International Strategy to Better Protect the Financial System Against Cyber Threats

Summary

The global financial system is going through an unprecedented digital transformation, which is being accelerated by the coronavirus pandemic.¹ Financial services firms increasingly look like tech companies and tech companies look like financial services firms. Central banks around the globe are considering throwing their weight behind digital currencies and modernizing payment systems.² In this time of transformation, when an incident could easily undermine trust and derail such innovations, cybersecurity is more essential than ever.

Malicious actors are taking advantage of this digital transformation and pose a growing threat to the global financial system, financial stability, and confidence in the integrity of the financial system. Malign actors are using cyber capabilities to steal from, disrupt, or otherwise threaten financial institutions, investors, and the public. These actors include not only increasingly daring criminals,³ but also states and state-sponsored attackers. North Korea, for example, has stolen some $2 billion from at least thirty-eight countries across five continents over the last five years alone,⁴ more than three times the amount of money it was able to generate through counterfeit activity over the previous four decades.⁵ Other state-sponsored actors have targeted financial institutions, for example, with massive distributed denial-of-service (DDoS) attacks.⁶ More dangerous attacks and ensuing shocks should be expected in the future. Most worrisome are incidents that corrupt the integrity of financial data, such as records, algorithms, and transactions; few technical solutions are currently available for such attacks, which have the potential to undermine trust and confidence more broadly.⁷

Increasingly concerned, key voices are sounding the alarm. In February 2020, Christine Lagarde, the president of the European Central Bank (ECB) and former head of the International Monetary Fund (IMF), warned that a cyber attack could trigger a serious financial crisis.⁸ At the 2019 annual meeting of the World Economic Forum (WEF), the head of Japan’s central bank predicted that cybersecurity could become the financial system’s most serious risk in the near future.⁹ Industry executives have echoed these concerns. Jamie Dimon, CEO of JPMorgan Chase, said in April 2019 that cyber attacks “may very well be the biggest threat to the U.S. financial system.”¹⁰

In April 2020, the Financial Stability Board (FSB) cautioned that “cyber incidents pose a threat to the stability of the global financial system.” The FSB went on to warn that the last few years have seen “a number of major cyber incidents that have significantly impacted financial institutions and the ecosystems in which they operate. A major cyber incident, if not properly contained, could seriously disrupt financial systems, including critical financial infrastructure, leading to broader financial stability implications.”¹¹ The potential economic costs of such events can be immense and the damage to public trust and confidence significant. Cyber incidents could potentially undermine the integrity of global financial markets;¹² equally important, the exploitation of cyber vulnerabilities could cause losses to investors and the general public. Central to the risk is the fact that the global financial system is a complex adaptive system. It is resilient and able to absorb most of the shocks that regularly occur, but its complexity also means that large shocks, although rare, can quickly ripple in unpredictable ways. The system’s complexity also makes it impossible to predict exactly when or how such systemic shocks will occur.¹³ But one thing is clear: it is not a question of if a major incident will happen, but when.

This is a global problem. Malign actors are targeting not only financial institutions in North America, Europe, and other high-income countries; many are also hitting less protected soft targets in low and lower-middle income countries. Although fintech is a buzzword worldwide, the trend toward digital financial services has been particularly pronounced in low and lower-middle income countries, where providing access to financial services to the unbanked is a top priority. The past decade’s push toward greater financial inclusion, driven by a massive G20 investment, has led many countries to leapfrog to digital financial services. Although they do advance financial inclusion, digital services also offer a target-rich environment for malicious hackers and present new money laundering risks, providing fertile ground for the full range of transnational criminal activity.

Surprisingly, despite the global financial system’s increasing reliance on digital infrastructure, it is unclear who is responsible for protecting the system against cyber attacks. In part, this is because the environment is changing so quickly. Everybody agrees that the global financial system is critical to society, the global economy, and the recovery from the pandemic. Yet the global financial sector remains vulnerable to cyber threats and, absent dedicated action, will only become more vulnerable as innovation, competition, and the pandemic further fuel the digital revolution. Although many threat actors are focused on making money, the number of purely disruptive and destructive attacks has been increasing; furthermore, those who learn how to steal also learn about the financial system’s networks and operations, which allows them to launch more disruptive or destructive attacks in the future (or sell such knowledge and capabilities to others). This rapid evolution of the risk landscape is taxing the responsiveness of an otherwise mature and well-regulated system.

Better protecting the global financial system is primarily an organizational challenge. Unlike many sectors, most of the financial services community does not lack resources or the ability to implement technical solutions. The main issue is a collective action problem: how best to organize the system’s protection across governments, financial authorities, and industry and how best to leverage these resources effectively and efficiently. The current fragmentation among stakeholders and initiatives partly stems from the unique aspects and evolving nature of cyber risk. Different communities operate in silos and tackle the issue through their respective mandates. The financial supervisory community focuses on resilience, diplomats on norms, national security agencies on cost imposition, and industry executives on firm- rather than sector-specific risks. As lines between financial services firms and tech companies become ever more fuzzy, the lines of responsibility for security are likewise increasingly blurred.¹⁴

The disconnect between the finance, the national security, and the diplomatic communities is particularly pronounced. Financial authorities face unique risks from cyber threats, yet their relationships with national security agencies, whose involvement is necessary to effectively tackle those threats, remain tenuous in most countries. The FSB did not include “cyber attack” in its 2018 lexicon of key terms related to cyber security and cyber resilience. The term, with its national security connotations, was considered beyond its mandate and beyond the responsibility of central banks. For their part, security agencies generally prioritize defending against threats at the national level rather than from a global system perspective, and therefore focus primarily on loss of life and physical damage. Nothing explodes when a cyber attack hits the financial sector.

This responsibility gap and continued uncertainty about roles and mandates to protect the global financial system fuels risks. Part of this uncertainty is due to the current geopolitical tensions, which hinder collaboration among the international community. Cooperation on cybersecurity has been hampered, fragmented, and often limited to the smallest circles of trust because it touches on sensitive national security equities. For example, participation in the Cyber Expert Group (CEG) created by the G7 Finance Track in 2016 was limited to G7 member states, whereas the process created by the G7 in 1989 to establish the Financial Action Task Force (FATF) included several non-G7 states from the outset. Yet it is clear that individual governments, financial firms, and tech companies cannot address these challenges alone. International and multistakeholder cooperation is not a “nice-to-have” but a “need-to-have.”

A good illustration of these continuing gaps and the need for greater coordination among the different stakeholders is the G7 itself. Although it has demonstrated international leadership on this issue through the G7 Finance Track’s CEG, there is room for improvement. For example, the G7 Finance Track’s CEG and the diplomat-led G7 cyber norms group have never met since their creation in 2016, despite clear general synergies and specific crosscutting challenges. Figure 1 illustrates such gaps between the cyber diplomacy and finance policy tracks.

Breaking down silos is a particular challenge for many financial authorities who, in most countries, operate mostly independent of other parts of the state. Cyber threat actors pose a unique type of risk. Many of them operate transnationally and target victims abroad. This requires countries not only to better organize themselves domestically but also to strengthen international cooperation to defend against, investigate, prosecute, and ideally prevent future attacks. This implies that the financial sector and financial authorities must regularly interact with law enforcement and other national security agencies in unprecedented ways, both domestically and internationally.

In sum, these trends, growing concerns, and existing gaps highlight several key points:

• Greater clarity about roles and responsibilities is required. The current fragmentation and uncertainty about roles and responsibilities weaken the international system’s collective resilience, recovery, and response capabilities. Only a handful of countries have built effective domestic relationships among their financial authorities, law enforcement, diplomats, other relevant government actors, and industry. International cooperation remains limited, partly hampered by the fragmentation.
• International collaboration is necessary and urgent. The threat of cyber disruption has grown and become more aggressive in recent years. Not only criminals but also states are now targeting financial institutions. It is not a question of if a major shock will happen, but when. Given the scale of the threat and the system’s globally interdependent nature, individual governments, financial firms, and tech companies cannot effectively protect against cyber threats if they work alone.
• Reducing fragmentation will free up capacity to tackle the problem. Many initiatives are underway to better protect financial institutions, but they remain siloed. Some of these efforts duplicate each other, and the diversity of initiatives increases transaction costs. Several of these initiatives are mature enough to be shared, better coordinated, and further internationalized.
• Protecting the international financial system can be a model for other sectors. The financial system is one of the few areas in which states have a clear shared interest in cooperation, even when geopolitical tensions are high. An entire international architecture—from the G7 and G20 Finance Tracks to the FSB and the international financial institutions—already exists to drive change. Focusing on the financial sector provides a starting point and could pave the way to better protect other sectors in the future.

Several ongoing initiatives have now reached sufficient maturity and degree of trust among their original members that they could potentially be expanded, strengthened, and coordinated with related efforts. Effective examples of cooperation on issues with a national security dimension do exist; the FATF is a case in point. Candidates for such expansion are the G7 CEG, which has issued several fundamental principles, analyzed systemic risks, and conducted an exercise. The FSB is in the process of updating its cyber lexicon and has finalized its cyber incident response and recovery toolkit, and the Bank for International Settlements (BIS) has established its Cyber Resilience Coordination Centre (CRCC).¹⁵ Industry has also launched new initiatives, such as Sheltered Harbor and the Cyber Defence Alliance (CDA). Individual countries have developed new models, including Singapore’s workforce initiatives; Israel’s FinCERT; red teaming testing frameworks like the European Union (EU)’s TIBER-EU, Saudi Arabia’s FEER, and Hong Kong’s iCAST;¹⁶ and the Bank of England’s concept of impact tolerances. In September 2020, the European Commission (EC) proposed a Digital Operational Resilience Act (DORA) “to ensure that all participants in the financial system have the necessary safeguards in place to mitigate cyber-attacks and other risks.”¹⁷

To achieve more effective protection of the global financial system against cyber threats, this report, “International Strategy to Better Protect the Global Financial System Against Cyber Threats,” outlines thirty-two recommendations and forty-four supporting actions to be implemented ideally in the 2021–2024 timeframe. Figure 2 and Table 1 illustrate how the recommendations and supporting actions are organized into strategic priority areas with three core pillars and three complementary crosscutting issues:

Strategic Priority Areas:

0. Strategic Imperative: Clarify roles and responsibilities and create more connective tissue among the various silos and relevant stakeholders.
1. Core Pillar #1: Cyber Resilience: Strengthen operational cyber resilience and collective defense to shield the financial sector against cyber threats.
2. Core Pillar #2: International Norms: Reinforce international norms at the United Nations and through other relevant processes to clarify what is considered inappropriate behavior—that is, when malicious activity has crossed a line—and hold actors accountable for violations to avoid norms being eroded by impunity.
3. Core Pillar #3: Collective Response: Facilitate collective response to disrupt malicious actors and more effectively deter future attacks.
4. Crosscutting Issue #1: Cybersecurity Workforce: Build the cybersecurity workforce required to turn ambitions into actions by assessing and expanding effective models for addressing workforce challenges including limited pipelines and a lack of diversity.
5. Crosscutting Issue #2: Capacity-Building: Align and expand capacity-building efforts across all three core pillars for those seeking assistance.
6. Crosscutting Issue #3: Digital Transformation/Financial Inclusion: Safeguard financial inclusion and the G20’s achievements of the past decade in this area.

Table 1: Overview of Recommendations and Supporting Actions Across Strategic Priority Areas
Strategic Priority Area	Strategic Imperative, Core Pillars, and Crosscutting Issues	Recommendations and Supporting Actions
Strategic Imperative
0	Strategic Imperative	3 Recommendations 1 Supporting Action
Core Pillars
1	Core Pillar #1: Cyber Resilience	7 Recommendations 17 Supporting Actions
2	Core Pillar #2: International Norms	4 Recommendations 9 Supporting Actions
3	Core Pillar #3: Collective Response	7 Recommendations 4 Supporting Actions
Crosscutting Issues
4	Crosscutting Issue #1: Workforce	3 Recommendations 7 Supporting Actions
5	Crosscutting Issue #2: Capacity-Building	4 Recommendations 3 Supporting Actions
6	Crosscutting Issue #3: Financial Inclusion	4 Recommendations 3 Supporting Actions

Overarching Recommendations

The following overarching recommendations focus on creating the foundation for stronger coordination among the various actors and for the implementation of the specific recommendations across the six priority areas:

• Recommendation 0.1: G20 heads of state should create interagency processes within their respective governments, co-led by the ministry of finance and the central bank/monetary authority (or other relevant entity representing the government in international finance bodies), to explore options for better protecting their domestic as well as the international financial system against cyber threats. Ideally these processes will focus on the six priority areas identified in this report and take into account the report’s recommendations. (The co-leadership is designed to avoid disruptions caused by the frequent turnover of politically appointed ministers of finance; including central banks/monetary authorities as co-leads will allow greater continuity of effort.)
  • Supporting Action 0.1.1: To help increase trust and confidence, G20 Finance Ministers and Central Bank Governors should consider creating a G20 Finance Track process emulating the confidence-building measures undertaken by the member states of the Organization for Security and Co-operation in Europe (OSCE), which includes the United States and Russia. (The supplementary background report provides more details about measures the G20 could explore.)
• Recommendation 0.2: Financial services firms should expand their engagement and dedicate more resources to strengthening the protection of the sector overall. In particular, firms should support capacity-building efforts for weaker links in the system and become more active in efforts complementary to firms’ core focus on resilience, such as advancing international norms, facilitating collective response, and tackling workforce challenges.
• Recommendation 0.3: G7 Finance Ministers and Central Bank Governors should renew the mandate of the G7 CEG starting in 2021; the mandate should include expanding the number of participant states and initiating a G7+ process, for example, emulating the one that established the FATF in the early 1990s, or another process for involving members outside its current remit. (In addition to the European Commission, which is already included, this expanded group could include financial centers such as Switzerland and Singapore and other relevant partner countries. Appendix A provides an outline of stakeholders that could be included in such an enlarged process.)

Specific Recommendations for Each Priority Area

Priority #1, “Cyber Resilience”: Focus on the Unique Nature of Cyber Threats

Core Pillar #1: Strengthen operational cyber resilience and collective defense to shield the financial sector against cyber threats.

The global financial system’s operational cyber resilience and collective defense against cyber attacks is the foundation for any comprehensive strategy. This first core pillar provides protection not only against potential cyber attacks but also against accidental failures. National security officials would view such resilience as a means of deterrence by denial. A particular challenge looking ahead will be to ensure that the increasing emphasis on broader operational resilience does not detract attention from the unique aspects of cybersecurity risks—in particular, the risk that nefarious actors will specifically target financial institutions and the need to create the mechanisms to effectively protect against such threats.

The recommendations focus on (i) ensuring that the shift to a broader conception of operational resilience does not eclipse the need to prepare for the specific risks of malicious cyber attacks; (ii) outlining innovative initiatives that could be emulated; and (iii) highlighting significant issues that demand specific attention.

