Considerations on cyber risk in financial information management

What it is about

Juan Fernando Ávila Embriz, from Banco de México, explained at the Third Annual Risk Conference (September 2025) how the central bank manages the security of the financial information it receives and disseminates. The opinions are the author's and do not necessarily represent the position of Banco de México or its Board of Governors.

The 20 slides describe the financial system's data flow (collection, validation, loading into the information model and dissemination), the security strengthening program started in 2017, the policies and families of controls, the biennial plan of 14 priority cybersecurity controls, how controls are applied in IT service provision and the challenges of artificial intelligence.

Objectives

• Describe how the flow of financial information is protected at an authority.
• Explain the structure of information security controls and the biennial plan of priority controls.
• Identify the challenges artificial intelligence poses for cybersecurity.

Key takeaways

1. Since 2017 Banco de México has run a program to strengthen the security of its information, which started from a diagnosis of its level of cybersecurity maturity.
2. Since 2021 it has implemented biennial plans of 14 priority cybersecurity controls, including the inventory of technology assets and the risk assessment of information assets.
3. Controls are implemented across all groups of IT management processes, including the operation of the collection system, which serves some 3,200 users from 250 financial entities.
4. The collection system automates 55 data collection and validation forms or processes and handles each year some 10,000 incident support cases and 3,500 service requests.
5. Among the challenges of artificial intelligence are the confidentiality of information when using cloud solutions and the complexity of the tools, which makes it hard to identify risks.