According to Russian hacker group Lockbit, which claims responsibility for the cyber-attack on ION Cleared Derivatives (a division of ION Markets) last week, the alleged ransom has been paid and a decryption key provided to the firm – although it declined to give details. However, even with the decryption key, sources close to ION tell The TRADE that the firm plans to build new infrastructure for its derivatives platform rather than risk returning to the hacked systems.

Starting from scratch 

“They are not relying on restoring or reactivating any compromised structures,” said the source. “The focus right now is on rebuilding and mitigating any further risk.”  

The self-spreading, automated ransomware works by gaining access to a system – usually through a compromised server or remote desktop account – and encrypting it so that it cannot be used or its information accessed. A ransom demand is then issued, often accompanied by the threat of making confidential information public if it is not paid. However, even if the ransom is paid, it can take substantial time and effort to restore affected files and systems, which usually need to be wiped once retrieved, as they can no longer be trusted.  

Read More – ION suffers cyber attack on derivatives platform

ION declined to formally comment as to whether it has paid the ransom or not. However, even with access to its systems restored, this could just be the start of its problems.  

A slap on the wrist?  

The authorities take a dim view of cyber-attack ransoms being paid – and could respond with financial penalties that match or exceed the ransoms themselves. In 2018, for example, the UK’s Financial Conduct Authority (FCA) fined Tesco Bank £16.4 million for “failing to exercise due skill, care and diligence” in protecting its personal current account holders against a cyber-attack that took place in 2016.  

The UK regulators have since made their position on the payment of ransoms clear. In July 2022, the UK’s National Cyber Security Centre (NCSC) and Information Commissioner’s Office (ICO) issued updated guidance stating that: “Paying ransoms to release locked data does not reduce the risk to individuals, is not an obligation under data protection law, and is not considered as a reasonable step to safeguard data.” 

“Ransomware remains the biggest online threat to the UK and we are clear that organisations should not pay ransom demands,” said NCSC CEO Lindy Cameron. The ICO has clarified that it will not take this into account as a mitigating factor when considering the type or scale of enforcement action. 

In March 2022, the ICO handed down its first Monetary Penalty Notice for a ransomware attack and data infiltration incident under the UK General Data Protection Regulation (GDRP). The £98,000 fine, against criminal law firm Tuckers, was regarding a cyber-attack in August 2020 in which the firm paid the requested ransom and was subsequently subject to an enforcement action.

In 2018, the introduction of GDPR saw the limit on data breach fines bumped up from a max of £500,000 to a possible 4% of total global turnover or £17.5 million (€20 million in the EU), whichever is greater – making it rather more than just a slap on the wrist, should the penalty for paying the ransom be enforced.  

US position  

In the US, the Department of Treasury’s Office of Foreign Asset Control (OFAC) issued an updated advisory in September 2021 warning all ransomware victims that if they succumb to ransomware demands and pay foreign actors who are subject to US sanctions, they could also be subject to financial penalties.  

Read More – ION cyber concerns continue: US Treasury steps in

“Facilitating a ransomware payment that is demanded as a result of malicious cyber activities may enable criminals and adversaries with a sanctions nexus to profit and advance their illicit aims,” said the statement. “The US government strongly discourages the payment of cyber ransom or extortion demands.”  The US Treasury has already convened a working group in partnership with industry associations in response to the recent ION attack. 

Companies involved in facilitating ransomware payments on behalf of victims should also consider whether they have regulatory obligations under Financial Crimes Enforcement Network (FinCEN) regulations 

Tightening regulation 

According to the FBI, there was a nearly 21% increase in reported ransomware cases and a 225% increase in associated losses from 2019 to 2020. The UK saw a 51% increase in “material cyber incidents” in 2021, while a 2023 report from Chainalysis claims that globally, $457 million was paid worldwide in ransom payments in 2022. It’s a growing trend, and as the risks increase, so too does regulatory scrutiny.  

In the UK, new FCA and PRA requirements in relation to operational resilience came into force on 31 March 2022, with a focus on cyber resilience forming a key element of the FCA’s 2022/23 Business Plan, while the FCA has also indicated that it wants to increase its powers of direct oversight of service providers like ION. 

Meanwhile in the US, Commodities Futures Trading Commission (CFTC) chairman Rostin Behnam has laid out plans to tighten up cyber regulation on his own side of the pond. “The growth of cybersecurity threats to financial institutions is well-documented and widely recognised as an important and increasingly urgent problem,” he said in prepared comments.  

“While many of our registrants are subject to cyber requirements through prudential and other regulatory regimes, there is a greater role for the Commission to play in fostering sound and responsive cybersecurity practices among our registrants.” 

He confirmed his support for a new operational resilience rule for futures commission merchants (FCMs) and swap dealers (SDs). 

The post ION has reportedly paid the ransom – but could it cause more harm than good? appeared first on The TRADE.