• Recommendation 1.1: Standard-setting bodies—namely the Basel Committee on Banking Supervision (BCBS), the Committee on Payments and Market Infrastructures (CPMI), the International Organization of Securities Commissions (IOSCO), and the International Association of Insurance Supervisors (IAIS)—should continue to support initiatives to improve and align regulatory oversight efforts for the cybersecurity and operational resilience of financial services. This will contribute to higher quality security practices among financial firms by reducing regulatory transaction costs and freeing up bandwidth among firms’ cybersecurity staff.
  • Supporting Action 1.1.1: The G20 should task the FSB with developing a baseline framework for the supervision of cyber risk management at financial institutions. This framework should leverage common risk management frameworks, such as those advanced by the Financial Stability Institute and the Financial Services Sector Cybersecurity Profile, as well as internationally accepted standards for technology and risk controls.
• Recommendation 1.2: Governments (starting with the G7 and G20 Finance Ministers and Central Bank Governors) and industry should expand and strengthen the international ecosystem of financial sector-focused computer emergency response teams (CERTs) or similar entities to stimulate public-private collaboration and strengthen sector-specific security.
  • Supporting Action 1.2.1: Governments should create a FinCERT, either as a substructure of an already established national CSIRT (computer security incident response team) emulating the Israeli FinCERT or as a stand-alone entity, to strengthen the protection of the financial sector, which is often at the forefront of regular and novel malicious cyber activity.
  • Supporting Action 1.2.2: The Forum of Incident Response and Security Teams (FIRST) should consider creating a stand-alone track or side event at the annual FIRST conference to deepen this community of experts, including government FinCERTs, staff of national CSIRTs focusing on the financial sector, and related private sector entities. Two or more members of FIRST should also propose a FinCERT “Special Interest Group” to the FIRST board to create a community of interest in addition to the annual side event. (This would be similar to the national CSIRT side event that takes place alongside the annual FIRST conference. Appendix B provides an overview of existing FinCERTs worldwide.)
• Recommendation 1.3: Financial authorities should prioritize increasing the financial sector’s resilience against attacks targeting the integrity of data and algorithms. Unlike incidents affecting availability or confidentiality, few technical mitigation solutions exist today to mitigate the risks associated with the manipulation of the integrity of data and algorithms. The second-order risk of undermining trust and confidence is significant.
  • Supporting Action 1.3.1: Financial authorities should encourage industry to join or emulate data vaulting initiatives, such as Sheltered Harbor, to advance common standards, to better protect against data integrity attacks such as ransomware, and to test data vaulting solutions’ effectiveness during a crisis.
  • Supporting Action 1.3.2: Considering the limitations of current technical solutions, governments and financial authorities should lead whole-of-society exercises, including industry, that specifically simulate cyber attacks involving the manipulation of the integrity of data and algorithms. Such exercises should be used to identify weaknesses, such as divergence between decision-making timelines in financial markets versus the national security community, and to develop action plans to better protect against such attacks.
• Recommendation 1.4: Governments and industry should put additional emphasis on the resilience of financial market infrastructures (FMIs)—critically important institutions responsible for payment systems, central counterparties, central securities depositories, or securities settlement systems—and other service providers deemed critical for the functioning of the financial sector, such as stock exchanges,¹⁸ as successful disruptions against these entities can pose a systemic risk and undermine confidence in the financial system.
  • Supporting Action 1.4.1: Governments should use the unique capabilities of their national security communities to help protect FMIs and critical trading systems, including sharing information about impending threats.
  • Supporting Action 1.4.2: Industry groups, such as the World Federation of Exchanges (WFE), which is a global industry association for exchanges and clearing houses, should dedicate more resources to capacity-building efforts designed to help smaller and less mature FMIs and other important service providers increase their cybersecurity level.
• Recommendation 1.5: Financial authorities, or a designated lead governmental agency, should (i) assess the benefits and risks of using cloud service providers to strengthen the cybersecurity of financial institutions that lack the capacity to effectively protect themselves and (ii) take steps to minimize the risks associated with a migration to the cloud, including potential concentration risk.
  • Supporting Action 1.5.1: Financial authorities, or a designated lead governmental agency, should assess which financial institutions, especially small and medium-sized organizations, would become more resilient against cyber attacks by migrating to appropriately secured public or hybrid cloud service providers.
  • Supporting Action 1.5.2: To better assess and address growing concerns about concentration risks, governments should work with the major cloud service providers and financial institutions to:
    • Organize annual joint exercises simulating different scenarios to (a) identify internally who would lead their firms during a global cyber disruption; (b) increase cooperation among cloud service providers in building international response and recovery capabilities; and (c) strengthen the resilience of the cloud service infrastructure, as disruption of one provider could lead to service disruptions and reputational damage for all providers in a worst-case scenario.¹⁹
    • Assess systemic risks, as well as existing and potential mitigations, and share information about key vulnerabilities and threats. The goal is to provide coordinated analysis and identify potential systemic risks for critical functions shared by cloud service providers and to create a playbook for when an incident occurs.²⁰
    
    Although the activities listed above have been piloted in other industries in line with anti-trust provisions, governments should express their support and provide guidance by issuing public statements clarifying their position.²¹
  • Supporting Action 1.5.3: Financial authorities should monitor whether the market, through cloud service providers and third-party consulting firms, is providing financial services firms with sufficient resources to assist with the migration to public or hybrid cloud service providers; this information will allow them to minimize the transitory risk and otherwise take supplementary actions. Publishing these findings will improve market information and allow potential cloud customers to assess benefits and costs more accurately.
  • Supporting Action 1.5.4: National security agencies should consult critical cloud service providers to determine how intelligence collection could be used to help identify and monitor potential significant threat actors and develop a mechanism to share information about imminent threats with cloud service providers.
• Recommendation 1.6: G20 Finance Ministers and Central Bank Governors should highlight, ideally in their 2021 communiqué, the necessity of cybersecurity threat information sharing—including being clear about what information should be shared, why, with whom, how, and when—in order to protect the global financial system.
  • Supporting Action 1.6.1: Data protection regulators (for example, the European Data Protection Board), together with financial authorities, should assess the impact of data protection regulation on different cyber threat information-sharing initiatives and clarify, where necessary, that such sharing arrangements serve the public interest and that they comply with the General Data Protection Regulation (GDPR) or other relevant regulations.²²
  • Supporting Action 1.6.2: Governments should assess the potential negative impact of broader data localization requirements on the ability to protect against cyber threats and consider actions to balance these different policy objectives.
• Recommendation 1.7: Financial authorities and industry should ensure they are properly prepared for influence operations and hybrid attacks that combine influence operations with malicious hacking activity;²³ they should integrate such attacks into tabletop exercises (such as the G7 exercise) and apply lessons learned from influence operations targeting electoral processes to potential attacks on financial institutions.
  • Supporting Action 1.7.1: Major financial services firms, central banks, and other financial supervisory authorities should identify a single point of contact within each organization to engage with social media platforms for crisis management. Quick coordination with social media platforms is necessary to organize content takedowns. Social media platforms will be more responsive to a single collective point of contact than to ad hoc communication with many financial institutions.
  • Supporting Action 1.7.2: Financial authorities, financial services firms, and tech companies should develop a clear communications and response plan focused on being able to react swiftly. A quick response can effectively dampen the effect of an incident, but conventional communication channels are often insufficient to fill the information vacuum in such an event. Given the speed of social media content sharing, limiting the number of people required to review and approve a response is essential for a swift response. Financial institutions should ensure potential influence operations are part of their cyber-related communications planning and be familiar with the rules on platforms relating to key areas, including impersonation accounts and hacked materials.
  • Supporting Action 1.7.3: In the event of a crisis, social media companies should swiftly amplify communications by central banks, such as corrective statements that debunk fake information and calm the markets. Central banks and social media platforms should work together to determine what severity of crisis would necessitate amplified communication and develop escalation paths similar to those developed in the wake of past election interference, as seen in the United States and Europe.
  • Supporting Action 1.7.4: Financial authorities and financial services firms should review their current threat monitoring systems to ensure that they include and actively try to identify and detect potential influence operations.

Priority #2, “International Norms”: Reinforce and Implement International Norms

Core Pillar #2: Reinforce international norms at the United Nations and through other relevant processes to clarify what is considered inappropriate behavior—that is, when malicious activity has crossed a line—and hold actors accountable for violations to avoid norms being eroded by impunity.

Diplomatic agreements on international norms can further reduce risk by clarifying unacceptable behaviors and by helping shape the actions of states and nonstate actors. For example, norms can make clear that undermining the integrity of the financial system would cross a line and lead the international community to swiftly condemn the action and potentially impose consequences. As attribution capabilities improve, this advances deterrence through normative taboos.²⁴ Norms can also outline standards for positive state behavior, such as providing assistance or investigating alleged malicious activity. At present, such international norms remain weak and will require senior leadership support and reinforcement to have a lasting impact.

The following recommendations are designed to address the uncertainty regarding how international law applies to cyberspace and malicious cyber activity targeting financial institutions, and to build and reinforce existing efforts to advance international norms.

• Recommendation 2.1: Heads of state should ensure that their state organs (continue to) exercise restraint when using offensive cyber capabilities to target financial institutions. This will strengthen the nascent state practice that has emerged over the past few decades.
• Recommendation 2.2: Individual governments should clarify how they interpret existing international law to apply to cyberspace, specifically with respect to malicious cyber activity involving financial institutions. Governments could do this through ministerial statements or speeches, letters to parliament/legislatures, submissions to the United Nations (UN) emulating existing examples, or other appropriate mechanisms. (Such clarification should follow and ideally go beyond the Australian, British, and Dutch examples and focus on the set of questions highlighted in the complementary report to this strategy.)
  • Supporting Action 2.2.1: The North Atlantic Treaty Organization (NATO), the Shanghai Cooperation Organisation (SCO), and other relevant security organizations should clarify how they interpret existing international law to apply to cyberspace, specifically with respect to malicious cyber activity involving financial institutions; at a minimum, they should initiate processes for member states to discuss this question.
  • Supporting Action 2.2.2: The International Committee of the Red Cross, through its mission to build respect for international legal obligations,²⁵ should build on and clarify its existing publications to provide a recommendation to the international community for how existing international humanitarian law should apply to cyberspace specifically with respect to malicious cyber activity involving financial institutions.²⁶
• Recommendation 2.3: UN member states should strengthen and support the operationalization and implementation of the voluntary norms they agreed to through the UN, namely the norm focused on protecting critical infrastructure.
  • Supporting Action 2.3.1: The G20 Finance Ministers and Central Bank Governors should adopt a communiqué, building on previous communiqués, urging restraint per recommendation 2.1, and adding specific declaratory language. The G20 heads of state should then endorse the language adopted by the G20 Finance Ministers and Central Bank Governors.
  • Supporting Action 2.3.2: In a future process convened through the UN General Assembly and succeeding the UN Open-Ended Working Group (OEWG) and the UN Group of Governmental Experts (GGE), UN member states should:
    • Make explicit reference to the financial services sector as critical infrastructure for all UN member states for the purposes of norms (f) and (g) of the 2015 UN GGE report, which focus on critical infrastructure.
    • Highlight that financial institutions have been a primary target for malicious actors and face growing criminal and state-sponsored threats that require stronger cooperation among states to protect the global financial system.
    • Call on states to adhere to the positive norms of cooperating in the investigation of transnational cyber crimes and denying the use of their territories for malicious activity.
  • Supporting Action 2.3.3: Financial authorities and industry should use the systems developed for resilience purposes (for example, to identify and detect potential incidents in order to defend against and recover from them) for the detection and attribution of norm violations. Sharing such information is necessary to more effectively hold malicious actors accountable.
  • Supporting Action 2.3.4: The UN Security Council should continue to monitor North Korea’s activities, considering that North Korea’s actions have impacted at least thirty-eight UN member states from 2015 to 2020 alone.²⁷ The UN Security Council should use all its instruments, ranging from monitoring latest developments through regular reports (such as the 2019 “Report of the Panel of Experts Established Pursuant to Resolution 1874”²⁸) to the imposition of sanctions, to deter future malicious activity.
• Recommendation 2.4: Financial services firms and related trade associations, such as the Institute of International Finance (IIF), the Global Financial Markets Association (GFMA), the Bank Policy Institute (BPI), the Geneva Association, the American Bankers Association (ABA), the European Banking Federation (EBF), the Pan-European Insurance Forum, the Association of Banks in Singapore (ABS), and others should call for stronger international norms to protect the financial system and should prioritize this as a talking point in their engagement with governments.
  • Supporting Action 2.4.1: CEOs of financial services firms should collectively call on governments, for example via a joint letter, to strengthen international norms to protect the global financial system and for the G7 and the G20 to issue such a commitment.
  • Supporting Action 2.4.2: Financial services firms should commit to sharing information about threat actors’ behavior and potential norm violations to assist in the monitoring of compliance. Not sharing this information could embolden malicious actors to continue their activity with impunity.
  • Supporting Action 2.4.3: If governments publicly commit to protecting the integrity of the financial system, financial services firms should provide financial support to advance the implementation and strengthening of international norms, for example, to expand capacity-building activities.

Priority #3, “Collective Response”: Disrupt and Deter Attackers More Effectively

Core Pillar #3: Facilitate collective response to disrupt malicious actors and more effectively deter future attacks.

The third strategic priority—collective response through law enforcement action or other instruments of statecraft, including multilateral or collective response with industry—is enabled by strong resilience and a clear normative framework. Considering the escalating threat landscape, there is growing concern that a lack of more robust and continuous reactions to malicious activity is further emboldening attackers. The current levels of theft and disruptive and destructive activities therefore require not just resilience but a response. Especially during the coronavirus pandemic, cyber heists cannot be ignored when societies worldwide need every penny to assist people in need and can ill afford to have those resources land in the pockets of cyber criminals.

A response may include sanctions, arrests, asset seizures, or other actions. For such actions to be justified, there must be a mutual understanding that a line has been crossed; in addition, since sanctions and other actions to hold actors accountable may provoke an escalatory response, financial actors will need to have a minimum level of resilience so that they can withstand such responses.

The following recommendations outline specific steps that governments and industry can take to facilitate a collective response to an incident in order to deter malicious actors from future cyber attacks. Such a response may include law enforcement action, and it may well require strengthening the financial sector’s ties to other parts of the national security community, considering the growth of state-sponsored threats.

• Recommendation 3.1: Governments and the financial industry should consider establishing entities to bolster their ability to assess systemic risk and threats as well as to coordinate mitigating actions. Existing examples of such entities include the United States’ Financial Systemic Analysis and Resilience Center (FSARC) and the United Kingdom’s Financial Sector Cyber Collaboration Centre (FSCCC).
• Recommendation 3.2: Governments should ensure their intelligence collection priorities include a focus on threats that could pose a risk to the financial system. In addition to nation-state and state-sponsored threat actors, sophisticated criminal actors could deliberately or (more likely) accidentally pose a risk, or they could provide the tools and services for others’ disruptive and destructive attacks.
• Recommendation 3.3: Governments should consider sharing intelligence about threats that pose a risk to the financial system with other allied, partnered, or like-minded countries.
  • Supporting Action 3.3.1: To facilitate such information sharing, governments should consider finding ways—from downgrading classification of intelligence to broadening the pool of security clearance issuance (for example to relevant industry professionals)—to facilitate the sharing of threat intelligence.
• Recommendation 3.4: Financial services firms should consider joining transnational networks like the Financial Services Information Sharing and Analysis Center (FS-ISAC) and/or emulating the region-based Cyber Defence Alliance (CDA) model to create a collective space for the financial industry to share information and prioritize responses to malicious cyber incidents.
• Recommendation 3.5: Governments should not only focus on state-sponsored actors but also make the fight against cyber crime a renewed priority, focusing less on time-consuming negotiations of a new cyber crime treaty and more on direct cooperation. This is especially important given the impact of the pandemic. For example, governments could support the WEF’s Partnership Against Cybercrime and Third Way’s Cyber Enforcement Initiative.
  • Supporting Action 3.5.1: Governments should build a framework to strengthen and further institutionalize public-private cooperation to tackle cyber crime more effectively at the national, regional, and global levels. The World Economic Forum’s Partnership Against Cybercrime is a promising initiative to further advance this on the international level, and Third Way’s Cyber Enforcement Initiative is an innovative effort to develop new public policy approaches aimed at strengthening public-public and public-private cooperation to address this problem.
  • Supporting Action 3.5.2: The financial industry should throw its weight behind efforts to tackle cyber crime more effectively, for example by increasing its participation in law enforcement efforts and better integrating its financial crimes, fraud, and cybersecurity systems in order to capture latest developments.
  • Supporting Action 3.5.3: Governments should prioritize and develop law enforcement capabilities to address cyber crimes that violate international norms, namely those targeting financial institutions.
• Recommendation 3.6: National and multilateral law enforcement agencies should help coordinate and provide negotiation expertise for financial institutions that have been infected with malware and are being held to ransom by threat actors.
• Recommendation 3.7: The FATF should explore how the existing regime to detect and counter money-laundering as well as terrorist and proliferation financing could be leveraged to fight cyber attacks more effectively.

Priority #4, “Workforce”: Expand Effective Models

Crosscutting Issue #1: Build the cybersecurity workforce required to turn ambitions into actions by assessing and expanding effective models for addressing workforce challenges including limited pipelines and a lack of diversity.

The fourth strategic priority—overcoming cybersecurity workforce challenges—is crosscutting in nature given that a strong cybersecurity workforce is needed by all actors, ranging from industry actors to central banks and governmental organizations, to effectively implement strategies and policies in each of the preceding areas. Financial authorities’ increased activity over the past five years may have created an unintended consequence in that financial firms now hire more of the limited cybersecurity talent, thereby exacerbating the workforce shortage in other sectors that are unable to compete with salaries offered in the financial industry.

The recommendations in this section can be grouped into two main categories considering the slightly different sets of challenges each sector is facing: (i) cybersecurity workforce challenges in the private sector and (ii) cybersecurity workforce challenges in the public sector.

