Featured Product

    ESRB Publishes Report on Systemic Cyberattacks

    February 19, 2020

    ESRB published a report that explores systemic implications of cyber incidents, such as cyberattacks. The report summarizes the latest estimates of the costs of cyber incidents and shows that a cyber incident could evolve into a systemic cyber crisis that threatens financial stability. It also describes when an incident might turn into a “systemic cyber incident” that could threaten financial stability. Finally, the report outlines policy areas that merit further exploration, with the ESRB announcing that it intends to explore some of the potential systemic mitigants in its future work.

    The report highlights that cyber risk is characterized by three features that, when combined, make it fundamentally different from other sources of operational risk: the speed of its propagation, the scale of its propagation, and the potential intent of perpetrators. ESRB has developed an analytical framework to assess how cyber risk can become a source of systemic risk to the financial system. The four stages of this conceptual model (context, shock, amplification, systemic event) facilitate a systematic analysis of how a cyber incident can grow from operational disruption into a systemic crisis. The framework could assist in analyzing systemic vulnerabilities that amplify the shock of a cyber incident and in understanding at which point a cyber incident may become systemic. ESRB also surveyed its membership to form a view on common individual vulnerabilities across ESRB jurisdictions. Combining these elements, ESRB has considered a number of historical and hypothetical scenarios. It used these scenarios to try to understand the distinction between severe operational disruption to the financial system and a systemic crisis.

    The ESRB analysis illustrates how a cyber incident could, under certain circumstances, rapidly escalate from an operational outage to a liquidity crisis. Standard-setting bodies, national and international authorities, and industry groups are combining their efforts to mitigate cyber risks. To further mitigate the risk of a systemic cyber incident materializing, more work is required to address system vulnerabilities and reduce the potential for widespread disruption through amplification channels. The scenario analysis in this report reveals that the loss of confidence in the financial system plays a key role in a cyber incident developing into a systemic crisis. The following are a number of policy areas that merit further exploration:

    • Given the speed and scale at which such a cyber incident may unfold, rapid coordination between stakeholders and a consistent and clear communication from authorities may be required to shore up confidence. Different ongoing workstreams could be leveraged to achieve this goal.
    • Effective restoration of key economic functions requires planning, including agreeing on a clear division of tasks between industry and authorities and between (technical) incident management and (financial) consequence management. This may also include reflections on central bank emergency communications, interventions, or assistance when a cyber crisis becomes a financial stability crisis.
    • Cyber-equivalent of capital buffers is preparedness and resilience. Thus, the operationalization of systemic resilience mechanisms such as data vaulting, among other things, merits further exploration. This is of particular importance as many recovery and resolution plans are contingent on the essential data being available or recoverable.

    ESRB intends to explore some of the potential systemic mitigants in future work. Taking stock of the findings in this report, ESRB intends to leverage its broad institutional composition and network to evaluate the costs and benefits of different systemic mitigants going forward.

     

    Related Links

    Keywords: Europe, EU, Banking, Insurance, Securities, Cyber Risk, Systemic Risk, Operational Risk, Financial Stability, ESRB

    Featured Experts
    Related Articles
    News

    APRA on Changes to Reporting Obligations for Banks Due to COVID-19

    APRA, in collaboration with the Reserve Bank of Australia (RBA) and the Australian Bureau of Statistics (ABS), published a letter outlining temporary changes in reporting obligations for authorized deposit-taking institutions and registered financial corporations, in response to COVID-19.

    April 01, 2020 WebPage Regulatory News
    News

    OSFI Outlines Capital Treatment for Some COVID-19 Mitigation Measures

    OSFI issued a letter outlining how federally regulated banks should treat the new capital made available to small and medium-size enterprises (SME) through the recently announced government programs.

    March 30, 2020 WebPage Regulatory News
    News

    APRA Announces Deferral of Capital Reform Implementation

    APRA announced that it is deferring the scheduled implementation of Basel III reforms in Australia by one year.

    March 30, 2020 WebPage Regulatory News
    News

    BaFin Explains Regulatory Measures to Address Impact of COVID-19

    BaFin has released new developments and important information about COVID-19 and its effects on the financial and banking system.

    March 30, 2020 WebPage Regulatory News
    News

    ECB Updates Recommendation on Dividend Distribution Policy of Banks

    ECB updated its recommendation to banks on dividend distributions.

    March 30, 2020 WebPage Regulatory News
    News

    EC Amends Implementing Standards on Supervisory Reporting Under CRR

    EC published Regulation 2020/429 that amends the Regulation 680/2014, which sets out implementing technical standards on supervisory reporting of institutions under the Capital Requirements Regulation or CRR (575/2013).

    March 30, 2020 WebPage Regulatory News
    News

    HKMA Announces Deferral of Implementation of Final Basel III Package

    HKMA announced its plans to defer the implementation of final Basel III package, inline with the timeline announced by the Group of Central Bank Governors and Heads of Supervision (GHOS).

    March 30, 2020 WebPage Regulatory News
    News

    BCBS Defers Implementation of Final Basel III Standards by One Year

    BCBS has announced deferral of the implementation date of the final Basel III standards by one year, to January 01, 2023.

    March 27, 2020 WebPage Regulatory News
    News

    EC Regulation on CCR Mitigation for Covered Bonds and Securitizations

    EC published the Delegated Regulation 2020/447 with regard to regulatory technical standards on the specification of criteria for establishing the arrangements to adequately mitigate counterparty credit risk, or CCR, associated with covered bonds and securitizations.

    March 27, 2020 WebPage Regulatory News
    News

    IFRS Publishes Statement on Its Work During the COVID-19 Crisis

    IFRS, in its statement, emphasized that it shares global concerns about the impact of COVID–19 and is supporting its stakeholders by reconsidering timelines of its meetings and publications, providing information on the application of IFRS 9 on financial instruments, and offering calendar updates on ongoing activities.

    March 27, 2020 WebPage Regulatory News
    RESULTS 1 - 10 OF 4913