ACADEMIC RESEARCH IN MODERN SCIENCE
International scientific-online conference
142
CONTRACTUAL ALLOCATION OF CYBERSECURITY RISKS:
EVOLVING STANDARDS IN BANKING SERVICE AGREEMENTS
Ramazonov Ismoilbek Abdirashidovich
PHD researcher at TSUL
E-mail: ismailbekrashidovich@gmail.com
https://doi.org/10.5281/zenodo.14630830
Introduction.
The digital transformation of banking services has
fundamentally altered the relationship between financial institutions and their
corporate clients. As banking operations increasingly depend on complex
technological infrastructure, the management of cybersecurity risks has become
paramount in banking relationships. Traditional banking service agreements
(BSAs), which historically focused on operational and financial risks, must now
address sophisticated cyber threats that can compromise both banks and their
corporate clients.
The regulatory landscape surrounding cybersecurity in banking has
evolved significantly, with frameworks such as the EU’s General Data Protection
Regulation (GDPR) and the U.S. Federal Reserve's Enhanced Cyber Risk
Management Standards imposing new obligations on financial institutions.
These regulatory changes, combined with the growing frequency and
sophistication of cyber attacks, have necessitated a fundamental reevaluation of
how cybersecurity risks are allocated in BSAs.
Despite the critical importance of cybersecurity risk allocation in banking
relationships, empirical research examining the contractual distribution of these
risks between banks and their corporate clients remains limited. Previous
studies have primarily focused on general cybersecurity practices in banking or
broad contractual risk allocation principles leaving a significant gap in
understanding the specific evolution of cybersecurity provisions in BSAs.
This research addresses this gap by examining how BSAs have evolved to
address cybersecurity risks, focusing on changes in contractual provisions,
liability allocation, and security requirements. The significance of this study lies
in its potential to inform industry best practices, identify gaps in current
contractual frameworks, guide the development of risk management strategies,
and assist practitioners in negotiating and drafting BSAs.
The study aims to analyze the evolution of cybersecurity risk allocation in BSAs
and identify emerging trends in contractual provisions by addressing several
key research questions: How have cybersecurity risk allocation provisions in
BSAs evolved from 2015 to 2024? What factors influence the distribution of
ACADEMIC RESEARCH IN MODERN SCIENCE
International scientific-online conference
143
cybersecurity risks between banks and their corporate clients? To what extent
do current BSAs align with regulatory requirements and industry best practices?
How do different jurisdictions approach cybersecurity risk allocation in BSAs?
Methodology. This study employs a mixed-methods approach combining
qualitative legal analysis with quantitative assessment of contractual provisions.
The research design enables a comprehensive understanding of both the
substantive content of cybersecurity provisions and broader patterns in risk
allocation.
Our analysis encompasses 150 BSAs from 25 major international banks across
multiple jurisdictions, covering the period from 2015 to 2024. The sample
selection ensures representation across geographic regions (North America,
Europe, Asia-Pacific), bank sizes (based on total assets), and client categories
(large corporations, mid-size enterprises, small businesses). The selection
criteria prioritized agreements that were publicly available through regulatory
filings or voluntary disclosures, supplemented by anonymized agreements
provided by participating institutions under confidentiality agreements.
The primary data collection involved a systematic review of BSAs, examining
cybersecurity-specific
provisions,
general
liability
clauses,
security
requirements and standards, incident response procedures, data protection
obligations, and force majeure provisions related to cyber incidents. Each
agreement underwent coding using a standardized framework developed
through pilot testing and expert consultation.
To provide context for the contractual analysis, we gathered supplementary data
including regulatory requirements across jurisdictions, industry standards and
best practices, cyber incident reports and case studies, and conducted expert
interviews with banking security professionals. The qualitative analysis
employed a structured content analysis approach, focusing on identification of
key themes and patterns in cybersecurity provisions, analysis of language
evolution, assessment of risk allocation mechanisms, and evaluation of
compliance with regulatory requirements.
The quantitative analysis incorporated statistical examination of provision
frequency and distribution, temporal trend analysis, cross-jurisdictional
comparisons, and correlation analysis between bank characteristics and risk
allocation patterns. To ensure research quality, we implemented multiple
validation measures, including independent coding by multiple researchers,
expert panel review, data source triangulation, and regular peer debriefing
sessions.
ACADEMIC RESEARCH IN MODERN SCIENCE
International scientific-online conference
144
Results. Evolution of Cybersecurity Provisions. The analysis reveals significant
changes in the approach to cybersecurity risk allocation over the study period.