• Recommendation 4.1: Financial services firms should prioritize their efforts to address cybersecurity workforce challenges, ranging from the limited talent pipeline to the lack of diversity in the workforce. The high rate of unemployment in the wake of the coronavirus pandemic represents an important opportunity to retrain and hire talent.
  • Supporting Action 4.1.1: Large financial services firms should form a dedicated working group to collect, compare, and assess data about their own current workforce and related initiatives with the goal of assessing those initiatives’ effectiveness and scalability and addressing the broader cybersecurity workforce challenges faced by individual firms, the sector, and countries.
  • Supporting Action 4.1.2: Following an assessment of the effectiveness and scalability of existing models, the dedicated working group should share best practices and lessons learned and issue recommendations for how the financial services sector can better address cybersecurity workforce challenges.
  • Supporting Action 4.1.3: Financial authorities, central banks, and ministries of finance should explore how they could help expand effective cybersecurity workforce initiatives. This would help alleviate the unintended consequence of financial services firms hiring more talent to comply with recently increased regulatory expectations, which exacerbates the workforce shortage for other sectors that cannot compete with financial sector salaries.
• Recommendation 4.2: Financial services firms should provide financial and other resources to help augment effective cybersecurity workforce initiatives, especially those focusing on building and widening the cybersecurity professional pipeline, including high school, apprenticeship, and university programs.
• Recommendation 4.3: Government agencies and financial authorities should identify, improve, and better promote their employment proposition to cybersecurity professionals, including: (i) exposure to and responsibility for a broad range of technical issues, (ii) access to cutting-edge information and authorities, (iii) providing a market-wide perspective valued by the private sector, (iv) job security, and (v) a service mission to the public.
  • Supporting Action 4.3.1: Leaders of financial authorities, and lawmakers when needed, should create mechanisms that give hiring managers greater flexibility, for example allowing them to offer salaries to cybersecurity professionals that are competitive with those offered by industry.
  • Supporting Action 4.3.2: Financial authorities should design their workforce plans based on the assumption that staff will leave their positions after a few years rather than stay for the medium or long term. This provides the opportunity to think of such staff as a resource that will build capacity for the sector more broadly and to minimize risk resulting from staff turnover. This action will likely require organizations to maintain additional headcount on the assumption that some number of positions will be routinely vacant until replacements are hired.
  • Supporting Action 4.3.3: Financial authorities should establish secondment mechanisms with government agencies that employ staff with cybersecurity expertise. Financial authorities may be able to attract and retain cybersecurity professionals more effectively by offering opportunities to work on cybersecurity challenges in other government agencies, or with private sector companies. At the same time, other government agencies tend to have limited situational awareness of the financial infrastructure and processes and could benefit from the expertise of seconded cyber supervisors and regulators.
  • Supporting Action 4.3.4: Financial authorities should establish secondment mechanisms with the financial services and technology sectors. This will offer opportunities for increased knowledge transfer and cybersecurity capability adoption by both public and private sectors. Both sectors could benefit from exposure to alternative cybersecurity risk and operational perspectives, as well as initiatives and technologies that may be brought back to their home organizations for implementation.

Priority #5, “Capacity-Building”: Align Limited Resources to Maximize Impact

Crosscutting Issue #2: Align and expand capacity-building efforts across all three core pillars for those seeking assistance.

The fifth strategic priority—capacity-building—centers on providing assistance to those in need and is also crosscutting. Countries around the world have been seeking assistance from more mature actors in government, industry, and the central bank community on how to strengthen their financial sector’s cybersecurity. For example, the IMF and other international organizations received many requests for cybersecurity assistance from member states, especially in the wake of the 2016 Bangladesh incident, in which a cyber attack resulted in unauthorized large fund transfers. Such capacity-building efforts cut across all three core pillars but are still relatively undeveloped with respect to operational cyber resilience and collective defense within the financial services sector (Core Pillar #1).

For this reason, the following recommendations focus on the still nascent capacity-building efforts relating to operational cyber resilience and collective defense. Some of these recommendations also reinforce other, related ongoing capacity-building efforts to help tackle cyber crime and to strengthen international norms.

• Recommendation 5.1: The G20 Finance Ministers and Central Bank Governors should adopt a communiqué creating a mechanism to operationalize a coherent approach to cybersecurity capacity-building for the financial sector. Such an approach could emulate and build on the lessons learned from the Global Infrastructure Hub launched during Australia’s G20 presidency or the Global Partnership for Financial Inclusion (GPFI) launched during South Korea’s G20 presidency.²⁹
  • Supporting Action 5.1.1: To clarify roles and responsibilities, the G20 Finance Ministers and Central Bank Governors’ communiqué should declare that one of the international financial institutions (ideally the IMF, as the sector-specific multilateral organization) will be the lead coordinating agency for this mechanism, which would also include the World Bank, the Consultative Group to Assist the Poor (CGAP), the Alliance for Financial Inclusion (AFI), and other relevant stakeholders.
  • Supporting Action 5.1.2: Considering ongoing capacity-building efforts by the private sector—for example, the Customer Security Program advanced by the Society for Worldwide Interbank Financial Telecommunication (SWIFT)—and the public sector’s limited financial resources in the wake of the pandemic, the G20 Finance Ministers and Central Bank Governors should invite private sector firms and other relevant stakeholders to participate in and support such capacity-building initiatives, as is the practice in a number of states today.
  • Supporting Action 5.1.3: The G20 Finance Ministers and Central Bank Governors should welcome and encourage the use of the “Cyber Resilience Capacity-building Tool Box for Financial Organizations,” developed by the Carnegie Endowment for International Peace and launched in partnership with the IMF, SWIFT, FS-ISAC, and other organizations.
• Recommendation 5.2: The member states of the Development Assistance Committee of the Organisation for Economic Co-operation and Development (OECD) should integrate cybersecurity capacity-building into official development assistance (ODA) budgets and significantly increase assistance to countries in need. Even with technical cooperation mechanisms, international financial institutions such as the IMF and World Bank currently do not have the capacity to respond to the disruptions to critical financial services or the hundreds of millions of dollars stolen in countries around the world.
• Recommendation 5.3: To further expand and strengthen ongoing capacity-building around international cyber norms and to advance the objectives outlined in this report, the UN Institute for Disarmament Research (UNIDIR) and the UN Office for Disarmament Affairs (UNODA) should integrate a specific module focusing on the financial sector into their capacity-building material.
• Recommendation 5.4: To further expand and strengthen ongoing capacity-building efforts with respect to tackling cyber crime more effectively, state and industry stakeholders should support the efforts by the Council of Europe, Europol, INTERPOL, the UN Office on Drugs and Crime (UNODC), and the World Bank to strengthen capabilities to address cyber crime.

Priority #6, “Digital Transformation”: Safeguard Financial Inclusion

Crosscutting Issue #3: Safeguard financial inclusion and the G20’s achievements of the past decade in this area.

The sixth strategic priority focuses on the massive digital transformation currently reshaping the financial system. One area where this transformation has been most pronounced is in the tremendous effort by the G20 and other stakeholders to expand financial inclusion around the world and increase access to financial services for hundreds of millions of people. Many financial inclusion efforts rely on leapfrogging to digital financial services (DFS) and are changing the level and type of interdependencies of the financial system and tech companies.³⁰ Safeguarding financial inclusion achievements against growing cyber threats is therefore an urgent challenge.

The following recommendations focus on establishing a consolidated foundation to advance cybersecurity in the context of financial inclusion and to safeguard the achievements made in that area over the past decade. This includes clarifying roles and responsibilities of key stakeholders, considering a dedicated regional focus on Africa to complement the focus on Latin America already provided through the Organization of American States (OAS), and exploring how financial inclusion initiatives could be leveraged to raise awareness about basic cybersecurity principles.

• Recommendation 6.1: The G20 heads of state should strengthen coordination among existing financial inclusion and cybersecurity efforts so as to align limited resources and maximize their impact, especially in the wake of the pandemic. They should also initiate an annual conference to assess latest developments and coordinate next steps; the convening should include major donors, the World Bank, IMF, AFI, CGAP, and other relevant stakeholders.
  • Supporting Action 6.1.1: The G20 should clarify the role of international financial institutions like the World Bank, CGAP, and the IMF with respect to cybersecurity and financial inclusion. They should also emphasize the need to coordinate on issues that overlap across these institutions.
  • Supporting Action 6.1.2: The GPFI should deepen the connections between financial inclusion initiatives and the cybersecurity community. As DFS continue to be expanded, especially in the wake of the pandemic, it is critical to develop greater collaboration between the financial inclusion and cybersecurity communities.
  • Supporting Action 6.1.3: The GPFI should deepen the connections between financial inclusion actors and the law enforcement community. As more people gain access to financial services, the platforms they use will become increasingly attractive targets for cyber criminals. By strengthening the relationship between the financial inclusion community and the law enforcement community, stakeholders can more effectively address cyber crime that targets products and services used for financial inclusion.
• Recommendation 6.2: A network of experts should be created to focus specifically on cybersecurity and financial inclusion in Africa to complement other existing regional initiatives. The fifty-four countries in Africa are experiencing a significant transformation of their financial sectors as they extend financial inclusion and leapfrog to DFS. At the same time, this transformation makes African countries a prime target for cyber criminals who exploit soft targets and financial institutions with limited capacity to effectively protect themselves. Cybersecurity expertise across the African continent remains limited and scattered.
• Recommendation 6.3: The G20 should highlight that cybersecurity must be designed into technologies used to advance financial inclusion from the start rather than included as an afterthought. An example of such a foundational expectation is the reference in the GPFI’s “G20 Action Plan on SME Financing” to a strong credit infrastructure as a fundamental requirement for small- and medium-sized enterprises to have access to loans and other credit. By looking ahead and mapping initiatives that will come online in the coming years, GPFI can help ensure that cybersecurity will ideally no longer be an afterthought but be incorporated in future financial inclusion developments beyond payment systems.
• Recommendation 6.4: The GPFI, main funders, and DFS platforms should explore how financial inclusion efforts could be leveraged to increase general awareness of basic cybersecurity principles. Raising awareness of best cybersecurity practices is critical, especially among users in developing countries, who recently gained access to financial services and the internet, often via a mobile phone. Financial inclusion platforms could be leveraged to offer basic cybersecurity resources for the individuals and businesses using them.

Notes

¹ Deloitte, “Realizing the Digital Promise: COVID-19 Catalyzes and Accelerates Transformation in Financial Services,” 2020, https://www2.deloitte.com/content/dam/Deloitte/global/Documents/Financial-Services/gx-fsi-realizing-the-digital-promise-covid-19-catalyzes-and-accelerates-transformation.pdf.

² Christine Lagarde, “Payments in a Digital World,” speech, Deutsche Bundesbank online conference on banking and payments in the digital world, Frankfurt am Main, September 10, 2020, https://www.ecb.europa.eu/press/key/date/2020/html/ecb.sp200910~31e6ae9835.en.html.

³ Lily Hay Newman, “The Billion-Dollar Hacking Group Behind a String of Big Breaches,” Wired, April 4, 2018, https://www.wired.com/story/fin7-carbanak-hacking-group-behind-a-string-of-big-breaches/.

⁴ United Nations Security Council, “Letter Dated 31 July 2019 from the Panel of Experts Established Pursuant to Resolution 1874 (2009) Addressed to the Chair of the Security Council Committee Established Pursuant to Resolution 1718 (2006).” U.S. Government Joint Advisory, “Alert (AA20-239A) FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks,” August 26, 2020, https://us-cert.cisa.gov/ncas/alerts/aa20-239a.

⁵ Tim Maurer and Arthur Nelson, “COVID-19’s Other Virus: Targeting the Financial System,” Strategic Europe (blog), April 21, 2020, 1, https://carnegieeurope.eu/strategiceurope/81599.

⁶ David E. Sanger, “U.S. Indicts 7 Iranians in Cyberattacks on Banks and a Dam,” New York Times, March 24, 2016, https://www.nytimes.com/2016/03/25/world/middleeast/us-indicts-iranians-in-cyberattacks-on-banks-and-a-dam.html.

⁷ Tim Maurer et al., “Toward a Global Norm Against Manipulating the Integrity of Financial Data,” Carnegie Endowment for International Peace, March 2017, https://carnegieendowment.org/2017/03/27/toward-global-norm-against-manipulating-integrity-of-financial-data-pub-68403; European Systemic Risk Board, “Systemic Cyber Risk,” February 25, 2020, https://www.esrb.europa.eu/pub/pdf/reports/esrb.report200219_systemiccyberrisk~101a09685e.en.pdf; Greg Ros, “The Making of a Cyber Crash: A Conceptual Model for Systemic Risk in the Financial Sector,” European Systemic Risk Board, Occasional Paper Series No 16, May 2020, https://www.esrb.europa.eu/pub/pdf/occasional/esrb.op16~f80ad1d83a.en.pdf.

⁸ Davey Winder, “$645 Billion Cyber Risk Could Trigger Liquidity Crisis, ECB’s Lagarde Warns,” Forbes, March 10, 2020, https://www.forbes.com/sites/daveywinder/2020/02/08/645-billion-cyber-risk-could-trigger-liquidity-crisis-ecbs-lagarde-warns/.

⁹ Mark Bendeich and Leika Kihara, “Cyber Threat Could Become Banking’s Most Serious Risk,” Reuters, January 24, 2019, https://www.reuters.com/article/davos-meeting-cyber-kuroda/davos-cyber-threat-could-become-bankings-most-serious-risk-boj-idUSS8N1PK01N.

¹⁰ Hugh Son, “Jamie Dimon Says Risk of Cyberattacks ‘May Be Biggest Threat to the US Financial System,’” CNBC, April 4, 2019, https://www.cnbc.com/2019/04/04/jp-morgan-ceo-jamie-dimon-warns-cyber-attacks-biggest-threat-to-us.html.

¹¹ Financial Stability Board, “Effective Practices for Cyber Incident Response and Recovery: Consultative Document,” April 20, 2020, https://www.fsb.org/2020/04/effective-practices-for-cyber-incident-response-and-recovery-consultative-document/.

¹² IOSCO Cyber Task Force, “Final Report,” The Board of the International Organization of Securities Commissions, June, 2019, https://www.iosco.org/library/pubdocs/pdf/IOSCOPD633.pdf.

¹³ Gerald J. Schueler, “The Unpredictability of Complex Systems,” Journal of the Washington Academy of Sciences 84, no. 1 (1996): 3–12; John H. Holland, “Complex Adaptive Systems,” Daedalus 121, no. 1, (1992): 17–30; George A. Polacek et al., “On Principles and Rules in Complex Adaptive Systems: A Financial System Case Study,” Systems Engineering 15, no. 4 (2012): 433–47, https://doi.org/10.1002/sys.21213.

¹⁴ Ryan Browne, “Banks Must Behave ‘more like Technology Companies’ to Survive, Finance Execs Say,” CNBC, November 18, 2019, https://www.cnbc.com/2019/11/18/banks-must-behave-like-tech-companies-to-survive-amid-fintech-threat.html; Gregory Barber, “Every Tech Company Wants to Be a Bank—Someday, At Least,” Wired, November 16, 2019, https://www.wired.com/story/tech-companies-banks/.

¹⁵ Financial Stability Board, “Effective Practices for Cyber Incident Response and Recover: Consultative document,” April 20, 2020, https://www.fsb.org/2020/04/effective-practices-for-cyber-incident-response-and-recovery-consultative-document/.

¹⁶ For a comprehensive overview of individual countries’ red team testing frameworks, see: Raymond Kleijmeer, Jermy Prenio, and Jeffery Yong, “FSI Insights on Policy Implementation No 21—Varying Shades of Red: How Red Team Testing Frameworks Can Enhance the Cyber Resilience of Financial Institutions,” Financial Stability Institute, November 2019, https://www.bis.org/fsi/publ/insights21.pdf.

¹⁷ “Digital Finance Package: Commission sets out new, ambitious approach to encourage responsible innovation to benefit consumers and businesses,” European Commission, Brussels, September 24, 2020, https://ec.europa.eu/commission/presscorner/detail/en/IP_20_1684.

¹⁸ Hanna Ziady, “New Zealand Spy Agency Investigating ‘Severe’ Cyberattack on Shody Exchange,” CNN Business, August 28, 2020, https://www.cnn.com/2020/08/27/investing/new-zealand-stock-exchange-cyber-attack/index.html.

¹⁹ This is modeled after the exercise series carried out by the financial sector’s Securities Industry and Financial Markets Association: “Cybersecurity Exercise: Quantum Dawn V,” Security Industry and Financial Markets Association (SIFMA), https://www.sifma.org/resources/general/cybersecurity-exercise-quantum-dawn-v/.

²⁰ This is modeled after the Financial Systemic Analysis & Resilience Center (FSARC): “Identifying Cyber Threats With FSARC,” JP Morgan, October 9, 2018, https://www.jpmorgan.com/commercial-banking/insights/cyber-threats-fsarc.

²¹ For example, in 2014, the U.S. Department of Justice and the Federal Trade Commission issued a joint statement for that purpose regarding the sharing of cyber threat information. The 2015 U.S. Cybersecurity Information Sharing Act (CISA) goes a step further by making clear that “activity authorized by CISA does not violate federal and state antitrust laws.”U.S. CERT, “Cybersecurity Information Sharing Act—Frequently Asked Questions,” accessed July 20, 2020, https://www.us-cert.gov/sites/default/files/ais_files/CISA_FAQs.pdf.

²² Relatedly, see also the submissions by members of the World Economic Forum’s “Global Coalition to Fight Financial Crime” to inform the European Commission’s Anti-Money Laundering Action Plan: “Press Release: Statement on the European Commission Action Plan on Preventing Money Laundering and Terrorism Financing,” Global Coalition to Fight Financial Crime, Brussels, August 26, 2020, https://www.gcffc.org/press-release-statement-on-the-european-commission-aml-action-plan/.

