Governor of Bank of Italy on Addressing Cyber Risk in Financial Sector
At the G7 Conference in Paris, Mr. Ignazio Visco, the Governor of the Bank of Italy, discussed the ongoing evolution of cyber risk in the financial sector and the ways to address this risk. Mr. Visco highlighted that in cyberspace externalities are not contained within national borders and that the increasing reliance on third-party suppliers who fall outside the jurisdiction of financial authorities is one important source of cyber risk for supervised entities. He outlined cross-industry and cross-border cooperation, issuance of common security standards for hardware and software, and the use of artificial intelligence by supervisory authorities as the means to deal with the increasing cyber-security issues.
In the past, attackers have leveraged vulnerabilities in the IT systems of third parties to strike financial institutions. In the G7 Fundamental Elements For Third Party Cyber Risk Management in the Financial Sector, which was published last year, tenets on the appropriate management of third-party risk were introduced. Work on implementation of these tenets must now be accelerated, said Mr. Visco. When it comes to third parties that operate in regulated sectors, such as energy and telecoms, the different authorities must step up their coordination and cooperation efforts. Within each country there needs to be a cohesive national system of cyber defense that allows different authorities to work together effectively. In this context, governments have a natural role as coordinators.
The financial sector remains a prime target and such risks cannot be effectively mitigated by simply mandating supervised entities to follow good practices. Complex attacks can be deployed via obscure tools. Even large financial institutions with excellent (and expensive) defense systems can be lost in the face of cutting-edge threats; they can, of course, work out some of the technical details, but they might miss some of the broader, systemic elements, simply because they ignore relevant information such as precedents that affected other sectors, attacker tactics, and effective defenses adopted elsewhere. This kind of information is generally available only to intelligence agencies and the military. Cross-sector, nationwide as well as international cooperation is, therefore, essential. There needs to be a mechanism in each country that allows appropriate public bodies to coordinate and jointly support, each within its own mandate, the victims of a cyber campaign. In EU, the Network and Information Security (NIS) Directive takes this course.
Next, he added that cooperation must extend beyond borders, given the nature of many of the attacks and the interconnectedness of the financial system. This will always be a challenge because disclosing vulnerabilities to entities from another jurisdiction might endanger national security. Nonetheless, feasible solutions need to be found for this problem, since this kind of information-sharing might prove crucial for responding to some attacks. He said that the G7 remains the most favorable context for international cooperation—the many achievements of the G7 Cyber Expert Group (CEG) provide a good example of what can be done. The CEG was established in 2015 under the German presidency and it went on to deliver results during the presidencies of four other countries—Japan, Italy, Canada, and France. "We need to persevere on this route," said Mr. Visco.
According to Mr. Visco, one area that is ripe for more cooperation is the establishment of common security standards for hardware and software, which also covers the growing market for financial technology apps. In EU, a new regulation (which is currently under approval) will introduce a mechanism of cybersecurity certification for many products. This is an important step, but it would be more effective if G7 countries could converge at least on a subset of requirements. "If a service is not safe according to our own laws, it should not be on the market—and there should be a reasonable degree of convergence between laws in like-minded jurisdictions." Finally, he highlighted that artificial intelligence introduces new possibilities in cyber-security. It facilitates the detection and the exploitation of vulnerabilities, which the attackers know; therefore, the attackers are starting to deploy machine learning to analyze and penetrate target systems. Cyber-security companies use the same artificial intelligence analytic tools, with the goal of fixing the weak spots. By the same token, authorities could employ artificial intelligence to ascertain whether supervised entities are meeting mandated security standards on a continuous basis, added Mr. Visco.
Related Link: Speech
Keywords: Europe, EU, Italy, Banking, Cyber Risk, Cyber Security, Artificial Intelligence, Suptech, G7, Cross Border Cooperation, Systemic Risk, Operational Risk, Bank of Italy, BIS
Featured Experts

María Cañamero
Skilled market researcher; growth strategist; successful go-to-market campaign developer

Blake Coules
Across 35 years in banking, Blake has gained deep insights into the inner working of this sector. Over the last two decades, Blake has been an Operating Committee member, leading teams and executing strategies in Credit and Enterprise Risk as well as Line of Business. His focus over this time has been primarily Commercial/Corporate with particular emphasis on CRE. Blake has spent most of his career with large and mid-size banks. Blake joined Moody’s Analytics in 2021 after leading the transformation of the credit approval and reporting process at a $25 billion bank.

Nicolas Degruson
Works with financial institutions, regulatory experts, business analysts, product managers, and software engineers to drive regulatory solutions across the globe.
Previous Article
EBA Updates List of Common Equity Tier 1 Instruments for EU EntitiesRelated Articles
EC Consults on PSD2 and Open Finance; EU Reaches Agreement on DORA
The European Commission (EC) published a public consultation on the review of revised payment services directive (PSD2) and open finance.
EC Mandates ESAs to Propose Amendments to SFDR Technical Standards
The European Commission (EC) has issued two letters mandating the European Supervisory Authorities (ESAs) to jointly propose amendments to the regulatory technical standards under Sustainable Finance Disclosure Regulation or SFDR.
EBA Examines Supervisory Practices, Issues Deposits Reporting Template
The European Banking Authority (EBA) published its annual report on convergence of supervisory practices for 2021. Additionally, following a request from the European Commission (EC),
US Agency Publications Address Basel, Reporting, and CECL Developments
The Farm Credit Administration published, in the Federal Register, the final rule on implementation of the Current Expected Credit Losses (CECL) methodology for allowances
SEC Extends Comment Period on Climate Risk Disclosures
The U.S. Securities and Exchange Commission (SEC) looks set to intensify focus on crypto-assets and cyber risk and extended the comment period on the proposed rules to enhance and standardize climate-related disclosures for investors.
APRA Reduces Committed Liquidity Facility, Issues Other Updates
The Australian Prudential Regulation Authority (APRA) announced reduction in the aggregate Committed Liquidity Facility and issued an update on the operational preparedness for zero and negative market interest rates.
CMF Consults on Basel Rules, Presents Roadmap to Address Climate Risks
The Commission for the Financial Market (CMF) in Chile published capital adequacy ratios (as of February 2022, January 2022, and December 2021) for 17 banks and for the banking system.
PRA Issues Statement on NPEs and Policy on Trading Activity Wind-Down
The Prudential Regulation Authority (PRA) issued a statement on the European Banking Authority (EBA) guidelines on management of non-performing exposures (NPEs) and forborne exposures.
EBA Updates Standards for 2023 Benchmarking of Internal Approaches
The European Banking Authority (EBA) updated the implementing technical standards that specify the data collection for the 2023 supervisory benchmarking exercise in relation to the internal approaches used in market risk, credit risk, and IFRS 9 accounting.
EIOPA Responds to Stakeholder Views on Blockchain in Insurance
The European Insurance and Occupational Pensions Authority (EIOPA) published a feedback statement on the responses received to the consultation on blockchain and smart contracts in insurance.