Research Report on Third-Party Cybersecurity Risk Management for Financial Institutions
Summary
Japan's Financial Services Agency published a research report on third-party cybersecurity risk management for financial institutions. The FSA commissioned Deloitte Tohmatsu Cyber LLC to examine management practices among major banks and large insurance companies in the United States, European Union, and United Kingdom. The report provides provisional English translations for industry reference.
What changed
The FSA published a research report titled 'Strengthening the Management of Third-Party Cybersecurity Risks by Financial Institutions,' examining cybersecurity risk management practices adopted by major financial institutions in the US, EU, and UK. The study was commissioned to Deloitte Tohmatsu Cyber LLC and covers how banks and large insurance companies manage third-party cybersecurity risks. Two PDF versions are available: a 714KB summary report and a full 1,389KB report.
Regulated entities in Japan should review this research report to understand international best practices for third-party cybersecurity risk management. While the report is informational and non-binding, compliance teams should consider integrating these international standards into their own third-party risk frameworks. The report is available in English translation through the FSA website, with contact provided through the Office of Policy Coordination for IT Risk, Cybersecurity and Economic Security.
Source document (simplified)
April 3, 2026
Financial Services Agency
Publication of the Research Report,
“Strengthening the Management of Third-Party Cybersecurity Risks by Financial Institutions”
The FSA commissioned Deloitte Tohmatsu Cyber LLC to conduct a “Strengthening the Management of Third-Party Cybersecurity Risks by Financial Institutions”.
In light of the growing importance of third-party cybersecurity risk management, the study examined management practices adopted by major banks and large insurance companies in the United States, the European Union, and the United Kingdom.
The provisional English translation is provided below.
- The Research Report, "Strengthening the Management of Third-Party Cybersecurity Risks by Financial Institutions" (Summary Report) (PDF:714KB)
- The Research Report, "Strengthening the Management of Third-Party Cybersecurity Risks by Financial Institutions"(PDF:1389KB) Contact Office of Policy Coordination for IT Risk, Cybersecurity and Economic Security, Strategy, Development and Management Bureau, Financial Service Agency
Telephone:+81-(0)3-3506-6000 (ext.2217, 3850)
Site Map
About FSA Ministerial Team Organization Location Pamphlet Open Policy Lab Press Releases & Public Relations Press Releases Press Conferences Official Statements FSA Weekly Review & ACCESS FSA Speeches For Financial Users Others Archives Policies & Councils Policies Councils Laws & Regulations Name of Laws and Regulations(PDF)
Recent Changes (Legislation, Ordinances, Guidelines) Guidelines Financial Instruments and Exchange Act Financial Monitoring Policy Public Comment No-Action Letter System Procedures concerning Foreign Account Management Institutions Regulated Institutions List of Institutions Administrative Action Statistics For those engaging in High Speed Trading To Operators of Specially Permitted Businesses for Qualified Institutional Investors, etc. Asia Region Funds Passport (ARFP) FSA Weekly Review & ACCESS FSA Back Number (2022) Back Number (2021) Back Number (2020)
Related changes
Source
Classification
Who this affects
Taxonomy
Browse Categories
Get Banking & Finance alerts
Weekly digest. AI-summarized, no noise.
Free. Unsubscribe anytime.
Get alerts for this source
We'll email you when Japan FSA Press Releases publishes new changes.