²³ Jim Edwards, “A False Rumor on WhatsApp Started a Run on a London Bank,” Business Insider, May 13, 2019, https://www.businessinsider.com/whatsapp-rumour-started-run-on-metro-bank-2019-5.

²⁴ Joseph S. Nye, “Deterrence and Dissuasion in Cyberspace,” International Security 41, no. 3 (January 2017): 44–71, https://doi.org/10.1162/ISEC_a_00266.

²⁵ International Committee of the Red Cross, “Building Respect for the Law,” https://www.icrc.org/en/what-we-do/building-respect-ihl.

²⁶ This would build on the ICRC’s existing publications on the topic, including: Laurent Gisel, Tilman Rodenhäuser and Knut Dörmann “Twenty Years On: International Humanitarian Law and the Protection of Civilians Against the Effects of Cyber Operations During Armed Conflicts, ”International Review of the Red Cross (2020), 0 (0), 1–48, https://international-review.icrc.org/sites/default/files/reviews-pdf/2020-09/Twenty-years-on-IHL-and-cyber-operations.pdf. Laurent Gisel, Tilman Rodenhäuser, and Kubo Mačák, “Cyber Attacks against Hospitals and the COVID-19 Pandemic: How Strong Are International Law Protections?,” Humanitarian Law & Policy Blog (blog), ICRC, April 2, 2020, https://blogs.icrc.org/law-and-policy/2020/04/02/cyber-attacks-hospitals-covid-19/; Peter Maurer et. al., “Call to Governments: Work Together to Stop Cyber Attacks on Health Care,” ICRC, May 25, 2020, https://www.icrc.org/en/document/governments-work-together-stop-cyber-attacks-health-care.

²⁷ U.S. Department of Homeland Security, “Joint Advisory—Alert (AA20-239A) FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks,” August 26, 2020, https://us-cert.cisa.gov/ncas/alerts/aa20-239a.

²⁸ United Nations Security Council, “Letter Dated 31 July 2019 from the Panel of Experts Established Pursuant to Resolution 1874 (2009) Addressed to the Chair of the Security Council Committee Established Pursuant to Resolution 1718 (2006),” August 30, 2019, https://www.securitycouncilreport.org/atf/cf/%7B65BFCF9B-6D27-4E9C-8CD3-CF6E4FF96FF9%7D/S_2019_691.pdf.

²⁹ Global Infrastructure Hub, “Funders and Strategic Partners,” accessed July 20, 2020, https://www.gihub.org/about/funders-and-strategic-partners/; and Global Partnership for Financial Inclusion, “GPFI,” accessed July 20, 2020, https://www.gpfi.org/.

³⁰ The changing nature of the financial system also influences what Harvard professor Joseph Nye calls “deterrence by entanglement”—the more entangled actors are in a system, the more likely it is that they will be deterred from attacking parts of the system. See Nye.

The unique nature of cyber threats and the actions necessary to better protect the global financial system against them require strengthening the connections between different actors and initiatives. However, many public and private actors remain unaware of the full range of efforts in this domain. The fact that this report is the most comprehensive analysis to date of the efforts underway to protect the global financial system against cyber threats is a telling example of the disconnect.

This background report therefore complements the strategy outlined in Part I and aims to raise readers’ awareness of processes taking place in other communities. The following sections outline the analysis and context for each recommendation in the strategy and its supporting actions. Each section offers an overview of the challenges specific to the priority area as well as a mapping of ongoing initiatives and relevant stakeholders in government, industry, and the financial supervisory community. We hope that readers will focus not on the sections they are most familiar with, but on those discussing less familiar issues.

For example, for central bank officials who are already very familiar with ongoing efforts to increase the sector’s resilience, the sections on international norms and collective response will offer new information about how the recommendations focusing on diplomatic initiatives and the national security community can help support their resilience-focused efforts. Similarly, for diplomats focused on advancing international norms, the section on cyber resilience will point to opportunities for implementing these norms. And the challenges with respect to workforce and capacity-building are often neglected but essential to strengthen the system’s weakest links.

The main challenge, outlined in the overarching recommendations, is how best to organize the protection of the financial system against cyber threats. These overarching recommendations therefore focus on strengthening international mechanisms for coordination, placing the G20 and the G7 at the center and pairing them with more active industry engagement.

• Recommendation 0.1: G20 heads of state should create interagency processes within their respective governments, co-led by the ministry of finance and the central bank/monetary authority (or other relevant entity representing the government in international finance bodies), to explore options for better protecting their domestic as well as the international financial system against cyber threats. Ideally these processes will focus on the six priority areas identified in this report and take into account the report’s recommendations. (The co-leadership is designed to avoid disruptions caused by the frequent turnover of politically appointed ministers of finance; including central banks/monetary authorities as co-leads will allow greater continuity of effort.)
  • Supporting Action 0.1.1: To help increase trust and confidence, G20 Finance Ministers and Central Bank Governors should consider creating a G20 Finance Track process emulating the confidence-building measures undertaken by the member states of the Organization for Security and Co-operation in Europe (OSCE), which includes the United States and Russia.

Although the G20 member states tend to emphasize their shared interest—the stability of the global financial system—that shared interest has not been sufficient to overcome a profound lack of trust, which has hampered coordination and cooperation among the G20 member states. To develop more trust when discussing cybersecurity in the context of the financial system, G20 member states could consider emulating the process at the OSCE. Given that the OSCE’s fifty-seven participating states, including the United States and Russia, were able to agree on confidence-building measures in 2013 and 2016, this seems a promising model to emulate in the G20 Finance Track.

Established during the Cold War, the OSCE was created to help build trust and increase confidence between the United States and the Soviet Union. In 2012, the OSCE’s member states decided to launch a new work stream specifically designed to reduce mistrust in the area of cybersecurity and conflict. They launched a working group focusing on developing “confidence-building measures (CBMs) to enhance interstate cooperation, transparency, predictability, and stability, and to reduce the risks of misperception, escalation, and conflict that may stem from the use of ICTs [information and communications technologies].” A first set of CBMs was adopted in 2013, followed by an expanded set adopted in 2016.

Similar actions could be taken through the G20 Finance Track, considering that a major cyber incident involving the financial system is likely to require international cooperation at a global level. As a starting point, G20 member states could assess which of these measures are already in place, whether through the FSB’s actions initiated in 2017 or other relevant entities such as the BIS. The following table lays out possible CBMs for the G20 modeled after the set created by OSGE.

Table 2: Possible Measures to Build Confidence Among the G20
G20 member states will nominate a 24/7 contact point to facilitate pertinent communications on cyber incidents with respect to the financial sector. G20 member states will update contact information annually and share any changes with other members no later than thirty days after a change has occurred.
G20 member states will voluntarily provide contact information for existing official national structures that manage ICT-related incidents relevant to the financial sector; member states will also coordinate responses to enable direct dialogue and facilitate interaction among responsible national bodies and experts.
G20 member states will voluntarily establish measures to ensure rapid communication at policy levels of authority.
G20 member states will voluntarily provide their national views on various aspects of national and transnational cyber threats targeting the financial system. The extent of such information will be determined by the member states.
G20 member states will voluntarily facilitate cooperation among the competent national bodies as well as exchange of information relevant to protecting the financial sector against cyber threats.
G20 member states will, on a voluntary basis and at the appropriate level, hold consultations in order to protect the integrity of the global financial system.
G20 member states will voluntarily share information on measures that they have taken to protect the integrity of the global financial system.
G20 member states will use the FSB as a platform for dialogue, exchange of best practices, awareness-raising, and information on capacity-building regarding cybersecurity in the financial sector. The participating states will explore further developing the FSB role in this regard.
G20 member states are encouraged to have in place modern and effective frameworks and policies to facilitate voluntary bilateral cooperation and effective, time-sensitive information exchange among competent authorities of the participating member states, including law enforcement agencies, in order to respond to malicious cyber activity.
G20 member states will voluntarily share information on their national organization, strategies, policies, and programs (including those involving cooperation between the public and the private sector) relevant to cybersecurity in the financial sector; the extent of this information sharing will be determined by the providing member states.
G20 member states will, on a voluntary basis, share information and facilitate inter-state exchanges in different formats, including workshops, seminars, and roundtables; these exchanges are aimed at allowing member states to investigate the spectrum of cooperative measures as well as other processes and mechanisms that could enable them to better protect the global financial system against cyber threats.
G20 member states will, on a voluntary basis and consistent with national legislation, promote public-private partnerships and develop mechanisms to exchange best practices of responses to common cybersecurity challenges in the financial sector.
G20 member states will, on a voluntary basis, encourage responsible reporting of vulnerabilities affecting cybersecurity in the financial sector with the goal of increasing cooperation and transparency among G20 member states.
G20 member states will, at the level of designated national experts, meet at least three times each year to discuss information exchanged and explore appropriate development of these measures.
*Certain steps taken at the OSCE have already occurred in the G20 Finance Track. For example, the cyber lexicon developed by the FSB mirrors a similar effort at the OSCE.
Source: OSCE, “Confidence-Building Measures to Reduce the Risks of Conflict Stemming From the Use of Information and Communication Technologies,” OSCE Permanent Council Decision No. 1202, March 10, 2016, https://www.osce.org/pc/227281.

• Recommendation 0.2: Financial services firms should expand their engagement and dedicate more resources to strengthening the protection of the sector overall. In particular, firms should support capacity-building efforts for weaker links in the system and become more active in efforts complementary to firms’ core focus on resilience, such as advancing international norms, facilitating collective response, and tackling workforce challenges.
• Recommendation 0.3: G7 Finance Ministers and Central Bank Governors should renew the mandate of the G7 CEG starting in 2021; the mandate should include expanding the number of participant states and initiating a G7+ process, for example, emulating the one that established the FATF in the early 1990s, or another process for involving members outside its current remit. (In addition to the European Commission, which is already included, this expanded group could include financial centers such as Switzerland and Singapore and other relevant partner countries. Appendix A provides an outline of stakeholders that could be included in such an enlarged process.)

The creation of the FATF provides useful insight into how to expand the important work that the G7 CEG commenced in 2016. A similar G7+ enlarged group could include other major financial centers such as Switzerland and Singapore. Rather than creating a formalized membership like that of the FATF, this new group could issue standing invitations to a small number of countries, similar to those extended by the G20 presiding member state each year.

Figure 3 shows the three phases of expansion for FATF’s membership, as the organization shifted over time from its original open membership model to one that invited additional countries to join based on a consensus-driven process. Membership of a group focusing on cybersecurity in the context of the financial system would likely differ from FATF’s original membership. Appendix A outlines which countries may be most relevant to include and which financial institutions would be particularly important to consult for such an effort.

Core Pillar #1: Strengthen operational cyber resilience and collective defense to shield the financial sector against cyber threats.

Problem Statement: Preparing for the Next Crisis

In March 2017, G20 Finance Ministers and Central Bank Governors warned for the first time that “the malicious use of Information and Communication Technologies could . . . undermine security and confidence and endanger financial stability.”¹ Consequently, the G20 tasked the FSB with taking stock of approaches on cybersecurity and the financial system; that FSB report was published in October 2017.² A year later, the FSB also published a cyber lexicon to promote a common language in the industry.³

In the meantime, many individual jurisdictions have been developing approaches to address the risk of cyber incidents. Cyber incidents (attacks or system failures) are inevitable, especially when financial institutions are increasingly digitally interconnected. Firms must be ready to withstand them and maintain operations.⁴ While operational risk has been a fundamental tenet of financial risk management for more than a decade, the term operational resilience—“the ability of firms and financial market infrastructures (FMIs) and the financial sector as a whole to prevent, adapt, respond to, recover and learn from operational disruptions”⁵—is still emerging as a foundational principle of financial risk management. Central to operational resilience is cyber resilience.

There is broad agreement that the financial sector should embrace operational resilience in order to withstand and recover from nonfinancial shocks and to protect financial stability. In February 2020, Christine Lagarde, the former managing director of the IMF and now head of the ECB, warned that a cyber attack had the potential to trigger a liquidity crisis.⁶ Just how operational resilience should be implemented and achieved remains unclear.

Managing cyber risk is still a challenge for regulatory and supervisory authorities. According to Arthur Lindo, a senior official from the U.S. Federal Reserve Board and chair of the BCBS Operational Resilience Group, “traditional regulatory approaches will not be adequate for meeting the challenges of this new environment. [Cyber risk] is requiring [a] regulatory approach that is significantly different from those we use for capital, liquidity and other major risk stripes.”⁷

The financial community is currently debating how regulators should create new tools and expectations to ensure operational resilience across jurisdictions. Both financial institutions and regulators have incentives to effectively mitigate risks from cyber incidents,¹⁴ but there is debate about what is required of firms. Achieving operational resilience requires a comprehensive approach to prevention, adaptation, response, recovery, and learning. Consequently, operational resilience has many subcomponents, including impact tolerances, penetration-testing, third-party risk management, incident response and crisis management, information sharing, incident reporting, governance, and a common lexicon, to name a few.

Figure 4 illustrates how the thinking about cyber risks in the context of the financial system has evolved.

Industry has raised concerns about financial authorities’ divergent and inconsistent approaches and has called for an “international common approach.”¹⁵ Harmonizing regulation internationally, they argue, will reduce the costs of complying with multiple regimes and free up resources for operational activities.

Mapping the Status Quo: Current Approaches and Specific Areas of Focus

National Approaches Trump International Cooperation

The concept of “operational resilience” emerged as a key focus among national supervisory and regulatory authorities in 2016, as highlighted in Figure 5.¹⁶ The United Kingdom’s 2018 discussion papers cemented the term across the sector, and authorities in the United States, Singapore, and the EU also developed their own perspectives on the topic.

This section summarizes and analyzes the approaches of five key jurisdictions—the United Kingdom, the EU, Singapore, the United States, and India—chosen for their centrality and thought leadership in the global financial system.

United Kingdom

The Bank of England (BoE), the Prudential Regulation Authority, and the Financial Conduct Authority (FCA), here referred to in the aggregate as the United Kingdom Financial Service Authorities (UK FSAs), were among the first financial authorities to advance the concept of operational resilience.

Starting in July 2018, the UK FSAs published a series of discussion papers, “Building the UK Financial Sector’s Operational Resilience,” that drew focus away from firms’ ability to prevent disruptions and refocused attention on ensuring that individual firms and the financial sector had the ability to withstand disruptions, or “shocks.”¹⁷ In December 2019, the UK FSAs proposed an operational resilience framework based on industry feedback that called upon financial institutions and FMIs to set impact tolerances for key business services by “quantifying the acceptable level of disruption through severe . . . but plausible scenarios.”¹⁸ Importantly, the UK FSAs noted that they would refine their framework based on emerging international standards.¹⁹

The United Kingdom has a number of other important initiatives related to operational resilience. To support sector-wide penetration testing, the BoE developed CBEST, a framework for penetration testing of systemically critical organizations.²⁰ According to the BoE, “The implementation of CBEST will help the boards of financial firms, infrastructure providers and regulators to improve their understanding of the types of cyber-attacks that could undermine financial stability in the U.K.”²¹

The United Kingdom also hosted and takes part in a number of cybersecurity exercises. For example, UK FSAs hosted the Waking Shark I and II exercises in 2011 and 2013, and the 2018 SIMEX18 exercise also focused on a prolonged and broad cyber attack.²² In 2015, the United Kingdom and the United States held a joint exercise testing the stability of the financial system in a cyber incident.²³ Many UK firms participate in the regular Quantum Dawn exercises, hosted by the Securities Industry and Financial Markets Association (SIFMA).²⁴ Relatedly, to support information sharing, the United Kingdom has the Cyber Security Information Sharing Partnership, a joint industry/government initiative led by the National Cyber Security Centre (NCSC) that provides threat intelligence to key financial institutions.²⁵

Public-private mechanisms like the Cross Market Operational Resilience Group (CMORG) or FSCCC enable cooperation on exercises and information-sharing in the UK financial sector. For example, CMORG is a platform for senior public and private sector executives to rehearse how to respond to a major crisis event to establish what the Bank of England calls “common reflexes.”²⁶ The group is jointly chaired by Lyndon Nelson of the Bank of England and Stephen Jones, CEO of UK Finance, the London-based financial services industry association.²⁷ A subgroup of CMORG, the Sector Exercising Group, manages the sector’s annual exercise regime, including simulations of major cyber incidents like SIMEX18.²⁸

In short, the UK FSAs are key thought leaders on operational resilience and the outcome of the consultation process will likely shape the international dialogue around this issue.

The European Union

The EC, the European Central Bank and other European supervisory authorities (ESAs), and individual EU member states have explored, tested, and implemented new approaches to strengthen the cyber and operational resilience of the financial system. Nonetheless, according to a September 2020 assessment by the EC, “Overall, the financial sector stability and integrity are not guaranteed and the single market for financial services remains fragmented.”²⁹ The new “Digital Finance Strategy for the EU” therefore puts harmonizing operational resilience approaches front and center in the EC’s legislative agenda, which will likely lead to greater convergence among national approaches in the coming years.

