Italy: Financial Sector Assessment Program-Technical Note on Cyber Risk Supervision and Oversight

The Italian financial sector is undergoing rapid digital transformation, marked by significant investments in innovative technologies, especially in payments, insurance, and banking. Digital payments surpassed cash transactions since 2022. This transformation has led to increased reliance on third-party service providers, particularly cloud services, with 64 percent of Less Significant Institutions (LSIs) and Nonbank Financial Intermediaries (NBFIs) using cloud solutions. The insurance sector reports 96 percent cloud adoption, and digital channels are now the primary interface for most policyholders. As a result, cyber and operational risks have become a major concern, with rising incidents of fraud, ransomware, phishing, distributed denial-of-service (DDoS) attacks, supply chain vulnerabilities, and data breaches. In 2024, 35 major cyberattacks occurred and three of them resulted in estimated losses exceeding EUR 2 million each. Payment fraud losses reached EUR 246 million. Fraud accounts for only a marginal share of total payment transactions (around 0.003 percent in value) and was broadly in line with averages in the European Union. The sharp increase of operational incidents in 2024 highlighted the risk from using and depending on third-party service providers to deliver financial services.