide banking sector analysis captures cyber risks in a given country, when, for example, an entire banking industry suffered from a series of repeated, serious breaches of security, or regulators appear to be more reactive than proactive in forcing financial institutions to strengthen their cyber security frameworks.

Continued Investment And Capitalization Help Minimize Cyber Risk Exposure

Over the past decade, GCC banks have reported a small number of cyberattacks that resulted in monetary or reputational damage. In addition, the overall operational risk capital charge, which is part of the local capital requirements, stood at 3.4% of total equity at the end of 2021 (assuming an 8% minimum capital requirement ratio). Banks that are present in more than one country, and those that have significant retail operations, reported the highest charge within our sample of GCC banks. Given that cyber risk is one of the elements operational risk capital is designed to cover, the allocation suggests that GCC banks regard their cyber risk exposure as low.

GCC banks' low cyber risk exposure is underpinned by:

Significant investment in infrastructure, equipment, and software, including for cyber risk mitigation.  Although GCC banks have not publicly disclosed figures for the investments, we understand from our interactions with rated banks that their boards of directors and senior management allocate significant attention to cyber risk. GCC banks have also invested in technology, equipment, and staff training to detect and limit exposure to cyber risk, and continue to update their policies and investments to factor emerging trends in the cyber security space. We recognize, however, that no system is perfect, and that continued investments and adaptation are required to minimize risk.

Local regulatory frameworks and requirements centered on cyber security.   This includes the Saudi Central Bank's cyber security framework, issued in 2017, which defined requirements around governance, risk management, compliance, operations, technology, and the use of third-party cyber security services by regulated entities. Those rules were supplemented, in 2022, with a document on cyber threat intelligence principles, which addressed the production and dissemination of intelligence aimed at identifying and minimizing cyber threats. The United Arab Emirates (UAE) Central Bank established, in late 2021, a Networking and Cyber Security Operations Centre to better protect the local financial system against cyberattacks. The central bank has also identified and worked to improve key pillars of effective cyber resilience for the banking system and its own infrastructure. Moreover, the Central Bank of Qatar published a circular in 2018 that outlines the regulatory requirements banks must fulfill to effectively manage cyber risk.

Our belief that GCC banks can manage their exposure to potential negative credit effects from cyber risks is consistent with Guidewire's estimates.

Using a tail-value-at-risk calculation that measures the average loss for the 40 most severe simulations in Guidewire's model, the top 19 banks in the GCC (for which data is available) would suffer an average loss of 7.5% of net income and 0.6% of equity following a high severity cyberattack, based on their financial position at the end of 2021. The simulations also indicate that, on average, banks with higher geographic diversification face greater risks, as do those with more extensive retail operations (see chart 1). Guidewire's projections indicate that a low severity incident (with 5% probability of occurring) would cost an average 0.2% of net income for the GCC banks in our sample (see chart 2).

Guidewire's calculations suggest that GCC bank's operational risk capital is sufficient. However, this assessment does not incorporate possible business position effects, associated revenue loss potential due to reputational damage, or cyber ransom. We also note that Guidewire's coverage of GCC banks excludes some smaller entities that could be relatively vulnerable to cyber risks.

We factor cyber risk into our assessment of banks' business stability, capitalization, and risk management adequacy. In extreme scenarios, cyber risk could have negative implications on liquidity through a sudden outflow of funds, leading to liquidity pressure. We also note that cyber risks evolve rapidly and require continued efforts if banks are to remain protected, and we recognize that no system can fully protect against unexpected-event risks.

Chart 1

Chart 2

Data Breaches Are Among The Biggest Risks

Cyber risks range from a temporary interruption of services to the complete shutdown of IT systems due to data destruction and data theft linked to cyber ransoms. The growth of ransomware linked to data theft, coupled with the significant amount of sensitive information handled by banks, suggest that this is a major risk for the GCC's lenders, particularly compared to other dangers such as business interruption. Ransomware-related attacks leading to data leaks increased by 82% in 2021 when there were 2,686 attacks, up from 1,474 over 2020, according to the "2022 Global Threat Report" from Crowdstrike, a cybersecurity technology company.

The risk of cyberattacks appears even higher for banks with greater geographic diversification (particularly those with operations in regions more prone to cyber-attacks than the GCC) and banks with extensive retail operations, which have proven more likely to attract the interest of hackers.

Guidewire's findings (see chart 3) suggest that the cyber risk profile of GCC banks is comparable to developed markets, rather than emerging market banks. It is notable that emerging markets are significantly more prone than the GCC to indirect business interruption issues, which stem from problems at third-party service providers. That could be explained by GCC countries' significant investment in infrastructure, which appears to have reduced indirect business interruption risks.

Chart 3