Activity by the European Commission

In March 2018, the EC’s FinTech Action Plan called for the ESAs to issue ICT risk management requirements for the EU financial sector.³⁰ The ESAs published the “Joint Advice of the European Supervisory Authorities,”³¹ which noted that “efforts should be made toward greater harmonization” and toward improved third-party risk management. In late 2019, the European Banking Authority (EBA) published its “Guidelines on ICT and Security Risk Management,” which entered into force on June 30, 2020.³² Among other things, these guidelines call for firms to conduct “business impact analysis by analyzing their exposure to severe business disruptions.”³³ The EBA also published their outsourcing guidelines.³⁴

In 2019, the EC focused on updating its regulations for Europe’s financial sector. In December 2019, the EC launched a consultation initiative, “Digital Operational Resilience Framework for Financial Services: Making the EU Financial Sector More Secure.”³⁵ Aware of the financial service industry’s concerns around harmonization, the consultation noted: “It is essential that financial supervisors’ efforts work in a harmonised and convergent framework.”³⁶ The EBF, the EU’s largest financial trade organization, welcomed the EC’s consultation: “The interconnectedness of all actors within the financial ecosystem, incl. [sic] third party providers, and the evolution of ICT risks highlight the need for a common minimum security for the financial sector as a whole, based on international coordination.”³⁷

In September 2020, the EC released a new digital finance strategy for the EU in conjunction with a “digital finance package” of legislative proposals. The new strategy warns that coronavirus has “increased reliance on digital and remote technologies,” which has only increased the urgency of action: “The EU cannot afford to have the operational resilience and security of its digital financial infrastructure and services called into question.”³⁸

The legislative package includes the Digital Operational Resilience Act (DORA) for the financial sector, which was prompted by an observed “minimum harmonization [that left] room for national interpretation and fragmentation.” ³⁹ DORA aims to strengthen firms’ management of ICT risks, increase the capacity of supervisors, improve testing of financial systems, and upgrade oversight of third-party ICT providers.⁴⁰ DORA reinforces that EU authorities are particularly concerned with third-party risk, especially that posed by cloud service providers. Most importantly, the legislation addresses the ESAs’ 2019 call to create “an appropriate oversight framework for monitoring critical service providers”;⁴¹ DORA proposes a framework that would enable “continuous monitoring of the activities of ICT third-party service providers that are critical providers to financial entities.”⁴²

Activity by the European Central Bank

The ECB has also played a central role in advancing initiatives on cyber resilience across the EU. In 2017, the ECB Executive Board voted to establish the Euro Cyber Resilience Board (ECRB) for pan-European Financial Infrastructures, a forum for senior officials to advance cyber resilience policy. In 2019, the ECB published a set of “cyber resilience oversight expectations” (CROE) to provide guidance to FMIs and supervisors. The ECB also hosts UNITAS, a cybersecurity exercise that tests the resilience of crisis communications between supervisors and firms.

Since its launch in 2018, the ECRB has focused on tackling effective cross-border information sharing between financial infrastructures. In February 2020, the ECRB launched the Cyber Information and Intelligence Sharing Initiative (CIISI-EU), which brings together a range of public and private stakeholders: pan-European financial infrastructures, operational teams within central banks, critical service providers, the European Union Agency for Cybersecurity (ENISA), and Europol.⁴³ CIISI-EU provides a technical platform for public-private information sharing, notably including strategic intelligence regarding nation state activity. To prevent mistrust between private companies and authorities from chilling the exchange of information, all content is siloed outside the purview of the supervisory functions of participating public authorities.⁴⁴

Additionally, in 2018, the ECB published the Framework for Threat Intelligence-Based Ethical Red Teaming (TIBER-EU), based on the original Dutch TIBER-NL framework. The TIBER-EU framework provides central banks and financial authorities guidance in collaborating with financial institutions to carry out penetration testing of live systems. TIBER-EU aims to overcome barriers of mistrust by generating practical results for financial institutions, and by fostering community and collaboration from the bottom up. To this end, the ECB chairs a TIBER-EU Knowledge Centre where participants convene, share experiences, and plan mutual cross-border tests. To date, TIBER-EU has been adopted by twelve EU member states and adoption continues to grow.⁴⁵

Individual EU Member States

EU member states have developed national approaches to operational resilience that mostly complement the EU’s work over the last two years. Key guidance and regulations from G7 states include: guidance on cloud computing from France’s Prudential Supervision and Resolution Authority (ACPR), the Bank of Italy’s guidance on outsourcing risk management, and governance expectations from Germany’s Federal Financial Supervisory Authority (BaFin).

One particular concern is how operational resilience will be implemented at a supra-national level, within the EU’s single market, given the national security implications of financial (in)stability. This concern was expressed during a meeting of the EU’s Economic and Financial Affairs Council in September 2019: “The designation of financial services as critical infrastructure might lead Member States to increasingly declare financial regulation a matter of national security, thus undermining internal market objectives. . . . An approach reconciling security and internal market objectives is therefore needed.”⁴⁶ CIISI-EU and TIBER-EU can be seen as first attempts to balance these competing equities, and DORA is a signal that the European financial system is moving toward a coordinated approach to operational resilience. However, overcoming barriers of trust will require persistent and practical collaboration that clearly demonstrates value to member states.

Singapore

Singapore is another key thought leader in the cybersecurity domain. The Cyber Security Agency of Singapore (CSA) is responsible for cybersecurity nation-wide and works closely with the MAS on cyber security and resilience in the financial sector. Singapore’s Cybersecurity Act, which entered into force in March 2018, establishes a legal framework for the oversight and maintenance of national cybersecurity in Singapore. Its key objectives are to strengthen critical information infrastructure against cyber attacks; authorize the CSA to prevent and respond to cybersecurity threats and incidents; establish a framework for sharing cybersecurity information; and establish a light-touch licensing framework for cybersecurity service providers.⁴⁷

With respect to cybersecurity and operational resilience in the financial sector, the MAS, through its Technology and Cyber Risk Supervision Department, has issued a number of innovative regulatory cyber risk management approaches over the last decade. In June 2013, the MAS issued a “Notice on Technology Risk Management” to establish legally binding requirements for the availability and recoverability of critical systems, recovery time, and incident reporting.⁴⁸ The MAS is currently revising these guidelines to reflect a more principles-based approach.⁴⁹

In March 2019, the MAS proposed changes to their Technology Risk Management Guidelines and Business Continuity Management (BCM) guidelines, citing concerns about the increase in the scale and frequency of cyber attacks.⁵⁰ The proposed revisions in the BCM guidelines intend to raise the standards for financial institutions to better account for interdependencies across their operational units and linkages with external service providers in their business continuity plans. The draft’s initial reference to “minimum performance levels”—not too dissimilar from the UK’s concept of “impact tolerances”—is being reviewed following the public consultation process.

In short, the MAS has become an international thought leader in building cyber resilience. For example, the MAS served as co-chair in developing the CPMI-IOSCO cyber guidance, one of the earliest international efforts focused on operational resilience.⁵¹ The MAS also partnered with the FS-ISAC to establish the Asia Pacific Regional Analysis Centre and an information-sharing group for central banks, regulators, and supervisory entities—the Central Banks, Regulators, and Supervisory Entities or CERES Forum—to combat cyber threats more effectively.⁵² Furthermore, Singapore has expanded its international cooperation through cybersecurity exercises such as the September 2019 Exercise Cyber Star and the November 2019 Exercise Raffles.⁵³

The United States

In the United States, the Board of Governors of the U.S. Federal Reserve System (the Fed), the Office of the Comptroller of the Currency (OCC), and the Federal Deposit Insurance Corporation (FDIC) issued an advance notice of proposed rulemaking around “enhanced cyber risk management standards” in 2016. These rules were to be issued in 2017 but were then deprioritized.⁵⁴ Two years later, the Financial Times reported that U.S. regulators were working on a “cross-agency approach to testing banks against attacks that could crash global payments networks, expose customer data or otherwise threaten the integrity of an industry.”⁵⁵ The Fed had reopened the consultation process for the proposed “Enhanced Cyber Risk Management Standards,” suggesting that resilience is once again becoming a priority.⁵⁶

There are indications that the United States is more sympathetic than other jurisdictions to industry concerns about regulatory harmonization. For example, in 2018, Randal Quarles, then vice chairman for supervision at the Fed, stated in a speech to the Financial Services Roundtable: “We support industry efforts to improve harmonization across the sector, which are complementary to achieving our regulatory safety and soundness goals.”⁵⁷ He concluded that the Federal Reserve’s approach to cybersecurity “may not have fast results” but was focused on “getting it right.”⁵⁸ A year later, during testimony before the U.S. House Committee on Financial Services, JPMorgan Chase CEO Jamie Dimon reiterated industry’s complaint about the conflicting cybersecurity regulations they were facing. The Financial Times reported that Dimon and other financial CEOs went on to meet with U.S. Treasury Secretary Steven Mnuchin to discuss improving harmonization of cybersecurity requirements.⁵⁹

In short, the United States is embracing operational resilience but moving more slowly, prioritizing regulatory harmonization and private sector input over speed. Arthur Lindo, deputy director of supervision and regulation at the Fed, explained the reasoning behind the U.S. approach: “We have changed [the Fed’s] focus from developing operational resiliency expectations that are primarily regulatory driven to developing expectations that are harmonized to leading industry standards and best practices and reflect significantly more input from firms before we establish specific resiliency tolerances.”⁶⁰

Even with this more deliberate approach, cyber resilience remains a priority for U.S. financial supervisory authorities. In its 2020–2023 strategic plan, the Fed committed to “evolve policy and supervisory capabilities to keep pace with financial technology innovation and operational vulnerabilities, including cyber security.”⁶¹ During the January 2020 meeting of the Fed’s Federal Open Market Committee, some participants raised concerns “that cyber-attacks could affect the U.S. financial system,” marking concern about the issue among senior leadership.⁶²

In addition to the Fed, individual states, specifically New York, have outsized influence on the financial sector’s resilience efforts. This is in part because the U.S. financial sector is heavily clustered around New York, and the New York State Department of Financial Services (NYDFS) has led a significant portion of the cyber risk supervision. In 2016, NYDFS published “Cybersecurity Requirements for Financial Service Companies,” a major revision to existing cybersecurity supervision requirements that focused less on prevention and more on recovery from cyber incidents.⁶³

India

India’s approach to cyber resilience and operational resilience is mainly driven by its central bank, the Reserve Bank of India (RBI). In 2016, the RBI published a circular calling for a cyber security framework for Indian banks; this document warned that “banks should immediately put in place a cyber-security policy elucidating the strategy containing an appropriate approach to combat cyber threats.” The framework also called for banks to establish security operations centers as soon as possible.

India’s other financial authorities have also been proactive in addressing cyber risks over the last five years. In 2015, the Securities and Exchange Board of India published a framework on cyber security and cyber resilience for FMIs, specifying that “cyber security frameworks include measures, tools and processes that are intended to prevent cyber attacks and improve cyber resilience.”⁶⁴ In 2018, the Insurance Regulatory and Development Authority of India issued a circular outlining guidance on cybersecurity risk for India’s insurance companies, including requirements on a cyber security assurance program, a gap analysis report, and a cyber crisis management plan.⁶⁵ Other key actors in India like the National Cyber Security Coordinator and the National Critical Information Infrastructure Protection Centre also play an active role in promoting cyber resilience across the financial sector.

Created by the RBI in 1996, the Institute for Development and Research in Banking Technology (IDRBT) incubated the Indian Banks–Center for Analysis of Risks and Threats (IB-CART) in 2014; IB-CART is modeled after FS-ISAC and the RBI Working Group on Information Security, Electronic Banking, Technology Risk Management and Cyber Frauds. Today, IB-CART facilitates information sharing across India’s financial sector. It was the first such sector-specific center in India and, according to IDRBT, has since “become a model of other critical sectors.”⁶⁶ According to IDRBT’s website, “The IB-CART now has more than ninety users from over sixty public, private and foreign banks in India. The IB-CART advisory council has nine members with representation from public and private sector banks and CERT-IN.”⁶⁷ IDRBT also led the development of a 2016 cyber security checklist for supervised entities within India’s financial sector. The checklist aims to “help banks in identifying any gaps in cybersecurity systems” and “help board level subcommittees on risk management and information security on monitoring the cyber defence preparedness of banks.”

In 2019, to address this evolving threat landscape, the RBI centralized all regulatory and supervisory functions related to cyber risks within its Cyber Security and IT Risk Group, located in a newly created Department of Supervision. In addition, the RBI, together with CERT-In, hosts cybersecurity exercises within the financial sector; as of July 2020, thirteen exercises have been held.⁶⁸

In response to coronavirus, the RBI has begun taking further action to address heightened cyber risk to India’s financial sector, in particular its payments markets. The rise in cyber threats also prompted the RBI to work in close coordination with CERT-In to combat cyber-enabled fraud.⁶⁹ CERT-In began tracking cyber threats, analyzing threat intelligence, and helping the RBI issue advisories to financial sector chief information security officers (CISOs).⁷⁰ The RBI has been working proactively with the Economic Offenses Division of India’s Central Bureau of Investigation, which leads investigations of cyber crimes related to banking and financial services.⁷¹ However, the degree of cyber threats in India’s financial sector has revived calls for a national Indian FinCERT.⁷²

International Financial Institutions’ Approach to Operational Resilience

This section summarizes and analyzes approaches to operational resilience on the part of key international financial institutions; the following section examines the approaches adopted by industry.

Committee on Payments and Market Infrastructures & the International Organization of Securities Commission

The CPMI, a committee within the BIS, is a global standard setter for payment, clearing, and settlement in the financial system; it is also a forum for central bank cooperation on such functions. IOSCO is an international body for financial authorities that regulate securities and futures markets. The CPMI and IOSCO have overlapping mandates and often collaborate on cybersecurity issues, “to enhance coordination of standard and policy development and implementation, regarding clearing, settlement and reporting arrangements including financial market infrastructures (FMI) worldwide.”⁷⁸

In June 2016, CPMI-IOSCO released their joint report, “Guidance on Cyber Resilience for Financial Market Infrastructures.”⁷⁹ It is regarded as the first internationally agreed upon guidance on cybersecurity for FMIs and highlights the growing attention this issue has been receiving in recent years. The goal of the report is to increase the ability of FMIs to pre-empt, rapidly respond to, and recover from cyber attacks, as well as to set resiliency standards from country to country.⁸⁰

It should be noted that both organizations tackle cybersecurity individually as well as collaboratively. For example, IOSCO’s Cyber Task Force tracks cybersecurity regulations from IOSCO member jurisdictions. In 2019, the task force published a report finding that member jurisdictions consider cyber “to be at least one of the most important risks faced by regulated firms.”⁸¹ In May 2018, the CPMI published a guidance document, “Reducing the Risk of Wholesale Payments Fraud Related to Endpoint Security.”⁸²

Financial Stability Board

The FSB, established by the G20 in 2009 and hosted by the BIS, began its work on cyber resilience in 2017, after being tasked by the G20 with taking stock of approaches on cybersecurity and the financial system.⁸³ In October 2017, the FSB published its “Stocktake and Summary Report on Financial Sector Cybersecurity Regulations, Guidance and Supervisory Practices.” It found that many jurisdictions were still actively developing regulation and guidance and pointed to a fragmentation between approaches among surveyed jurisdictions.⁸⁴

The FSB also published a cyber lexicon to promote a common language in the industry; this lexicon is currently being updated and is scheduled to be released in November 2020.⁸⁵ The FSB also developed a toolkit, “Effective Practices for Cyber Incident Response and Recovery,”⁸⁶ based on a range of practices from different jurisdictions; the toolkit will be presented at the G20 meeting in November 2020.

Basel Committee on Banking Supervision

The BCBS, the main international body of banking supervisory authorities guided by the central bank governors of the G10 countries, has traditionally advanced cyber resilience and operational resilience through coordination and surveys across its memberships, and most recently through a set of principles for operational resilience. The BCBS works closely with the BIS and other international financial standard-setting bodies, and its focus on operational resilience and cyber risk builds on the work of its counterparts. For example, in 2019, the BCBS published “Cyber-resilience: Range of Practices,” which builds upon a 2017 survey from the FSB and compares how financial authorities approach cyber resilience across jurisdictions.⁸⁷

In August 2020, the BCBS published a consultative document, “Principles for Operational Resilience,”⁸⁸ which builds on its 2011 “Principles for the Sound Management of Operational Risk.” The new consultation notably broadens the focus beyond cyber incidents to include risks from pandemics, accidents, natural disasters, and technology failures.⁸⁹ The consultation period is set to end by November 2020.

