Financial institutions occupy a uniquely sensitive position in the cybersecurity landscape. They hold concentrated quantities of sensitive personal and financial data, operate the payment infrastructure on which the broader economy depends, and are subject to attack patterns that are among the most sophisticated and well-resourced anywhere in the world. The legal and regulatory expectations that apply to financial institutions in Iraq reflect this sensitivity: cybersecurity is treated as a core supervisory concern of the Central Bank of Iraq, with detailed expectations that exceed those applicable to most other sectors.
Governance and Risk Management
Cybersecurity governance in financial institutions is treated as a board-level responsibility. The board is expected to engage actively with cyber risk, to approve the institution’s cybersecurity strategy and risk appetite, to allocate adequate resources, and to oversee the effectiveness of controls. A designated senior officer often a Chief Information Security Officer reporting at a sufficiently senior level is typically expected to lead the cybersecurity function with appropriate independence and authority. Cybersecurity should be integrated into the institution’s broader risk management framework rather than treated as a standalone IT concern.
Risk assessment forms the foundation of the cybersecurity program. The institution must identify its information assets, assess the threats and vulnerabilities applicable to those assets, evaluate the potential impact of compromise, and prioritize controls accordingly. The risk assessment should be updated regularly as the threat landscape evolves and as the institution’s own systems change.
Technical and Operational Controls
The Central Bank’s expectations on controls reflect international good practice. Core areas include:
- Network security, segmentation, perimeter protection, intrusion detection
- Access management, strong authentication, least-privilege access, active monitoring
- Endpoint and application security, and secure development practices for in-house systems
- Cryptography for data at rest and in transit, with proper key management
- Monitoring and detection, logging, SIEM, threat intelligence integration
- Vulnerability and patch management
The pattern in major incidents is rarely that the attack was undetectable; more often, it is that the indicators were present but not acted upon, and the regulatory expectation is that monitoring is operated effectively rather than merely deployed.
Payment Systems
Payment systems attract particular attention. The security of online banking, mobile banking, ATM networks, card payment processing, and interbank settlement is essential not only to the individual institution but to the integrity of the financial system. Specific controls transaction monitoring, fraud detection, customer authentication, encryption of payment data, and incident response capability are expected to meet international standards. Compliance with the Payment Card Industry Data Security Standard, while not formally mandated by Iraqi law, is a practical expectation for institutions handling card data, driven by the requirements of card networks and contractual obligations to merchants and partners.
Third-Party Risk Management
Third-party and outsourcing arrangements introduce some of the most significant cyber risk for modern financial institutions. Vendors with system access, cloud service providers, payment processors, technology partners each represents a potential vector for compromise. The Central Bank expects financial institutions to:
- Conduct due diligence on their third parties
- Impose appropriate contractual obligations on security, confidentiality, and incident response
- Monitor third-party performance on an ongoing basis
- Maintain the ability to respond when third-party incidents affect the institution
- Address supervisory access, data sovereignty, and cross-border response when functions are outsourced outside Iraq
Incident Reporting
Reporting of cybersecurity incidents to the Central Bank is a defined obligation. The thresholds for reporting, the timelines, and the content expectations are set by the Central Bank’s circulars and supervisory practice. Beyond regulatory reporting, the institution typically has contractual obligations to report incidents to correspondent banks, card networks, customers, and partners. Internal escalation processes must trigger all of these reporting paths quickly and accurately. Where the incident involves personal data, the data protection notification obligations.
Engagement with the Central Bank during and after an incident requires careful management. The regulator expects to be informed promptly, to be kept updated as the situation develops, and to be given access to investigation findings as they emerge. Concealment, delay, or inadequate disclosure can compound the regulatory consequences of the underlying incident.
Business Continuity and Cyber Resilience
Business continuity and recovery are integral to cybersecurity, particularly given the prevalence of ransomware and other destructive attacks. Financial institutions are expected to maintain:
- Offline, immutable backups
- Tested recovery procedures
- Alternative processing capabilities for critical functions
- The ability to continue serving customers during extended incidents
- Documented operational resilience with impact tolerances and recovery time objectives
Testing and Assurance
Independent testing and assurance support both compliance and operational effectiveness. Penetration testing, vulnerability scanning, red team exercises, audit reviews, and other forms of testing identify weaknesses that internal monitoring may have missed. The Central Bank expects evidence of regular testing, with appropriate scope and remediation of identified findings. Internal audit functions are expected to provide independent assurance over the cybersecurity program, with reports reaching the board or its risk committee.
Staff Training and Customer Protection
People are both the strongest defence and the most common point of failure in cybersecurity. Comprehensive staff training, phishing simulation programs, role-specific training for high-risk functions, and a culture of security awareness throughout the institution are all expected. Customer protection extends to authentication for high-risk transactions, fraud detection and prevention, customer education on safe practices, and clear processes for responding to customer fraud reports. Allocation of liability between the institution and the customer for unauthorized transactions is governed by both regulation and contract, and the institution’s processes for handling disputed transactions should be transparent and fair.
How We Can Help
Etihad Law Firm advises banks, payment institutions, and other financial sector clients on cybersecurity compliance in Iraq, including engagement with the Central Bank, governance and policy design, contractual arrangements with vendors and partners, incident response, and supervisory and enforcement proceedings. We bring together legal, regulatory, and operational perspectives to support institutions in building and maintaining cyber programs that meet both Iraqi and international expectations.