The cyber attack on ION Markets continues to make waves, with unconfirmed rumours suggesting that the firm may be in a stand-off with the hackers with regards to a ransom. ION responded with no comment. 

The malicious ransomware has been involved in numerous high-profile hacks in recent years: including US rail giant Wabtec in March 2022, the Port of Lisbon in December 2022, and the UK’s Royal Mail in January 2023. In each case, the hackers demanded a ransom to prevent them leaking sensitive data.  

Read More – ION suffers cyber attack on derivatives platform

While it is not known how ION is responding to any ransom demands that may have been issued, the US authorities are taking the situation extremely seriously. 

A senior spokesperson from the US Department of the Treasury contacted The TRADE at 9.28pm GMT on 1 February to confirm its actions.  

“Treasury and the Financial and Banking Information Infrastructure Committee (FBIIC) are aware of the ransomware attack targeting ION,” said Todd Conklin, deputy assistant secretary of the Treasury for Office of Cybersecurity and Critical Infrastructure Protection (OCCIP). 

“Today, Treasury convened a common operating picture level set with FBIIC, Financial Services Information Sharing and Analysis Center (FS-ISAC), Financial Services Sector Coordinating Council (FSSCC), and Securities Industry and Financial Markets Association (SIFMA).  

“The issue is currently isolated to a small number of smaller and mid-size firms and does not pose a systemic risk to the financial sector.  We remain connected with key financial sector partners, and will advise of any changes to this assessment.” 

The post ION cyber concerns continue – US Treasury steps in appeared first on The TRADE.

American dollar and Russian ruble

At least six banks have started cautiously returning to the Russian bond market, reported Reuters today. JP Morgan, Bank of America, Citigroup, Deutsche Bank, Barclays and Jefferies are all reported to have started once again facilitating trades in Russian government and corporate bonds for their clients.  

A spokesperson for Deutsche Bank confirmed to The TRADE that the information on its Russian bond trading activities was “factually correct”. 

Most banks halted their Russian debt trading earlier this year following heavy sanctions imposed by the US, UK and Europe in response to the Russia-Ukraine conflict, as reported by The TRADE.  

A spokesperson for Deutsche Bank confirmed to The TRADE that the information on its Russian bond trading activities was “factually correct”. 

Following a ramping up of US sanctions against Russia, the Treasury prohibited market participants in the US from purchasing both new and existing debt and equity securities issued by a Russian Federation entity, causing most banks to cease their activities. JP Morgan, one of the last banks to exit, halted trading in June.  

On 22 July, new guidelines from the Treasury allowed holders to start winding down their positions again, within the parameters of current sanctions, allowing investors to exit their toxic positions. The US Treasury approved an auction in credit default swaps sold on Russian bonds late last month, with the Office of Foreign Assets Control (OFAC) issuing licenses for the auction and associated wind-down activities, following a group request by market participants.  

The Treasury also clarified that banks would be allowed to facilitate, clear and settle transactions of Russian securities in order to help their US clients wind down their positions. A Treasury spokesperson said the move was designed to help US and global investors make a clean exit from their Russian holdings.  

It would now appear that activity is being cautiously resumed, with most of the banks operating on a request-only, case-by-case basis.  

Citi, Bank of America and Jefferies declined to comment. JP Morgan and Barclays had not responded at the time of publication.

The post Wall Street banks return to Russian bond trading appeared first on The TRADE.

Derivatives marketplace CME Group has expanded the collateral CME Clearing accepts to include short-term US Treasury ETFs.

The addition will provide clearing members and their clients with greater flexibility and increased efficiency in managing collateral costs. CME notes that ETFs pay a dividend, which is more operationally efficient and mitigates the needs for clients to re-invest maturity proceeds for individual US Treasury securities.

“We are very pleased to provide our market participants with additional capital efficiencies by continuing to expand the types of collateral we accept,” said Suzanne Sprague, senior managing director and global head of clearing and post-trade services. “We’ve worked closely with ETF sponsors to ensure that this new collateral both meets our rigorous risk management standards and offers a broader range of collateral choices for clearing members.”

Mike Crinieri, global head of ETFs at Goldman Sachs Asset Management, added: “Treasury ETFs such as the Goldman Sachs Access Treasury 0-1 Year ETF (GBIL) are a useful form of collateral that may benefit clients who have challenges managing the roll of a US Treasury Bill portfolio, or who simply wish to outsource treasury management. We are excited to work with CME Clearing to deliver the operational efficiency of the ETF wrapper for collateral purposes.”

The short-term ETFs invest in US Treasury securities with less than one-year to maturity and are portable instruments held at the Depository Trust Company.

The post CME Clearing expands collateral to include short-term US Treasury ETFs appeared first on The TRADE.