Bank for International Settlements

The BIS helps its members manage cyber risk and build resilience through key regulator stocktakes,⁹⁰ convenings,⁹¹ consultations, and guidance.⁹² In 2018, the BIS hosted two events on cyber resilience: a cybersecurity seminar attended by fifty central banks and monetary authorities and a five-day cyber range exercise in which cybersecurity professionals from fifteen central banks defended against attacks on simulated networks. From these events, the BIS learned that “to be truly effective against the common threat of cyber attack, central banks must work together.”⁹³ Shortly afterwards, the BIS created the CRCC to facilitate such collaboration.

The BIS’s CRCC is part of its Innovation BIS 2025 strategy, designed to facilitate collaboration on cyber resilience within the central bank community. According the BIS’s annual report, the CRCC will “offer cyber security seminars, technical training with hands-on cyber ranges similar to the one described above, and a secure platform to help build collaboration within the central bank community.” In a 2019 speech to regulators, the general manager of BIS, Agustín Carstens, explained that the CRCC will leverage its “trusted position within the central bank community” to provide four core services:

• Developing a cyber resilience self-assessment framework for central bank cyber security benchmarking
• Providing cyber range capability to provide hands-on cyber security training via scenarios that are fully customized for the financial sector
• Providing a secure collaboration platform for multilateral cyber threat information exchange, virtual access to cyber security personnel in other central banks, information technology investment discussions, and best practices in information sharing
• Collaborating closely with the Financial Stability Institute to assist in its delivery of cyber resilience publications and training as well as providing cyber security expertise in relation to emerging financial technology trends⁹⁴

The Financial Stability Institute, established jointly by the BIS and the BCBS, advances research through policy briefs, crisis exercises, and papers on effective cybersecurity and operational resilience practices, along with other financial policy topics.⁹⁵ The institute drives capacity-building for supervisors and regulators through four channels:

• Raising awareness around key developments in cyber resilience through a global series of high-level meetings
• Facilitating regional exchanges of experiences and best practices on cyber resilience and cyber risk between supervisors and regulators through regional expert meetings
• Developing online products and tutorials on the work of the international financial standard-setting bodies—the BCBS, IAIS, and CPMI-IOSCO—on cyber resilience
• Publishing research, policy briefs, and environmental scans on supervisory and regulatory developments in cybersecurity and cyber resilience in the financial sector

Because of their cost-effectiveness and scalability, online tutorials will be the focus for future efforts.⁹⁶

Industry’s Approach to Operational Resilience

The financial industry generally supports establishing a minimum level of operational resilience across the sector but wants to be involved in developing a regulatory approach that does not overly burden business. Because financial institutions do not view cybersecurity or operational resilience as competitive issues, the industry has developed a consensus-preferred approach: regulations that are simple, internationally harmonized, principles-based, and risk-based and that maximize resilience while minimizing risk. Industry has also launched its own initiatives, mostly in the United States, to advance operational resilience.

The financial industry primarily advocates for regulatory development and reform, including around operational resilience, through trade associations. Some trade associations, like the EBF, align closely with specific regional markets, whereas other trade associations, like the IIF and the GFMA, represent institutions from all over the world. On major issues, like operational resilience, trade associations coordinate to speak to regulators with a unified voice.

Industry has two primary concerns about the global regulatory approach to operational resilience. First, there is significant concern about regulatory fragmentation. In 2016, just as regulators had begun to explore operational resilience, a group of trade associations warned that “fragmentation would not only impede the flow of global capital and its contribution to economic growth, but also exacerbate the very risks regulators are trying to mitigate.”⁹⁷ In the United States, industry built the “Financial Sector Cybersecurity Profile” to help simplify compliance requirements.⁹⁸ According to the FSSCC website, “The Profile is a financial services sector-specific extension of the NIST Cybersecurity Framework (NIST CSF)—and other key guidance documents such as [those created by the International Organization for Standardization (ISO)] and CPMI-IOSCO—to better address the sector's regulatory environment.”⁹⁹ In Europe, the EBF has warned that “harmonization of regulatory requirements is a standing request of the European banking sector so as to facilitate compliance and avoid duplication and overlapping.”¹⁰⁰

To counter fragmentation, industry wants leadership from international financial organizations. For example, in response to the MAS’s proposed BCM guideline revisions, the Asia Securities Industry and Financial Markets Association (ASIFMA) recommended that regulatory requirements be driven by “G20, FSB and the Basel Committee.”¹⁰¹ Industry’s desire for harmonization also explains their advocacy of a common taxonomy and their support for the FSB’s cyber lexicon.

Second, industry is concerned about prescriptive requirements and maintains instead that regulators should adopt risk- and principles-based approaches. Trade associations argue that there is no “one-size-fits-all” approach and that regulations need to be proportional to the maturity and systemic importance of the firm. They consider risk- and principles-based approaches to be more future-proof, whereas prescriptive requirements may become irrelevant as technology changes.

In addition to consultation and advocacy with regulators, industry has established sector-led initiatives focused on operational resilience, primarily in the United States. Examples include FSARC and its UK counterpart FSCCC, Sheltered Harbor (a subsidiary of FS-ISAC focused on consumer banking), the Financial Sector Profile, and Quantum Dawn, a series of global sector-led cybersecurity exercises. These initiatives not only improve firms’ resilience but also signal to regulators that private sector interests align with those of the public and that future regulatory requirements need not be heavy-handed.

Specific Issues Worth Highlighting: Promising Opportunities, Urgent Topics, and Low-Hanging Fruit

FinCERTs

The ability to respond quickly and effectively to a cyber incident is fundamental to recovery and operational resilience. CERTS and CSIRTs specialize in response; they have been described as “digital fire brigades.”¹¹³

Over the last twenty years, an ecosystem of CERTs that specialize in responding to incidents in the financial system has emerged—some of which are explicitly called “FinCERTs.”¹¹⁴ FinCERTs specialize in responding to cyber incidents in financial networks, core banking systems, and payment systems. Most FinCERTs are operated by large banks to respond to incidents on their internal networks. Recently, financial regulators have begun establishing their own FinCERTs to respond to incidents within their jurisdiction. Figure 6 shows their existence around the globe.

In addition, many national CERTs and cybersecurity agencies operate substructures that specialize in financial sector cybersecurity. While the national-level CERTs and cybersecurity agencies are officially sector-agnostic, these substructures often fulfill the same function as that of a standalone FinCERT: facilitating information sharing, responding to cyber incidents, and building public-private trust.

However, the ecosystem of FinCERTs and national substructures is fragmented, and cooperation occurs on an ad hoc basis. There is no sector-wide coordinating body that connects FinCERTs across jurisdictions or bridges the public-private divide. (FS-ISAC is not a CERT since it does not perform incident response functions.¹¹⁵) Connecting the emerging system of FinCERTs will likely improve global responses to rising cyber threats to the financial system.

Mapping the FinCERT Ecosystem

While there is no sector-wide coordinating body for FinCERTs, two organizations—FIRST and the Task Force on Computer Security Incident Response Teams (TF-CSIRT)—provide global platforms with the “aim of sharing information among CSIRTs and assisting coordination during network-wide incidents.”¹¹⁶ Neither have operational functions, but most FinCERTs are members of one or both platforms.

Most FinCERTs can be categorized as either (1) CERTs operated by financial institution CERTs, or (2) CERTs operated by public financial authorities. A survey of the directories of FIRST and TF-CSIRT shows that there are at least sixty-eight FinCERTs operating today: thirteen are public, and fifty-five are private.

Public Sector FinCERTs

Governments have long been operating CERTs at the national level to respond to incidents that occur on government or commercial networks, including networks operated by the financial industry. The EU’s NIS Directive requires member states to establish national CSIRTs and supervise critical sectors like the financial sector.¹¹⁷ What is new is that central banks and ministries of finance are establishing their own FinCERTs to create specialized response and recovery capabilities for the financial sector. One advantage of housing a FinCERT within a financial regulatory body is increased authority to request information and data sharing from private financial institutions.¹¹⁸ Many, like Sri Lanka’s FinCERT, were established in collaboration with private financial institutions and trade associations.

Another example of a public-private FinCERT is the Italian CERTFin, which is led jointly by the Bank of Italy and the Italian Banking Association. Participation in CERTFin is open and any financial institution or service provider operating in Italy’s financial sector can opt in.

According to its mission statement, CERTFin’s main goals are:

• “To provide prompt information regarding potential cyber-threats that could damage banks and insurance organizations;
• To act as Point of Contact between financial operators and other relevant public institutions as far as cyber protection;
• To facilitate the response to large-scale security incidents;
• To support crisis management process in case of cyber incidents;
• To cooperate with national and international institutions and other actors, from both public and private sector, which are involved in cyber security, by promoting the cooperation among them; and,
• To improve cyber-security awareness and culture.”¹¹⁹

CERTFin coordinates incident response and acts primarily as an information gathering center for affected constituents. In the event of a major cyber incident, CERTFin also functions as a conduit between cybersecurity operators in the financial sector and the Italian national CERT through a dedicated escalation process. CERTFin also prioritizes operational cooperation and information sharing with other CERTs, considering such activity “of paramount importance.”¹²⁰

Europe has established the majority of FinCERTs. One standout example of multilateral cooperation is the Nordic Financial CERT, operated jointly by Sweden, Norway, Iceland, Denmark, and Finland. Efforts by the ENISA and TF-CSIRT to coordinate CERTs and CSIRTs across Europe may contribute to the culture of collaboration in the European CERT community.¹²¹ Additionally, the fact that the ECB has its established CSIRT-ECB may encourage national central banks to create their own.

Sheltered Harbor

Sheltered Harbor is designed to improve the resilience of and preserve public confidence in the U.S. financial system, specifically with respect to the integrity of financial data. It functions as a fail-safe to restore financial data for banks and customers in the event of a major disruption. The main idea is that should a financial institution be unable to recover quickly from a cyber incident, other financial firms could jump in and continue to provide service to affected customers by accessing the struggling firm’s standardized, backed-up account data through the Sheltered Harbor data vault.¹²⁷

Sheltered Harbor was conceptualized after the 2015 Hamilton Series showed financial institutions how damaging a major data loss or disruption would be to financial stability.¹²⁸ A group of thirty-four financial institutions, clearing houses, core processors, and industry associations came together in 2016 to create the initiative.¹²⁹ As of October 2018, Sheltered Harbor holds the data for 70 percent of U.S. deposit accounts and 55 percent of U.S. retail brokerage client assets.¹³⁰

Participation in Sheltered Harbor is voluntary; member institutions must pay minor dues and meet certain standards. In a public letter sent to financial CEOs in May 2019, six U.S. financial trade associations called for all financial institutions to join Sheltered Harbor, arguing that “implementing the Sheltered Harbor standard prepares institutions to provide customers timely access to balances and funds in such a worst-case scenario.”¹³¹

An excerpt from that public letter explains how Sheltered Harbor works:

Financial institutions back up critical customer account data each night in the Sheltered Harbor standard format, either managing their own secure data vault or using a participating service provider. The data vault is owned and managed by your institution, is unchangeable, and is completely separated from your institution’s infrastructure, including all backups. When your institution completes the requirements for data vaulting, you will be awarded Sheltered Harbor certification. This designation and accompanying seal communicate to key audiences, such as customers, industry peers, and regulatory agencies, that your critical customer account data [are] protected.¹³²

Regulators have received the private sector–led initiative well. For example, two U.S. regulators, the OCC and the FDIC, promoted Sheltered Harbor to financial institutions in a “Joint Statement on Heightened Cybersecurity Risk” following the U.S. killing of Iranian general Qasem Soleimani.¹³³ Additionally, the U.S. Federal Financial Institutions Examination Council included Sheltered Harbor in their 2019 “IT Examination Handbook” and 2018 “Cybersecurity Resource Guide for Financial Institutions.”¹³⁴

Exchanges and Other Financial Infrastructures

“Banks tend to have the loudest voice but governments need to focus more on exchanges.” Expert at Carnegie’s FinCyber Brainstorming Workshop in May 2020.

Financial infrastructures include FMIs (that is, payment systems, central securities depositories, securities settlement systems, central counterparties, and trade repositories), credit rating agencies, stock exchanges, securities settlement platforms, and any other service providers deemed critical for the functioning of the financial sector.¹³⁵ Their systemic importance in the financial system demands a high standard of resilience. For example, the first internationally agreed upon guidance on cyber resilience was about FMIs, published by CPMI-IOSCO in 2016. In 2019, the ECB published the CROE, which provides guidance to FMIs and supervisors regarding cyber resilience expectations.¹³⁶

Financial infrastructure operators do have unique concerns about operational resilience. For example, in comments to CPMI-IOSCO, the WFE raised concerns about a prescriptive recovery time of two hours. As Darrell Duffie and Joshua Younger explained, “the CPMI standard for the cyber resilience of financial market infrastructure is a two-hour recovery time, or ‘2hRTO,’ but this standard remains aspirational.”¹³⁷ There are also concerns about independent assurance of data integrity in the event of an incident: in order to independently assure data integrity, an FMI would need to establish a point of reliability loss, invalidate transactions submitted after that point, and return to the previous checkpoint. This also raises questions about whether and to what extent legal provisions around settlement finality may need to be updated.

Nevertheless, financial infrastructure operators seem broadly supportive of a regulatory approach based on operational resilience, and the interests of financial infrastructure operators typically align with those of other financial institutions. Resistant to prescriptive supervision and regulation, they advocate for proportionality, and they are concerned about the international harmonization of cybersecurity regulatory approaches. In a March 2020 response to the EC’s consultation, the WFE affirmed support for policymakers’ efforts “to enhance operational resilience,” but urged them to align new rules with existing ones, as this “would be helpful in quickly realising and implementing those common principles across an interconnected, global financial services industry.”¹³⁸ Financial infrastructures are built on consumer trust, so establishing a resilient financial system is also broadly in their interest. This is especially true given the evolving threat landscape in which financial infrastructures operate.

Threat Landscape for Exchanges and Clearing Houses

A 2013 survey by the WFE and IOSCO found that 53 percent of exchanges surveyed reported experiencing a cyber attack in the previous year and that 89 percent of respondents considered cyber crime in securities markets to be a systemic risk. The survey also found that attacks against exchanges tend to be disruptive rather than profit-driven.¹³⁹ This clearly differentiates exchanges from banks and other financial institutions: exchanges are focused on traders and corporate clients and do not hold personal accounts that can be targeted, as happens, for example, in carding. Instead, a DDoS campaign against the New Zealand Stock Exchange in August 2020 led to multiday disruptions of its operations and was a powerful reminder of the continued threat to, and importance of, exchanges for a country’s financial sector.¹⁴⁰

A string of successful profit-driven attacks—including one via the SWIFT network against the Bangladesh Bank in 2016; one against Mexico’s interbank payment network, SPEI, in 2018; and one against Banco de Chile in 2018 via international payment systems—have also focused attention on attacks against participants within financial payments systems.¹⁴¹ In 2018, SWIFT and BAE Systems examined potential threats to foreign exchange markets, securities markets, and trade finance markets. They found that:

The cyber threat is highest in the securities markets, particularly to its Participants. This is due to the large numbers of Participants and infrastructures in that market, the complexities of their interactions, and inherent characteristics such as long chains of custody, unstructured communications and trusted practices—all of which combine to provide opportunities for [Advanced Persistent Threat] groups to exploit.¹⁴²

Profit-driven attackers usually target low-hanging fruit in emerging financial markets, but this could change. As BAE analysts point out, attackers “might choose to attack foreign exchange markets, trade finance, securities and other areas, looking to make large gains in single intrusions or use persistent access to play the market over longer periods.”¹⁴³ Successful attacks against systemically important exchanges or clearing houses would be highly complex but highly profitable for malicious actors.

Politically motivated attacks that aim to disrupt exchanges and clearing houses may also pose a systemic risk to the financial system and could create market volatility, settlement issues, and trade inconsistencies. Disruptions to a systemically important exchange or clearing house could have cascading consequences for the larger financial system. Attacks that call into question the integrity of an exchange’s transactions or data could undermine trust in the financial system and require a great deal of time, effort, and funds to resolve.

Past examples of politically motivated disruptions include 2012 DDoS attacks against U.S. exchanges; a 2014 data breach involving the Warsaw Stock Exchange, reportedly carried out by a group affiliated with the self-proclaimed Islamic State; and 2019 DDoS attacks against Hong Kong Exchanges and Clearing Limited.¹⁴⁴

Third-Party Risk

Financial services firms increasingly rely on services and a complex digital supply chain provided by third parties. This trend has accelerated further during the coronavirus global pandemic as the financial sector transitioned to remote work and expanded digital services. Third-party risk, or outsourcing risk, is not a new concept to financial authorities and institutions. What is new is the degree of interdependent risk, the increasing complexity of that interdependence, and the number of actors involved in managing the risk. This growing interdependence can be exploited by malicious actors who, for example, may choose to target vulnerable third-party service providers with ransomware because the leverage gained by disrupting not only the service provider but also its dependent customers can make extortion more successful.

