Featured Product

    ESRB Presents Conceptual Model for Systemic Cyber Risk

    May 14, 2020

    ESRB is presenting a conceptual model for systemic cyber risk in the financial sector. One of the goals is to provide a structured approach that can be used to describe cyber incidents, from genesis to a potential systemic event. Building on this conceptual model, future work could be undertaken to study the efficacy of individual systemic mitigants; use quantitative or data-driven methods to more accurately express each phase of amplification; or further study the interaction and measurement of impact at institutional and aggregate-system levels.

    The model aims to demonstrate the link between the crystallization of cyber risk in a firm-specific context (portraying micro-prudential concerns) and the possible ramifications for the financial system (applying a macro-prudential focus). Another aim of the model is to identify system-wide vulnerabilities and the unique characteristics of cyber incidents that can act as amplifiers, thus propagating shocks through the financial system. The aim is also to support the use of historical or theoretical scenario-based analysis to demonstrate the viability of the model and suggest system-wide interventions that could act as systemic mitigants. Although the model is geared toward disruption arising from cyber incidents, it can also be used for any source of operational disruption (although some elements of the model may be less relevant).

    To deconstruct and describe the macro-financial implications of operational and cyber risks, the systemic cyber risk model is split into four distinct phases: context, shock, amplification, and systemic event. The context phase is useful for scenario design, but is not essential for assessing systemic vulnerabilities or relevant mitigants. It is possible to adopt a cause-agnostic approach, which ignores the circumstances of disruption and focuses solely on impact. From a micro-prudential perspective, it is important to maintain a dual focus on both idiosyncratic individual vulnerabilities and Common Individual Vulnerabilities. Measuring impact is challenging and remains primarily a judgment-based, qualitative approach. Although some quantitative indicators exist, they should be used to complement and inform impact assessments.

    With regard to policy considerations arising from the model, a systemic event arising from a cyber incident is conceivable. Cyber incidents resulting in near-systemic consequences have occurred, in circumstances that can be described as “severe, but plausible.” However, a truly systemic event would require an alignment of amplifiers and a lack of effective systemic mitigants that would be “extreme, but existential” in nature. A cyber incident that causes only operational-to-operational contagion may have system-wide impact. However, the current base of evidence suggests that a systemic event requires the confidence and/or financial contagion channels to be triggered. 

     

    Related Link: Conceptual Model for Systemic Risk (PDF)

    Keywords: Europe, EU, Banking, Cyber Risk, Systemic Risk, Operational Risk, Scenario-based Analysis, Historical Event Analysis, Basel, ESRB

    Featured Experts
    Related Articles
    News

    BIS Quarterly Review Discusses Developments in Fintech and ESG Space

    BIS published the September issue of the Quarterly Review, which contains special features that analyze the rapid rise in equity funding for financial technology firms, the effectiveness of policy measures in response to pandemic, and the evolution of international banking.

    September 20, 2021 WebPage Regulatory News
    News

    BCBS to Consult on Supervisory Practices for Climate Risks by Year-End

    The Basel Committee for Banking Supervision (BCBS) met in September 2021 and reviewed climate-related financial risks, discussed impact of digitalization, and welcomed efforts by the International Financial Reporting Standards (IFRS) Foundation to develop a common set of sustainability reporting standards

    September 20, 2021 WebPage Regulatory News
    News

    OCC Identifies Operational Risk Deficiencies in MUFG Union Bank

    The Office of the Comptroller of the Currency (OCC) issued a Cease and Desist Order against MUFG Union Bank for deficiencies in technology and operational risk governance.

    September 20, 2021 WebPage Regulatory News
    News

    EC Rule on Contractual Recognition of Write Down and Conversion Powers

    The European Commission (EC) published the Delegated Regulation 2021/1527 with regard to the regulatory technical standards for the contractual recognition of write down and conversion powers.

    September 17, 2021 WebPage Regulatory News
    News

    ECB to Consider Climate Risks When Reviewing Collateral Framework

    In a response to the questions posed by a member of the European Parliament, the President Christine Lagarde highlighted the commitment of the European Central Bank (ECB) to an ambitious climate-related action plan along with a roadmap, which was published in July 2021.

    September 17, 2021 WebPage Regulatory News
    News

    SRB Provides Update on Approach to Prior Permissions Regime

    The Single Resolution Board (SRB) published a Communication on the application of regulatory technical standard provisions on prior permission for reducing eligible liabilities instruments as of January 01, 2022.

    September 16, 2021 WebPage Regulatory News
    News

    APRA Issues Further Guidance on Application of Securitization Standard

    The Australian Prudential Regulation Authority (APRA) published a new set of frequently asked questions (FAQs) to provide guidance to authorized deposit-taking institutions on the interpretation of APS 120, the prudential standard on securitization.

    September 16, 2021 WebPage Regulatory News
    News

    ACPR Publishes Corrective Version of RUBA Taxonomy

    The French Prudential Control and Resolution Authority (ACPR) published the corrective version of the RUBA taxonomy Version 1.0.1, which will come into force from the decree of January 31, 2022.

    September 15, 2021 WebPage Regulatory News
    News

    Nordea Bank and EIB Sign Agreement to Fund Green Projects in Nordics

    The European Commission (EC) announced that Nordea Bank has signed a guarantee agreement with the European Investment Bank (EIB) Group to support the sustainable transformation of businesses in the Nordics.

    September 15, 2021 WebPage Regulatory News
    News

    APRA Publishes FAQs on Capital Treatment of Overseas Subsidiaries

    The Australian Prudential Regulation Authority (APRA) published a new set of frequently asked questions (FAQs) to clarify the regulatory capital treatment of investments in the overseas deposit-taking and insurance subsidiaries.

    September 15, 2021 WebPage Regulatory News
    RESULTS 1 - 10 OF 7487