Portugal: Financial Sector Assessment Program-Technical Note on Cyber Resilience and Financial Stability

The scope of the assessment covered cyber risk supervision and regulation of the financial sector from a risk-based perspective in Portugal, encompassing the mandates and practices of all sectoral authorities; Banco de Portugal (BdP), Comissão do Mercado de Valores Mobiliários (CMVM), and Autoridade de Supervisão de Seguros e Fundos de Pensões (ASF) including their coordination arrangements. Emphasis is on BdP, given its central role in banking supervision and financial stability and the extensive set of cyber‑related instruments and practices under its remit. Portugal’s cyber risk oversight framework distributes responsibilities across sector-specific authorities and assigns some horizontal cyber risk monitoring powers to national bodies. The country has established a coordinated, European Union (EU) aligned framework for cyber risk oversight across its financial sector. The BdP, the CMVM, and the ASF, cooperate through the National Council of Financial Supervisors (CNSF) to manage cyber risks. Supervision of significant banking institutions is within the remit of the European Central Bank’s (ECB) Single Supervisory Mechanism (SSM) and was therefore outside the scope of the FSAP, although as national macroprudential authority BdP oversees the whole financial sector, which was covered by the FSAP.