• Home
• Banks

The Central Bank of Egypt (CBE) has officially launched version 2.0 of the Egyptian Comprehensive Cybersecurity Framework for the financial and banking sector, aiming to strengthen digital protection and improve financial institutions’ readiness to address growing cyber threats amid rapid technological change, wider use of artificial intelligence and the expansion of digital banking services.

Speaking at the launch event, Tarek El-Kholy, CBE Deputy Governor for Banking Stability, said the new edition represents a shift in the approach to cybersecurity supervision and protection. It replaces conventional assessment methods with a dynamic, multi-stage model based on the actual risks facing financial institutions.

He explained that the framework goes beyond introducing additional regulatory controls. It also upgrades readiness assessment mechanisms and links requirements to risk drivers, helping institutions allocate investments in line with their business scale and risk exposure.

Grace period for banks to implement the new framework

El-Kholy said the CBE had prepared copies of the second edition for participants at the launch event, with additional copies to be sent to banks when needed. The Central Bank will set a grace period for banks to implement the new requirements and communicate its duration in the coming period.

The CBE will also provide direct communication channels with the relevant teams to clarify provisions and explain amendments introduced in version 2.0 compared with the first edition, V1.0.

38 standards to assess cybersecurity readiness

The Deputy Governor revealed that the framework currently contains 38 standards for measuring cybersecurity readiness across the financial and banking sector.

He noted that readiness levels vary among banks depending on their size, resources and technological capabilities, and that no single percentage can accurately represent the entire sector. While current readiness levels are high, he stressed that institutions must continue upgrading their protection systems as cyber threats and attack techniques evolve.

The CBE aims to raise readiness levels further and bring all banks towards a consistent level of preparedness.

On-site supervision and corrective measures

The Central Bank’s On-site Supervision teams, working alongside Information Security officials, will monitor implementation of the new framework. Field assessments will examine each bank’s actual ability to apply the requirements, rather than simply verify formal compliance.

El-Kholy stressed that the CBE would prioritize corrective actions, guiding banks to address weaknesses and improve their capabilities before resorting to violations or penalties. The objective is to strengthen resilience and preserve the stability of the banking sector.

Free cyberattack simulation and training project

El-Kholy announced that the CBE is preparing a new project in cooperation with the Banking Sector Development Fund to establish a specialized environment for simulating cyberattacks and training bank information-security teams.

The project, which was launched as an initiative under the Governor’s direction, remains under preparation and has not yet entered operation.

The idea followed a practical simulation experience attended by CBE officials at a European conference last year. The training model divides participants into two groups: an offensive Red Team and a defensive team. The first conducts simulated attacks to test the second team’s protection systems and response capabilities, with scenarios changing continuously.

The CBE is preparing to launch a tender to establish the simulation environment and make it available to banks operating in Egypt free of charge. Information-security employees will be able to attend practical exercises, test their response capabilities, identify potential vulnerabilities and improve incident-handling procedures. No final launch date has been announced.

Risk analytics and business continuity

El-Kholy emphasized that risk analytics are essential to creating a secure and reliable digital environment. Cybersecurity, he said, is not limited to protecting systems and data; it also supports economic growth and the continuity of financial and banking operations.

He highlighted the importance of Enterprise Risk Management and balancing banking stability with sustainability, noting that stability at a particular point does not necessarily guarantee business continuity when unexpected challenges arise.

CBE receives three digital bank licence applications

The Deputy Governor disclosed that the CBE had received three applications for licences to establish new digital banks in Egypt, as more banks pursue digital transformation projects.

He also referred to a digital bank named Onebank, which is expected to begin operations in the near future. He stressed that the expansion of digital banking must be accompanied by stronger cybersecurity measures to ensure safe and reliable services.

The first edition became a national reference in 2022

El-Kholy said the first edition of the Egyptian Comprehensive Cybersecurity Framework, launched in 2022, established common terminology and standardized criteria for assessing the cyber readiness of banks and financial institutions. It subsequently became a national reference used by several government and sovereign entities to strengthen digital protection.

The framework helped improve supervision, close security gaps, enhance policy implementation and accelerate continuous development across financial institutions. Version 2.0 builds on those achievements while addressing the changing threat landscape.

