Babban bankin, hasken rana, fitarwa da kuma kula da fasaha

A banki ne set na alkawurran da aka rubuta a cikin wani littafi. Idan littafin ne ba daidai ba, ba a samu ko lalace, bankin ba zai iya sanin abin da ya kamata, biya abokan cinikinsa ko rahoto ga mai kula da shi. Domin wannan dalili, masu tsara yanzu duba fasahar gini, outsourcing da cyber juriya kamar yadda kusa da kasafin kudin.

Abin da tsarin banki na farko ke yi

The core bank system is the ledger of record. It holds customer and account data, posts every transaction, calculates interest and fees, and produces the balances on which everything else relies.

Abubuwan aiki na yau da kullum sun haɗa da:

Aiki	Mene ne yake rufewa
Manajan asusu da abokan ciniki	Aikace-aikacen abokin ciniki, buɗe lissafi, sharuɗɗan samfurin, halin lissafi
Ledger da posting	Real-time ko batch posting na debits da credits, general ledger feeds
Deposits	Asusun yanzu, ajiya da na lokaci, adadin riba da kuma zuba jari
Bayar da bashi	Maɓallan haɗi na farkon bashi, lokaci, biyan kuɗi, adadin da aka biya baya, fitarwa na samarwa
Abubuwan haɗi na biyan kuɗi	Haɗawa zuwa wuraren biyan kuɗi, masu sarrafa katin bashi da asusun ma'aikaci
Saita kayan aiki	Rates, fee, limits and rules without code changes
Data da rahoto	Cire-cire don kudi, haɗari, rahoton doka da AML kulawa

A kusa da tushe zauna sauran tsarin: digital hanyoyi, a biya hub, card management, customer onboarding da kuma tabbatar da adireshi, hukuncin bincike, gudanar da kasuwanci, kasafin kudi, kudi da kuma dokokin rahoto injiniya.

Zaɓuɓɓukan Tsarin Gida

Bankunan da suke ci gaba suna iya zaɓar tsakanin nau'ikan uku.

1. Licensed software, hosted by the bank or a provider. The bank controls configuration and data, but bears the integration burden.
2. Software kamar wani sabis a kan wani dandali cloud. Faster don fara, amma bankin ya dogara ne a kan roadmap mai sayarwa da juriya, kuma tsari ne outsourcing.
3. Banking a matsayin wani sabis daga wani lasisin cibiyar. The sauri hanya, amma za ta iya kara da tambaya ko sabon banki yana da isasshen abu na kansa.

Masu kula ba su tanadar da wani nau'i ba, suna tantance ko banki na fahimtar da kuma kula da wanda ya zaba.

Outsourcing rules

Outsourcing yana nufin wani mai bayar da sabis ya aikata wani tsari, sabis ko aiki wanda banki zai yi shi kansa. A cikin EU, EBA Hanyoyi kan ayyuka na outsourcing (EBA/GL/2019/02) sun shiga aiki a ranar 30 ga Satumba, 2019. Sun maye gurbin shawarwarin da suka gabata, ciki har da EBA's daban-daban shawara kan outsourcing zuwa masu ba da sabis na hasken rana.

Tsarin tsakiya shi ne cewa alhakin ba za a iya fitarwa ba. Kwamitin gudanarwa yana da alhakin duk ayyukan da aka fitarwa. Ma’aikatun “za su kiyaye a duk lokacin da ake buƙata kuma ba za su zama ‘ƙuƙumma marasa amfani’ ko ‘ma’aikatun akwatin imel’”.

Critical or important functions

The guidelines apply stricter requirements where the outsourced function is critical or important, meaning a failure would materially impair compliance, financial performance or continuity. For such functions, the bank should:

1. Yi wani bincike na hadari da kuma hakkin a kan mai bada sabis kafin contracting.
2. Ka haɗa da haƙƙoƙin yarjejeniyar samun dama, bayanai da bincike ga banki da hukumar da ke da alhakin.
3. Control sub-outsourcing, ciki har da sanarwar da kuma hakkin ya yi watsi ko dakatar.
4. Shigar da bayanan tsaro, wuri da bukatun sirri.
5. Sun rubuce da kuma gwaji fitarwa manufofi.
6. Ka sanar da ma'aikacin da ya cancanta a gaba na shirin muhimmanci ko muhimmanci outsourcing.

Kuma lalle ne, haƙĩƙa, ãyõyi sun bayyana a cikin Littãfi.

Bayan EU

A cikin Birtaniya, PRA Bayanin Supervisory SS2 / 21 akan fitarwa da sarrafa haɗari na ɓangare na uku, wanda aka wallafa a watan Maris 2021 kuma yana aiki daga 31 Maris 2022, ya ƙunshi muhimmanci, tsaron bayanan, hasken rana da shirin fita. PRA ya bayyana shi kamar yadda ake nufi don sauƙaƙe "mafi girman juriya da amincewa da hasken rana da sauran fasahar zamani".

A Singapore, MAS Technology Risk Management Guidelines, wanda aka wallafa a ranar 18 ga Janairu, 2021, ya kafa dokoki don kula da haɗarin fasaha, IT da kuma juriya ta yanar gizo, kuma an cika su da sanarwa mai tsauri da umarnin rahoton hatsarin.

