Regulators Warn that Death of Windows XP Could Pose Risks

Financial institutions still using the Windows XP operating system should prepare now for glitches and data breaches that could occur when it ceases to be supported by its maker next year, regulators say.

On April 8, 2014 Microsoft plans to discontinue support for the once ubiquitous operating system. The announcement by the company, intended to push technology stragglers onto its newer products, is not without some regulatory repercussions. In a statement issued Monday afternoon by the Federal Financial Institutions Examination Council, financial institutions, their technology service providers, and other third parties were instructed to identify, assess, and manage potential operational risks associated with the discontinuation of XP support and “ensure that safety and soundness and the ability to deliver products and services are not compromised.”

Once Microsoft discontinues extended support for XP it will no longer provide regular security patches, technical assistance, or support for the operating system. Financial institutions and their vendors who use XP in personal computers, servers, and automated teller machines, or that are dependent on applications that require the use of XP, could be exposed to increased operational hazards, the regulators said. Potential problems include application incompatibilities and the increased threat of data theft and unauthorized additions, deletions, and changes of that data. Financial institutions and TSPs that are subject to the requirements of the Payment Card Industry Data Security Standard may no longer be compliant.

The guidance urges financial institutions that use XP to follow their risk management processes and fully address the potential risks that may come with its use after it is officially discontinued.

The FFIEC includes members from the Federal Reserve, Federal Deposit Insurance Corporation, National Credit Union Administration, Comptroller of the Currency, Consumer Financial Protection Bureau, and representatives of state agencies that supervise financial institutions.