The survey on the US Treasury market is aimed at better understanding the trends and challenges borne by buy-side managers who participate in the market.

Aite Group and The TRADE have partnered on the research to uncover insights into the trading of US treasuries, pricing and transparency, and changes we might expect to see over the next 12 to 18 months.

“This is an especially exciting survey to conduct because of the changes we are seeing in the way both on- and off-the-run US Treasuries are being traded,” said Audrey Blater, senior analyst at Aite Group.

“The adoption of tools such as algorithms to transact these securities has enabled firms to focus and specialise on more complex trades and alpha generation.

“Generally speaking, automation and electronification of trading has led to greater efficiencies. We are excited to learn more about the adoption of electronic trading tools and protocols by the buy-side in the market for US Treasuries.” 

The survey will explore, among other things, the buy-side’s adoption of e-trading and what tools they will use, along with off-the-run US Treasuries and packages such US Treasuries traded against swaps, futures, and TBAs.

“Beyond efficiencies in the front office, the e-trading of US Treasuries is supported by straight-through processing – creating efficiencies along the entire workflow chain. This is a process that used to be plagued with manual steps and errors,” added Blater.

“We’ve consistently had an interest in the adoption rates of e-trading in financial markets. While the sell-side often uses electronic and automated means to transact U.S. Treasuries, the buy-side has some catching up to do. This study allows us to take the pulse of this progression.”

To thank respondents for completing the survey, Aite Group will send charts with the aggregate results those who fill in the survey.

A write-up of the results will also be published in The TRADE’s summer issue, available at the end of June.

Readers of The TRADE can complete the survey by clicking this link.

All responses will be reported anonymously and in aggregate. Individual responses will remain strictly confidential, and the report will not include the names of individuals or companies that participate.

If you have any further questions on the survey or wish to discuss, please contact Aite Group senior analyst Audrey Blater, Ph.D. (ablater@aitegroup.com).

The post New US Treasury survey launched by The TRADE and Aite Group appeared first on The TRADE.

OpenDoor Securities launched on Tuesday with the backing of nearly three dozen firms representing more than $5 trillion of assets under management, with six sponsor dealers including Societe Generale and Bank of Nova Scotia, which have onboarded to the platform.

Its users include central banks, hedge funds, pension funds, asset managers, trading firms and primary dealers, among others.

“The Treasury market remains bifurcated between the six benchmark issues and the remaining three-hundred plus off-the-runs,” stated Estes.

“As a result, real-money accounts continue to experience increased transaction costs in their core bond holdings through ever widening bid-offer spreads. This is felt to a much larger degree by accounts trading less volume than the top ten. OpenDoor’s solution works for all participants, targeting an often-overlooked but vital pillar of national debt.”

It provides an all-to-all marketplace for traders struggling to source liquidity in off-the-run Treasuries (OFTRs) and Treasury Inflation Protected Securities (TIPS), which combined represent 98% of the $13.8 trillion of total outstanding issuance in the US Treasury market.

With banks’ having less capacity to house securities on their balance sheets, off-the-run Treasuries have become more difficult to trade.

“Liquidity conditions remain challenging across many asset classes, even in the off-the-run segments of liquid markets such as U.S. Treasuries,” said Barry Cohen, managing director and head of rates sales, Americas, Societe Generale.

“We absolutely believe that the OpenDoor platform represents an innovative way to utilise technology to achieve added liquidity in the off-the-run and less liquid corners of the Treasuries market. Being involved on day 1 shows our commitment to the US markets, our customers, and our partnership with the team at OpenDoor.”

The post Former Morgan Stanley, Deutsche Bank fixed income head goes live with startup platform appeared first on The TRADE.

The Securities and Exchange Commission’s (SEC) chair, Mary Jo White, has said public reporting for US Treasury transactions is the next critical step the regulator is considering.

In a keynote address at a US Treasury conference in New York, White explained to delegates that public reporting is “a question of ‘how best’ to deliver public transparency, not ‘whether’ to do so.”

She asserted: “I am committed to working with my fellow regulators to arrive at the optimal solution.”

White also defended the newly approved reporting requirements for US Treasury transactions.

She explained some commenters expressed concern that the reporting rules only applied to members of the Financial Industry Regualtory Authority (FINRA). 

White added those commenters believed it “would result in a competitive disparity, given that non-FINRA member firms also trade US Treasury securities.”

She added that some had said an audit trail consisting only of transactions effected by FINRA members “would not provide regulators with a comprehensive understanding of the market without the same requirements for bank-dealers.”

The Federal Reserve Board recently announced plans to enter into negotiations with the SEC to collect data from banks for US Treasury transactions.

Commenting on this, White said she was pleased with the announcement and the possibility of FINRA acting as an agent on behalf of the Federal Reserve Board.

The post SEC eyes public reporting amid US Treasury reporting rules appeared first on The TRADE.