DORA: ci gaba da aiki na dijital a EU

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. Ta na kawo kula da haɗarin ICT, rahoton hatsarin, gwaji da haɗarin ɓangare na uku a cikin dokoki guda don mafi yawan hukumomin kuɗi na EU, gami da bankuna.

yankin DORA	Buƙatun farko ga bankuna
Manajan haɗari	A takardar tsari da aka amince da kuma kula da shi ta hanyar hukumar gudanarwa, rufe ganewa, kare, gano, amsa da dawo da
Rahoto na al'amari	Aikace 19
Resilience testing	A gwajin shirin ga dukan entities; ga entities da aka sani da hukumomi, ci gaba barazana-jawo penetration gwaji aƙalla kowace shekara uku a kan rayuwa samarwa tsarin karkashin Sashe na 26
ICT third party risk	A shirye-shiryen kan ICT na uku-party hadari, contractual minimums, da wani rajista na bayanai a kan duk ICT sabis yarjejeniyoyi a karkashin Sashe na 28
Oversight of critical providers	The European Supervisory Authorities designate critical ICT third-party service providers and oversee them directly under Article 31

Sashe na 28 ya bayyana cewa kungiyoyin kudi da ke amfani da sabis na ICT "za su, a duk lokacin, su ci gaba da zama masu alhakin cika alkawari da kuma biyan dukkan alkawuran" a karkashin DORA da dokokin sabis na kuɗi. Shirin dole ne ya bambanta tsakanin ayyukan tallafawa muhimmanci ko muhimmanci. Kungiyoyi dole ne su bayar da rahoton shekara-shekara game da sabbin ayyuka kuma su sanar da hukumar a cikin lokaci game da kwangilar da aka tsara don ayyuka masu mahimmanci ko muhimmai.

DORA yana amfani tare da EBA umarni na fitarwa. A cikin aiki, bankuna suna kiyaye wani adadi wanda ya gamsar da duka.

Cybersecurity

Cyber hadarin yanzu wani ɓangare na kula da hankali. Supervisors sa ran wani banki don sanin bayanai asusunsa, kare su a daidai da muhimmancinsu, gano hare-hare da sauri, da kuma dawo da muhimmanci sabis a cikin lissafa tolerances.

Key controls usually include:

1. Manajan shaida mai ƙarfi da damar shiga, tare da tabbatarwa mai yawa da kuma kulawa da damar shiga.
2. Tsarin ci gaban manhajar da kuma kula da canje-canje, gami da masu sayar da wayoyin hannu.
3. Shigar da bayanai cikin tafiyar hawa-hawa, da kuma kulawa da maɓalli wanda banki ke sarrafawa.
4. Binciken ci gaba da kuma damar gudanar da ayyukan tsaro, cikin gida ko waje.
5. Manajan cututtuka da gwajin shiga na yau da kullum.
6. Takardun riga-kafi waɗanda aka tsare daga muhallin samarwa kuma aka gwada don dawo dasu.
7. Incident amsa shirye-shiryen da ya shafi regulative sanarwar da abokan ciniki sadarwa.

Tsaro na cin hanci da rashawa yana haɗa cyber da biyan kuɗaɗe. Binciken mai karɓa, nazarin halaye da ƙarfin tabbatarwa na abokin ciniki suna kare abokan ciniki kamar yadda biyan kuɗi ke zama nan take kuma ba za a iya mayar da su ba.

Rahoto na Regulatory

Banks rahoton manyan adadin bayanai ga masu kula da kuma bankin tsakiya. A cikin EU, Sashe na 430 na CRR buƙaci makarantu don gabatar da rahoto kan bukatun kudi na kansu ciki har da leverage ratio, manyan exposures, bukatun liquidity, dukiyar encumbrance da ESG exposures, a tsakanin sauran abubuwa, da wasu makarantu dole ne kuma su gabatar da rahoton bayanan kuɗi.

Rahotanni suna da kyau kamar yadda bayanan da ke bayansu suke. Layin daga tsarin ginshiƙi zuwa mai sarrafawa yana tafiyar da:

1. Tushen bayanai a cikin tsarin ginin da sauran tsarin aiki.
2. A ajiyar bayanai ko rahoton layin da hadin gwiwa zuwa general ledger.
3. Wani injiniyar rahoton doka wanda ke nuna bayanan zuwa siffofin kulawa da dokokin tabbatarwa.
4. Tattaunawa da sa hannu off ta kudi da kuma haɗari, tare da lissafin kulawa.
5. Aikace-aikace ta hanyar gidan yanar gizo na mai kula ko format.

Kuskure a cikin rahoton zai iya haifar da sakamakon kulawa da kuma, inda suka ɓatar da mai kulawa, aiwatarwa. New bankuna yawanci ƙayyade aikin mapping samfurin bayanai zuwa rahoto templates kafin farawa.

Abin da masu kulawa ke nema a cikin aikace-aikacen lasisi

1. A clear target architecture, with each system, its owner, its provider and its location.
2. A critical or important functions map, showing which functions are outsourced and to whom.
3. Exit plans for each critical provider, realistic in time and cost.
4. Lokacin da aka samu bayanan da kuma damar shiga, gami da na mai kula da shi da kuma na hukumar yanke hukunci.
5. Tested resilience, tare da dawo da lokaci wanda ya dace da shirin kasuwancin's sabis alkawurran.
6. Akwai tabbaci na shiryawa, kamar gwajin ƙarshe-zuwa-ƙasa, gyare-gyare na canji da karɓar aiki.

The ECB's guide to fintech bank licensing tambayar masu neman a yi la’akari da wani shirin fita don dakatar da ayyukan a cikin wata hanya mai tsari da kuma mai sauki, ba tare da laifi ga masu amfani ko bukata na gudanarwa shigarwa.

The next article explains the payment rails that the core system connects to: card schemes, SEPA, instant payments and real-time gross settlement.