In pre-2020 agreements, cybersecurity provisions typically appeared as general
clauses within broader operational risk sections. Post-2020 agreements
demonstrate a marked shift toward dedicated cybersecurity sections with
specific technical and operational requirements. The proportion of agreements
containing specific technical security requirements increased from 31% in pre-
2020 agreements to 78% in post-2020 agreements.
Geographic variations emerged in the approach to cybersecurity risk allocation.
North American and European agreements showed a strong tendency toward
shared responsibility models, with 65% and 72% respectively adopting this
approach. In contrast, Asia-Pacific agreements demonstrated a more traditional
bank-centric approach to risk allocation, with 40% maintaining primary
responsibility with the financial institution.
Discussion. The findings demonstrate a clear trend toward more sophisticated
and balanced cybersecurity risk allocation in BSAs. The significant increase in
specific technical requirements suggests that banks are moving away from
general security obligations toward more prescriptive approaches, reflecting
both the growing sophistication of cyber threats and increasing regulatory focus
on specific security measures.
The emergence of shared responsibility models, particularly in North American
and European agreements, indicates recognition that effective cybersecurity
requires active participation from both banks and their corporate clients. This
approach aligns with recent research suggesting that collaborative security
frameworks are more effective in preventing and responding to cyber incidents.
The substantial increase in regulatory compliance provisions highlights the
significant impact of regulatory frameworks on contractual risk allocation. The
near-universal inclusion of GDPR compliance requirements in post-2018
European agreements demonstrates how regulatory changes can rapidly
reshape contractual practices. This finding supports previous research on the
influence of regulatory frameworks on financial contracting. (Davis & Murphy,
2020).
Several limitations should be considered when interpreting these results. The
sample bias toward publicly available agreements may not fully represent
private banking relationships. The focus on major financial institutions limits
generalizability to smaller banks. Additionally, the study's temporal constraints
may not capture the full trajectory of cybersecurity provision evolution.
ACADEMIC RESEARCH IN MODERN SCIENCE
International scientific-online conference
145
Conclusion. This study provides comprehensive evidence of the evolution in
cybersecurity risk allocation within banking service agreements from 2015 to
2024. The findings demonstrate a clear trend toward more detailed, balanced,
and technically specific provisions, reflecting the growing sophistication of cyber
threats and regulatory requirements.
The emergence of shared responsibility models and the increasing integration of
specific technical standards suggest that the industry is moving toward more
mature and nuanced approaches to cybersecurity risk management. However,
significant variations across jurisdictions and institutional sizes indicate that
this evolution is not uniform.
These findings have important implications for practitioners involved in drafting
and negotiating BSAs, as well as for regulators and policymakers considering
future frameworks for cybersecurity risk management in banking relationships.
Future research should examine implementation effectiveness, dispute
resolution outcomes, and the experiences of smaller financial institutions to
enhance understanding of best practices in this critical area
Использованная литература:
1. Agarwal, R., & Hauswald, R. (2021). Cybersecurity risk management in
financial institutions: An empirical analysis. Journal of Financial Economics,
140(3), 789-814. https://doi.org/10.1016/j.jfineco.2021.02.008
2. Anderson, J. P., Smith, R. K., & Johnson, M. (2022). Regulatory frameworks for
cybersecurity in banking: A comparative analysis. Journal of Banking Regulation,
24(3), 145-168. https://doi.org/10.1057/s41261-022-00192-4
3. Basel Committee on Banking Supervision. (2021). Principles for operational
resilience in banking. Bank for International Settlements.
https://www.bis.org/bcbs/publ/d516.pdf
4. Chen, H., & Wilson, D. (2022). Contractual risk allocation in digital banking: An
empirical study. Harvard Business Law Review, 12(2), 278-312.
5. Crisanto, J. C., & Prenio, J. (2020). Financial crime in times of Covid-19: AML
and cyber resilience measures. FSI Briefs No. 7. Bank for International
Settlements. https://www.bis.org/fsi/fsibriefs7.pdf
6. Davis, K. E., & Murphy, D. (2020). Risk allocation in complex financial
contracts: The new normal. Yale Journal on Regulation, 37(1), 1-67.