He added that the establishment of the CBE’s cybersecurity sector dates back to 2017. The initiative gradually developed from a specialized cybersecurity structure into a central department and ultimately a dedicated sector overseeing cybersecurity across the banking and financial industries in coordination with relevant authorities.

Early warnings and lessons from cyber incidents

El-Kholy discussed the warnings issued by the CBE’s cybersecurity sector to banks about potential threats. Such alerts may arrive late at night, he said, but require prompt attention from information-security and risk-management teams.

Specialized entities analyze threats and simulate attack scenarios observed in different parts of the world before issuing alerts containing warnings and technical guidance to test the strength of banks’ defensive systems.

He revealed that a bank suffered a cyberattack in February 2022. The relevant teams, working with the bank’s management, managed to contain the incident, allowing the bank to reopen the following day and resume operations in a balanced manner. The experience demonstrated the importance of preparedness, coordination and timely responses to warnings.

He also warned that a continued disruption of systems on the day after the Ramses Central incident could have affected the Automated Clearing House (ACH), the Real-Time Gross Settlement (RTGS) system and electronic clearing operations, potentially paralysing financial and banking transactions nationwide. Rapid response and coordination helped contain the consequences and maintain the continuity of critical systems.

Artificial intelligence adds new cybersecurity challenges

El-Kholy said rapid technological development and the spread of AI applications are creating new challenges for financial institutions, as attackers adopt increasingly sophisticated tools and may target defensive systems themselves.

He called for continuous upgrades to cybersecurity capabilities and greater use of technology to improve threat monitoring and incident response. Cybersecurity, he added, has become a core element of enterprise risk management rather than a technical responsibility limited to IT departments.

Cybersecurity covers the wider financial sector

The Deputy Governor stressed that the CBE’s cybersecurity efforts extend beyond banks to the entire financial sector. Given the links between institutions, an attack on the stock exchange or a company supervised by the Financial Regulatory Authority could indirectly affect banking operations.

He confirmed coordination with sovereign and government entities, the National Telecom Regulatory Authority and the Ministry of Communications and Information Technology to protect digital infrastructure and essential services.

El-Kholy also referred to President Abdel Fattah El-Sisi’s emphasis on cybersecurity during a meeting with the CBE Governor and the Prime Minister. He noted that the Supreme Council for Cybersecurity is chaired by the President.

Egypt expands cybersecurity cooperation with Africa

El-Kholy said Egypt’s experience in developing its comprehensive cybersecurity framework has attracted interest from entities in several African countries. He highlighted Egypt’s participation in African organizations and its role in exchanging expertise with other countries.

The CBE’s African Affairs Department coordinates with several sectors, including cybersecurity, information technology and banknote printing. El-Kholy also revealed that Egypt receives requests from African countries to print their currencies, describing this as a reflection of confidence in Egypt’s technical and technological capabilities.

He warned that modern banknote-printing machines rely on advanced electronic systems and are therefore potentially exposed to cyberattacks. Cybersecurity measures, he stressed, must cover equipment and digital systems used in critical activities.

Protecting interconnected systems and addressing skills shortages

El-Kholy highlighted the need to secure communications and systems connected to the CBE’s cash centre and head office. A virus or cyberattack spreading between interconnected systems could affect Core Banking platforms and other cash and banking systems.

He urged banks to strengthen their Information Security teams, pointing to a shortage of specialized cybersecurity professionals, including within the Central Bank itself. Demand for these skills is increasing alongside digital transformation.

Attracting and retaining specialists requires more than financial incentives and job benefits, he said. Institutions must also provide a healthy and motivating work environment and invest in employee development. Such investment is strategic to protecting financial institutions and the national economy.

Cybersecurity as a foundation for innovation

El-Kholy concluded that the CBE’s ambitions extend beyond securing banks to strengthening the digital resilience of critical sectors across the country. The Egyptian framework provides a national reference through which financial, government and sovereign institutions can coordinate their efforts.

Cybersecurity is no longer merely a preventive measure, he said. It has become an enabling environment for innovation and a prerequisite for a safe and sustainable digital future. The CBE will continue supporting innovative technology in the financial and banking sector while maintaining high standards of protection and financial safety.