Financial authorities have traditionally managed third-party risk in the system by setting outsourcing requirements for financial institutions. However, concerns are growing that financial authorities do not have enough visibility or authority over certain third-party service providers, and that financial institutions are expected to manage risks in oligopolistic markets where they have less leverage to set the terms of service level agreements.

New regulation and guidance reflect these growing concerns. The MAS’s 2019 updates to its BCM guidelines raise the standards for financial institutions developing business continuity plans so that those plans better account for linkages with external service providers.¹⁴⁵ The BCBS has proposed “third party dependent management” as one of its core “principles for operational resilience.” Such approaches provide financial institutions with flexibility, and responsibility, to manage these outsourcing relationships. The EU may be going one step further with DORA, which proposes a framework that would enable “continuous monitoring of the activities of ICT third-party service providers that are critical providers to financial entities.”¹⁴⁶

The Cloud

The increasing reliance on cloud services has been highlighted during the coronavirus pandemic. According to a March 2020 Business Insider article, “projections of moving 55% of workloads to the cloud by 2022 (from 33% now) look conservative as these targets could be reached a full year ahead of expectations given this pace.”¹⁴⁷ Nasdaq, for example, has further accelerated its planned migration to the public cloud.¹⁴⁸ Cloud infrastructure also plays an important role for innovation as many start-ups, including in fintech, are “cloud native,” using cloud service providers from the start to avoid having to build (and pay for) their own IT infrastructure.

“A quarter of major banks’ activities and almost a third of all UK payments activity are already hosted on the Cloud, and there are considerable opportunities for even more intense usage.” Remarks by Mark Carney, Governor of the Bank of England, in June 2019.¹⁴⁹

When thinking about the risk implications of the cloud for the financial system, two different public policy problems are relevant: an existing public policy problem and an emerging one. The existing public policy problem is the rising cost of cyber attacks and the fact that most organizations—governments and companies—cannot effectively protect themselves. Very few organizations can rival the security teams of the large cloud service providers and they are therefore better off entrusting their security to teams at cloud service providers or other third-party service providers.¹⁵⁰ The emerging public policy problem is the concentration risk associated with such a centralized approach.

Lawmakers and financial supervisory authorities have grown increasingly concerned about the emerging risk associated with the growth of the cloud. In 2019, two members of the U.S. Congress urged the U.S. Department of the Treasury to designate the leading cloud service providers to the financial industry as systemically important.¹⁵¹ Financial authorities outside the United States increasingly lament their inability to assess risks associated with cloud service providers that are primarily located in the United States or China.

The current geopolitical landscape makes a multilaterally coordinated governance approach to cloud service providers highly unlikely. While such an arrangement would not be unprecedented (consider, for example, the SWIFT governance model), it is much more likely that a fragmented regulatory approach will emerge. This fragmentation will be characterized along two dimensions. In the first, fragmentation will emerge among jurisdictions as individual countries and small groups of like-minded countries create their own regulatory frameworks. In the second, fragmentation will emerge across sectors as individual sectors start to impose regulations affecting cloud service providers through, for example, third-party provisions.

Given the current climate, it is also difficult to envision a scenario where the United States or China would agree to a multilateral governance arrangement without being in the driver’s seat. After all, nearly all major cloud service providers are located in the United States and China. Although other countries will try to extend their own regulatory authority to cloud service providers, either reaching beyond their borders or forcing companies to store and process data locally, cloud service providers will likely behave like other firms have in the past. Depending on the market, they will either (a) comply with the regulation only for the largest and most important markets such as the United States, (b) communicate that they comply with other countries’ individual regulations de jure while de facto only using a few jurisdictions internally as benchmarks, or (c) decide to leave markets with overly onerous regulatory burdens or not to enter them in the first place.

In short, it is unlikely that a regulatory approach will effectively address the growing security concerns about cloud service providers in the near to medium term. The regulatory trend is overwhelmingly toward fragmentation and away from coherence, and this state of affairs is likely to continue for years. This raises the question: What can realistically be done to improve the security and resilience of cloud service providers within the next five years? The recommendations in this report focus on a few actionable measures that could help mitigate the risk independent of the broader governance questions.

Data Privacy, the GDPR, and Challenges to Information Sharing

Ensuring data privacy is fundamental to the operation of the financial ecosystem and the financial institutions therein. However, “data privacy” (the proper protection and handling of personal data) and “data security” (the protection of data from unauthorized access) are not the same. There has been some confusion as to whether recent data privacy regulation, in particular the EU’s GDPR, may have unintended consequences for cybersecurity in the financial system. Specifically, some are concerned that the GDPR’s protections of personal data could hamper cybersecurity threat information sharing.

For example, one legal assessment, produced in 2018 on behalf of FS-ISAC, concluded:

The exact impact of GDPR on international threat information sharing appears not fully understood. There should be no misunderstanding: threat information sharing, undertaken in a proper and controlled manner, is a lawful enterprise under GDPR. Article 6(1)(f) holds as lawful the processing of personal data that “is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject”, requiring protection of the personal data. The processing of personal data in threat information by FS-ISAC and its Members, as well as other ISACs, member organizations, and governmental entities meets this criteria.¹⁵²

Feedback from regulators and industry experts suggests that governments and regulators may need to provide further clarification so as to remove any doubt among financial institution’s legal counsels (including data protection officers) that could potentially undermine cybersecurity efforts. Confusion seems to exist specifically with respect to the sharing of potentially personal data (for example, IP addresses, email addresses, and related metadata), which are often linked to business email compromise, as well as with sharing profiles of malicious actors and anonymized tactics, techniques, and procedures.¹⁵³

This uncertainty and reluctance are not in the public interest as they can degrade a financial institution’s ability to protect against and respond to cyber attacks targeting systems and data under their care (including attacks on personal data, the protection of which is the key justification for the GDPR). Specifically, if financial institutions limit their information-sharing arrangements because of a perceived risk of incurring GDPR-related fines (and the subsequent reputational impact), it could undermine the cybersecurity not only of the institutions themselves but of the entire financial system. In Europe, initiatives like CIISI-EU have had to overcome such hurdles, often caused by participants’ legal counsels having a very narrow interpretation of the GDPR’s applicability in such cybersecurity arrangements.¹⁵⁴

Data protection regulations usually include specific reasons that can justify cybersecurity threat information sharing within the financial system. For example, GPDR justifies information sharing in cases of national security and the public interest.¹⁵⁵ However, without further clarification from governments that these justifications apply to cybersecurity threats, industry will opt to avoid risk more often than not.

EU member countries may choose to interpret the cybersecurity of their financial system as a national security issue under Part 2, Chapter 3 of the Data Protection Act 2018.¹⁵⁶ However, this measure is geared toward national cybersecurity and law enforcement authorities; embracing such an interpretation would run counter to the international and interdependent nature of the financial system. Treating financial cybersecurity as a national security issue may inhibit cross-border information sharing and undermine the cybersecurity of the EU’s digital single market and of the international financial system more broadly. Cybersecurity threat information sharing in the financial system may more appropriately fall under the public interest justification as outlined in Article 6 (1)(e) of the GDPR.¹⁵⁷ The public interest justification may not face the same potential barriers to cross-border sharing that face the national security justification.

Ultimately, it would be ironic if confusion about data protection regimes led the financial industry to reduce cybersecurity threat information sharing and resulted in weaker protections for personal data held in the purview of financial institutions. Since the GDPR is seen internationally as a leading model in data privacy and is used as a template for data protection regulations around the world, Europe has an opportunity to clarify this important issue and set an example that would help countries beyond Europe’s borders avoid this conflict in their own privacy frameworks.

Influence Operations and Deepfakes in the Context of the Financial System

Financial markets are shaped by their information environments. The internet has transformed how information flows through financial markets. This creates new ways for actors to manipulate information in financial markets for malign purposes—for example, through influence operations. The FSB’s consultative document “Effective Practices for Cyber Incident Response and Recovery” highlights the “sector-wide implications of a cyber incident, including any market confidence issues arising through, for example, social media, news media, and market reactions.”¹⁵⁸

Influence operations are the organized attempt to achieve a specific effect among a target audience.¹⁵⁹ They employ a variety of tactics, techniques, and messaging, including disinformation (the deliberate spreading of misleading or false information), astroturfing (creating the illusion of a grassroots movement), hack-and-leaks, and other cyber attacks.

Recent attention paid to influence operations has focused on the threat to political processes, especially elections, but little attention has been paid to how influence operations affect financial markets. Influence operations targeting financial markets are not new, and innovating technologies continue to empower their speed, scale, and scope. It is therefore prudent to examine whether and how modern influence operations could pose a threat to the financial system.

Influence operations that might threaten the financial sector can be broadly split into two categories based on target and aim: (1) operations that target a specific business, brand, or institution (mostly led by criminals and competition); and, (2) operations aimed at overall markets or a country (mostly led by nation-states and terrorist groups).

The first category of influence operations, those targeting individual firms, is generally profit-driven and carried out by individuals, criminal organizations, or lobbyists. Organized actors will spread fraudulent rumors to manipulate stock prices and generate profit based on how much the price of the stock was artificially moved. Firms and lobbyists use astroturfing campaigns, which create a false appearance of grassroots support, to tarnish the value of a competing brand or attempt to sway policymaking decisions by abusing calls for online public comments. Fortunately, while these operations might cause short-term financial harm, because they are precise in their targeting, they pose little systemic risk to the financial system.

The second category of influence operations, those aimed at the overall market, is rare and more challenging to carry out but may pose systemic risk, at least temporarily. Attacks in this category are likely to be carried out by a politically motivated actor like a terrorist group or even a nation-state. This type of influence operation may directly target the financial system to manipulate markets, for example, by spreading rumors about market-moving decisions by central banks. Alternatively, influence operations may aim to spread false information that does not directly reference financial markets but that causes financial markets to react. For example, the state-sponsored Syrian Electronic Army caused the U.S. stock market to briefly lose $136 billion in value by disseminating false news on Twitter in 2013 (see Figure 7).¹⁶⁰

It is important to note that not every part of an influence operation is malign. Operations may make use of a mix of social media and online advertising that then crosses over to mainstream media with the goal of spreading disinformation across these various platforms. In addition, the accidental spread of false or misleading information, even if not connected to an influence operation, should also be a concern.

The problem is that while organizations tend to be good at having playbooks, they are bad at organizing how to respond. A good indicator of an organization’s ability to respond quickly is the number of people required to review and sign off on a statement or tweet in response to an incident: an organization that needs clearance from multiple people will inevitably be less nimble. Another indicator is whether a playbook envisions a response only as a press statement or includes plans to respond across platforms; social media in particular requires repeated and persistent messaging to quickly counter any potential influence operation.

Notes

¹ G20 Finance Ministers and Central Bank Governors, “Communiqué,” March 17, 2017, Carnegie Endowment for International Peace, https://carnegieendowment.org/files/g20-communique.pdf.

² “FSB Publishes Stocktake on Cybersecurity Regulatory and Supervisory Practices,” October 13, 2017, https://www.fsb.org/2017/10/fsb-publishes-stocktake-on-cybersecurity-regulatory-and-supervisory-practices/.

³ “FSB Publishes Stocktake on Cybersecurity Regulatory and Supervisory Practices.”

⁴ GFMA and IIF, “Discussion Draft Principles Supporting the Strengthening of Operational Resilience Maturity in Financial Services,” October 2019, https://www.gfma.org/wp-content/uploads/2019/10/discussion-draft-iif-gfma-operational-resilience-principles-october-2019.pdf.

⁵ Bank of England, Financial Conduct Authority, and Prudential Regulatory Authority, “Building Operational Resilience: Impact Tolerances for Important Business Services.”

⁶ Davey Winder, “$645 Billion Cyber Risk Could Trigger Liquidity Crisis, ECB’s Lagarde Warns,” Forbes, accessed March 10, 2020, https://www.forbes.com/sites/daveywinder/2020/02/08/645-billion-cyber-risk-could-trigger-liquidity-crisis-ecbs-lagarde-warns/.

⁷ Art Lindo, “Oversight of Cyber Resilience in the Financial Regulatory System: Seminar for Senior Bank Supervisors from Emerging Economies,” October 25, 2019, http://pubdocs.worldbank.org/en/388141572546457065/Day-5-ArtLindo-FRB-CyberResilience.pdf.

⁸ G7 Finance Ministers and Central Bank Governors, “Press Release,” G7 Information Centre, University of Toronto, October 13, 2017, http://www.g7.utoronto.ca/finance/171013-cybercrime.html.

⁹ G7 Finance Ministers and Central Bank Governors, “Press Release,” G7 Information Centre, University of Toronto, October 13, 2017, http://www.g7.utoronto.ca/finance/171013-cybercrime.html.

¹⁰ Italian Ministry of the Economy and Finance, “The G7 Reaffirms Its Commitment to Strengthening Cybersecurity in the Financial Sector,” October 11, 2018, http://www.dt.mef.gov.it/en/news/2018/G7_cyber_security.html.

¹¹ Bank of Japan, “G-7 Fundamental Elements for Threat-Led Penetration Testing and Third Party Cyber Risk Management in the Financial Sector,” Press Release, October 15, 2018, https://www.boj.or.jp/en/announcements/release_2018/rel181015k.htm/.

¹² “Cybersecurity: Coordinating Efforts to Protect the Financial Sector in the Global Economy,” (conference, Banque de France and the French Ministry for the Economy and Finance, Paris, France, May 10, 2019), https://www.banque-france.fr/en/conferences-and-media/seminars-and-symposiums/research-conferences-and-symposiums/french-presidency-g7-2019-cybersecurity-coordinating-efforts-protect-financial-sector-global-economy.

¹³ Leigh Thomas, “G7 Countries to Simulate Cross-Border Cyber Attack Next Month: France,” Reuters, May 10, 2019, https://www.reuters.com/article/us-g7-france-cyber-idUSKCN1SG1KZ.

¹⁴ Jaime Vazquez and Martin Boer, “Addressing Regulatory Fragmentation to Support a Cyber-Resilience Global Financial Services Industry,” n.d., https://www.iif.com/portals/0/Files/private/iif_cyber_reg_04_25_2018_final.pdf.

¹⁵ GFMA and IIF, “Discussion Draft Principles Supporting the Strengthening of Operational Resilience Maturity in Financial Services.”

¹⁶ Marc Saidenberg, John Liver, and Eugene Goyne, “2020 Global Bank Regulatory Outlook: Four Major Themes Dominating the Regulatory Landscape in 2020,” EY, January 20, 2020, https://assets.ey.com/content/dam/ey-sites/ey-com/en_gl/topics/banking-and-capital-markets/ey-global-regulatory-outlook-four-major-themes-dominating-the-regulatory-landscape-in-2020_v2.pdf.

¹⁷ Bank of England and Financial Conduct Authority, “Building the UK Financial Sector’s Operational Resilience,” July 2018, https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/discussion-paper/2018/dp118.pdf.

¹⁸ “Building Operational Resilience: Impact Tolerances for Important Business Services,” Bank of England and Financial Conduct Authority, December 2019, https://www.bankofengland.co.uk/prudential-regulation/publication/2018/building-the-uk-financial-sectors-operational-resilience-discussion-paper.

¹⁹ “Building Operational Resilience: Impact Tolerances for Important Business Services.”

²⁰ Bank of England, “CBEST Implementation Guide,” Bank of England, 2016, https://www.bankofengland.co.uk/-/media/boe/files/financial-stability/financial-sector-continuity/cbest-implementation-guide.pdf.

²¹ Jeffrey Roman, “Bank of England Launches Cyber Framework,” BankInfoSecurity, June 10, 2014, https://www.bankinfosecurity.com/bank-england-launches-cyber-framework-a-6934.

²² Alex Hern, “Operation ‘Waking Shark II’ Tests the Ccybersecurity of Britain’s Banks,” Guardian, November 12, 2013, https://www.theguardian.com/technology/2013/nov/12/operation-waking-shark-ii-tests-cybersecurity-banks; Bank of England, “Sector Simulation Exercise: SIMEX 2018 Report,” September 27, 2019, https://www.bankofengland.co.uk/report/2019/sector-simulation-exercise-simex-2018-report.

²³ David Milliken, “U.S. and UK to Test Financial Cyber-Security Later This Month,” Reuters, November 2, 2015, https://www.reuters.com/article/us-britain-usa-cybersecurity-idUSKCN0SR1DW20151102.

²⁴ SIFMA, “Cybersecurity Exercise: Quantum Dawn V,” February 28, 2020, https://www.sifma.org/resources/general/cybersecurity-exercise-quantum-dawn-v/.

²⁵ National Cyber Security Centre, “Cyber Security Information Sharing Partnership (CiSP),” September 2016, https://www.ncsc.gov.uk/information/cyber-security-information-sharing-partnership--cisp-.