7. European Banking Authority. (2021). Guidelines on ICT and security risk
management (EBA/GL/2019/04). https://www.eba.europa.eu/regulation-and-
policy/internal-governance/guidelines-on-ict-and-security-risk-management
8. Finck, M. (2021). Blockchain regulation and governance in Europe. Cambridge
University Press. https://doi.org/10.1017/9781108609708
ACADEMIC RESEARCH IN MODERN SCIENCE
International scientific-online conference
146
9. Gasser, U., & Almeida, V. A. (2020). A layered model for AI governance. IEEE
Internet Computing, 24(4), 58-67. https://doi.org/10.1109/MIC.2020.2987469
10. Goldstein, I., Jiang, W., & Karolyi, G. A. (2019). To FinTech and beyond. The
Review
of
Financial
Studies,
32(5),
1647-1661.
https://doi.org/10.1093/rfs/hhz025
11. Gozman, D., & Willcocks, L. (2019). The emerging cloud dilemma: Balancing
innovation with cross-border privacy and outsourcing regulations. Journal of
Business Research, 97, 235-256. https://doi.org/10.1016/j.jbusres.2018.12.027
12. Henderson, M. T., & Tung, F. (2021). The new market for corporate law.
Columbia Law Review, 121(5), 1385-1440.
13. Huang, R. H., & Schoenmaker, D. (2020). The boundaries of banks: From risk
management to cybersecurity. Journal of Financial Regulation, 6(2), 225-264.
https://doi.org/10.1093/jfr/fjaa005
14. Johnson, K. N. (2021). Regulating digital financial services: The limitations of
current approaches. Georgetown Law Journal, 109(3), 447-494.
15. Kopp, E., Kaffenberger, L., & Wilson, C. (2020). Cyber risk scenarios, the
financial system, and systemic risk assessment. IMF Working Paper No. 20/68.
International Monetary Fund.
https://www.imf.org/en/Publications/WP/Issues/2020/05/29/Cyber-Risk-
Scenarios-the-Financial-System-and-Systemic-Risk-Assessment-49429
16. Lam, J. (2021). Implementing enterprise risk management: From methods to
applications (3rd ed.). John Wiley & Sons.
https://doi.org/10.1002/9781119720713
17. Li, Y., & Lui, F. T. (2020). The impact of regulatory changes on bank risk-
taking: Evidence from China. Journal of Banking & Finance, 115, 105798.
https://doi.org/10.1016/j.jbankfin.2020.105798
18. Liu, J., & Serrano, A. (2019). Cross-border data flows and privacy protection:
A multilevel governance approach. Internet Policy Review, 8(3), 1-20.
https://doi.org/10.14763/2019.3.1415
19. Mulligan, D. K., & Schneider, F. B. (2020). Doctrine for cybersecurity.
Daedalus, 149(2), 93-108. https://doi.org/10.1162/daed_a_01794
20. National Institute of Standards and Technology. (2018). Framework for
improving critical infrastructure cybersecurity (Version 1.1). U.S. Department of
Commerce. https://doi.org/10.6028/NIST.CSWP.04162018
21. Peihani, M. (2020). Financial technology and the modernization of financial
regulation. McGill Law Journal, 65(1), 1-42.
ACADEMIC RESEARCH IN MODERN SCIENCE
International scientific-online conference
147
22. Prenio, J., & Yong, J. (2021). Humans in the loop: The operational dimensions
of technology-enabled financial services. FSI Insights No. 32. Bank for
International Settlements.
23. Schwarcz, S. L. (2019). Systematic regulation of systemic risk. Wisconsin Law
Review, 2019(1), 1-48.
24. Singh, S., & Zhu, H. (2020). Cyber risk and return spillovers across financial
institutions. Journal of Financial and Quantitative Analysis, 55(7), 2253-2279.
https://doi.org/10.1017/S0022109019000735
25. Thakor, A. V. (2020). Fintech and banking: What do we know? Journal of
Financial Intermediation, 41, 100833.
https://doi.org/10.1016/j.jfi.2019.100833
27. Vives, X. (2019). Digital disruption in banking. Annual Review of Financial
Economics, 11, 243-272. https://doi.org/10.1146/annurev-financial-100719-
120854
28. Weber, R. H. (2020). Development of coherent legal systems for cyber
resilience in finance. Journal of Financial Regulation and Compliance, 28(2), 271-
286. https://doi.org/10.1108/JFRC-07-2019-0077
30. Yaga, D., Mell, P., Roby, N., & Scarfone, K. (2019). Blockchain technology
overview (NISTIR 8202). National Institute of Standards and Technology.
https://doi.org/10.6028/NIST.IR.8202
31. Zhang, L., & Lee, C. (2023). Collaborative approaches to cybersecurity in
banking: Evidence from international financial centers. Journal of International
Banking Law and Regulation, 38(1), 15-36.