²⁶ Andrew Gracie, “Cyber in Context,” Speech at the UK Financial Services Cyber Security Summit, London, July 2015, https://www.bankofengland.co.uk/-/media/boe/files/speech/2015/cyber-in-context.pdf.

²⁷ Stephen Jones, “A Resilient Banking Sector,” UK Finance, December 7, 2018, https://www.ukfinance.org.uk/blogs/resilient-banking-sector.

²⁸ Bank for International Settlements (BIS), “Cyber Resilience: Range of Practices,” December 2018, https://www.bis.org/bcbs/publ/d454.pdf.

²⁹ European Commission, “Executive Summary of the Impact Assessment Accompanying the Document: Proposal for a Regulation of the European Parliament and of the Council on Digital Operational Resilience for the Financial Sector,” Commission Staff Working Document, September 24, 2020, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=SWD:2020:199:FIN.

³⁰ The ESAs are the European Banking Authority, the European Securities and Markets Authority (ESMA) and the European Insurance and Occupational Pensions Authority (EIOPA). European Commission, “FinTech Action Plan: For a More Competitive and Innovative European Financial Sector,” March 2018, https://ec.europa.eu/info/publications/180308-action-plan-fintech_en.

³¹ European Supervisory Authorities, “Joint Advice of the European Supervisory Authorities,” April 10, 2019, https://www.esma.europa.eu/sites/default/files/library/jc_2019_26_joint_esas_advice_on_ict_legislative_improvements.pdf.

³² European Banking Authority, “EBA Guidelines on ICT and Security Risk Management,” November 28, 2019, https://eba.europa.eu/eba-publishes-guidelines-ict-and-security-risk-management.

³³ European Banking Authority, “EBA Guidelines on ICT and Security Risk Management,” November 28, 2019, https://eba.europa.eu/eba-publishes-guidelines-ict-and-security-risk-management.

³⁴ European Banking Authority, “Guidelines on Outsourcing Arrangements,” June 5, 2019, https://eba.europa.eu/regulation-and-policy/internal-governance/guidelines-on-outsourcing-arrangements.

³⁵ European Commission, “Consultation Document: Digital Operational Resilience Framework for Financial Services: Making the EU Financial Sector More Secure,” December 2019, https://ec.europa.eu/info/sites/info/files/business_economy_euro/banking_and_finance/documents/2019-financial-services-digital-resilience-consultation-document_en.pdf.

³⁶ European Commission, “Consultation Document: Digital Operational Resilience Framework for Financial Services: Making the EU Financial Sector More Secure.”

³⁷ European Banking Federation, “Digital Operational Resilience Framework: EBF Key Messages on the Commission Consultation,” April 6, 2020, https://www.ebf.eu/cybersecurity/ebf-key-messages-on-the-commission-consultation-on-a-digital-operational-resilience-framework/.

³⁸ European Commission, “Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on a Digital Finance Strategy for the EU,” September 24, 2020, https://ec.europa.eu/transparency/regdoc/rep/1/2020/EN/COM-2020-591-F1-EN-MAIN-PART-1.PDF.

³⁹ European Commission, “Executive Summary of the Impact Assessment Accompanying the Document: Proposal for a Regulation of the European Parliament and of the Council on Digital Operational Resilience for the Financial Sector,” Commission Staff Working Document, September 24, 2020, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=SWD:2020:199:FIN.

⁴⁰ European Commission, “Executive Summary of the Impact Assessment Accompanying the Document: Proposal for a Regulation of the European Parliament and of the Council on Digital Operational Resilience for the Financial Sector,” Commission Staff Working Document, September 24, 2020, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=SWD:2020:199:FIN.

⁴¹ European Banking Authority, “EBA Guidelines on ICT and Security Risk Management.”

⁴² European Commission, “Executive Summary of the Impact Assessment Accompanying the Document: Proposal for a Regulation of the European Parliament and of the Council on Digital Operational Resilience for the Financial Sector,” Commission Staff Working Document, September 24, 2020, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=SWD:2020:199:FIN.

⁴³ Euro Cyber Resilience Board Secretariat, “Cyber Information and Intelligence Sharing: A Practical Example,” Cyber Information Sharing and Intelligence Sharing Initiative, European Central Bank, September 2020, https://www.ecb.europa.eu/paym/groups/euro-cyber-board/shared/pdf/ciisi-eu_practical_example.pdf.

⁴⁴ Euro Cyber Resilience Board Secretariat, “Cyber Information and Intelligence Sharing: Community Rulebook,” Cyber Information Sharing and Intelligence Sharing Initiative, European Central Bank, August 2020, https://www.ecb.europa.eu/paym/groups/euro-cyber-board/shared/pdf/ciisi-eu_community_rulebook.pdf

⁴⁵ EU member states currently implementing TIBER-EU: Belgium, Denmark, Finland, Germany, Ireland, Italy, Norway, Romania, Sweden, and the Netherlands.

⁴⁶ Weuro Jaakko, “Resilience of Financial Market Infrastructure and the Role of the Financial Sector in Countering Hybrid Threats,” Presidency Issues Note for the Informal ECOFIN Working Session, September 9, 2019, https://eu2019.fi/documents/11707387/15400298/Hybrid+Threats+Informal+ECOFIN+final+Issues+Note+2019-09-09_S2.pdf/29565728-f476-cbdd-4c5f-7e0ec970c6c4/Hybrid+Threats+Informal+ECOFIN+final+Issues+Note+2019-09-09_S2.pdf.

⁴⁷ Based on written input received from officials at Singapore’s Cyber Security Agency and the Monetary Authority of Singapore on October 16, 2020.

⁴⁸ Aquiles A. Almansi and Yejin Carol Lee, “Financial Sector’s Cybersecurity: A Regulatory Digest,” World Bank Group, Financial Sector Advisory Center, November 2019, http://pubdocs.worldbank.org/en/940481575300835196/CybersecDIGEST-NOV2019-FINAL.pdf.

⁴⁹ Monetary Authority of Singapore, “Technology Risk Management Guidelines,” Consultation Paper, March 2019, https://www.mas.gov.sg/-/media/Consultation-Paper-on-Proposed-Revisions-to-Technology-Risk-Management-Guidelines.pdf.

⁵⁰ “Consultation Paper on Proposed Revisions to Business Continuity Management Guidelines,” Monetary Authority of Singapore, March 2019, https://www.mas.gov.sg/-/media/MAS/News-and-Publications/Consultation-Papers/Consultation-Paper-on-Proposed-Revisions-to-Business-Continuity-Management-Guidelines.pdf.

⁵¹ “Minutes of the Federal Open Market Committee” (U.S. Federal Reserve System, January 28, 2020), https://www.federalreserve.gov/monetarypolicy/files/fomcminutes20200129.pdf.

⁵² FS-ISAC, “FS-ISAC & MAS to Strengthen Cyber Info Sharing Across Nine Countries,” Press Release, November 14, 2017, https://www.fsisac.com/newsroom/fs-isac-and-mas-to-strengthen-cyber-information-sharing-across-nine-countries.

⁵³ FS-ISAC, “FS-ISAC Launches the Ceres Forum: World’s Premier Threat Information Sharing Group for Central Banks,” Reston, Virginia and Singapore, June 11, 2018, https://www.fsisac.com/newsroom/fs-isac-launches-the-ceres-forum-worlds-premier-threat-information-sharing-group-for-central-banks-regulators-and-supervisors; CSA Singapore, “11 CII Sectors Tested on More Complex Cyber Attack Scenarios,” September 4, 2019, https://www.csa.gov.sg/news/press-releases/exercise-cyber-star-2019.

⁵⁴ Federal Reserve System, “Enhanced Cyber Risk Management Standards,” Advance Notice of Proposed Rulemaking, Fall 2019, 7100-AE61, Office of Information and Regulatory Affairs, OMB, https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201910&RIN=7100-AE61.

⁵⁵ Robert Armstrong, Kiran Stacey, and Laura Noonan, “US Banks Face Tighter Scrutiny of Cyber Defences,” Financial Times, June 17, 2019, https://www.ft.com/content/69a25232-8eaa-11e9-a1c1-51bf8f989972.

⁵⁶ Federal Reserve System, “Enhanced Cyber Risk Management Standards,” Advance Notice of Proposed Rulemaking, Fall 2019, 7100-AE61, Office of Information and Regulatory Affairs, OMB, https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=201910&RIN=7100-AE61.

⁵⁷ Randal Quarles, “Speech by Vice Chairman for Supervision Quarles on the Financial Regulatory System and Cybersecurity,” Board of Governors of the Federal Reserve System, February 2018, https://www.federalreserve.gov/newsevents/speech/quarles20180226b.htm.

⁵⁸ Randal Quarles, “Speech by Vice Chairman for Supervision Quarles on the Financial Regulatory System and Cybersecurity,” Board of Governors of the Federal Reserve System, February 2018, https://www.federalreserve.gov/newsevents/speech/quarles20180226b.htm.

⁵⁹ Robert Armstrong, Kiran Stacey, and Laura Noonan, “US Banks Face Tighter Scrutiny of Cyber Defences,” Financial Times, June 17, 2019, https://www.ft.com/content/69a25232-8eaa-11e9-a1c1-51bf8f989972.

⁶⁰ Art Lindo, “Oversight of Cyber Resilience in the Financial Regulatory System: Seminar for Senior Bank Supervisors from Emerging Economies.”

⁶¹ Board of Governors of the Federal Reserve System, “Strategic Plan 2020–23, December 2019,” 2019, 20.

⁶² “Minutes of the Federal Open Market Committee” (U.S. Federal Reserve System, January 28, 2020), https://www.federalreserve.gov/monetarypolicy/files/fomcminutes20200129.pdf.

⁶³ New York State Department of Financial Services, “NYDFS 23 NYCRR 500,” 2017, https://www.dfs.ny.gov/docs/legal/regulations/adoptions/dfsrf500txt.pdf.

⁶⁴ Aquiles A. Almansi and Yejin Carol Lee, “Financial Sector’s Cybersecurity: A Regulatory Digest,” World Bank Group, Financial Sector Advisory Center, July 2020, http://pubdocs.worldbank.org/en/361881595872293851/CybersecDigest-v5-Jul2020-FINAL.pdf.

⁶⁵ Aquiles A. Almansi and Yejin Carol Lee, “Financial Sector’s Cybersecurity: A Regulatory Digest,” World Bank Group, Financial Sector Advisory Center, July 2020, http://pubdocs.worldbank.org/en/361881595872293851/CybersecDigest-v5-Jul2020-FINAL.pdf.

⁶⁶ Institute for Development and Research in Banking Technology, “Indian Banks—Center for Analysis of Risks and Threats (IB-CART),” last modified September 30, 2020, https://www.idrbt.ac.in/ib-cart.html.

⁶⁷ Institute for Development and Research in Banking Technology, “Indian Banks—Center for Analysis of Risks and Threats (IB-CART),” last modified September 30, 2020, https://www.idrbt.ac.in/ib-cart.html.

⁶⁸ Reserve Bank of India, “Financial Stability Report,” July 2020, https://www.rbi.org.in/Scripts/FsReports.aspx.

⁶⁹ “Cyber Threats Against Banking Industry on the Rise in post Covid-19 Lockdown Phase, says RBI,” Hindu Business Line, https://www.thehindubusinessline.com/money-and-banking/cyber-threats-against-banking-industry-on-the-rise-in-post-covid-19-lockdown-phase-says-rbi/article32201404.ece.

⁷⁰ Reserve Bank of India, “Financial Stability Report,” July 2020, https://www.rbi.org.in/Scripts/FsReports.aspx.

⁷¹ “CBI to Set Up Cyber-Crime Investigation Branch in Mumbai,” Business Standard, March 1, 2016, https://www.business-standard.com/article/news-ians/cbi-to-set-up-cyber-crime-investigation-branch-in-mumbai-116030100949_1.html.

⁷²Rajeev Jayaswal, “Govt Plans Cyber Security System for Financial Sector,” Hindustan Times, August 18, 2020, https://www.hindustantimes.com/india-news/govt-plans-cyber-security-system/story-bHRwwBeFVGLIrA3VMmOaDO.html.

⁷³ Bank of England, Financial Conduct Authority, and Prudential Regulatory Authority, “Building Operational Resilience: Impact Tolerances for Important Business Services.”

⁷⁴ European Banking Authority, “EBA Guidelines on ICT and Security Risk Management,” https://eba.europa.eu/regulation-and-policy/internal-governance/guidelines-on-ict-and-security-risk-management.

⁷⁵ “Consultation Paper on Proposed Revisions to Business Continuity Management Guidelines,” Monetary Authority of Singapore, March 2019, https://www.mas.gov.sg/-/media/MAS/News-and-Publications/Consultation-Papers/Consultation-Paper-on-Proposed-Revisions-to-Business-Continuity-Management-Guidelines.pdf.

⁷⁶ Art Lindo, “Oversight of Cyber Resilience in the Financial Regulatory System: Seminar for Senior Bank Supervisors from Emerging Economies.”

⁷⁷ Global Financial Markets Association, “Response to Bank of England and FCA Discussion Paper on ‘Building the UK Financial Sector’s Operational Resilience,’” October 2018, https://www.afme.eu/portals/0/globalassets/downloads/consultation-responses/tao-gfma-response-to-bank-of-england-fca-building-uk-financial-resilience-5-oct-2018.pdf.

⁷⁸ International Organization of Securities Commissions, “About CPMI-IOSCO,” accessed July 20, 2020, https://www.iosco.org/about/?subsection=cpmi_iosco.

⁷⁹ Committee on Payments and Market Infrastructures and The Board of the International Organization of Securities Commissions, “Guidance on Cyber Resilience for Financial Market Infrastructures.”

⁸⁰ Committee on Payments and Market Infrastructures and The Board of the International Organization of Securities Commissions, “Guidance on Cyber Resilience for Financial Market Infrastructures.”

⁸¹ The Board of the International Organization of Securities Commissions, “Cyber Task Force Final Report,” June 2019, https://www.iosco.org/library/pubdocs/pdf/IOSCOPD633.pdf.

⁸² Committee on Payments and Market Infrastructures, “Reducing the Risk of Wholesale Payments Fraud Related to Endpoint Security,” Bank for International Settlements, May 8, 2018, 178, https://www.bis.org/cpmi/publ/d178.htm.

⁸³ “FSB Publishes Stocktake on Cybersecurity Regulatory and Supervisory Practices,” October 13, 2017, https://www.fsb.org/2017/10/fsb-publishes-stocktake-on-cybersecurity-regulatory-and-supervisory-practices/.

⁸⁴ Financial Stability Board, “Summary Report on Financial Sector Cybersecurity Regulations, Guidance and Supervisory Practices,” October 13, 2017, https://www.fsb.org/2017/10/summary-report-on-financial-sector-cybersecurity-regulations-guidance-and-supervisory-practices/.

⁸⁵ Financial Stability Board, “FSB Publishes Stocktake on Cybersecurity Regulatory and Supervisory Practices,” press release, October 13, 2017, https://www.fsb.org/2017/10/fsb-publishes-stocktake-on-cybersecurity-regulatory-and-supervisory-practices/.

⁸⁶ Financial Stability Board, “Effective Practices for Cyber Incident Response and Recovery: Consultative Document,” April 20, 2020, https://www.fsb.org/2020/04/effective-practices-for-cyber-incident-response-and-recovery-consultative-document/.

⁸⁷ Aquiles A. Almansi and Yejin Carol Lee, “Financial Sector’s Cybersecurity: A Regulatory Digest,” World Bank Group, Financial Sector Advisory Center, November 2019, http://pubdocs.worldbank.org/en/940481575300835196/CybersecDIGEST-NOV2019-FINAL.pdf.

⁸⁸ Basel Committee on Banking Supervision, “Consultative Document: Principles for Operational Resilience,” August 2020, https://www.bis.org/bcbs/publ/d509.pdf.

⁸⁹ Basel Committee on Banking Supervision, “Consultative Document: Principles for Operational Resilience,” August 2020, https://www.bis.org/bcbs/publ/d509.pdf.

⁹⁰ Bank for International Settlements (BIS), “Cyber Resilience: Range of Practices,” December 2018, https://www.bis.org/bcbs/publ/d454.pdf.

⁹¹ Committee on Payments and Market Infrastructures, “Payment, Clearing and Settlement Operators Meet on Global Cyber-Resilience,” Press Release, September 14, 2018, https://www.bis.org/press/p180914.htm.

⁹² Committee on Payments and Market Infrastructures and The Board of the International Organization of Securities Commissions, “Guidance on Cyber Resilience for Financial Market Infrastructures,” Bank for International Settlements, 2016, http://www.bis.org/cpmi/publ/d138.htm.

⁹³ Bank for International Settlements, “BIS Annual Report 2018/2019,” 2019, https://www.bis.org/about/areport/areport2019.pdf#bis2025.

⁹⁴ Agustin Carstens, “The New BIS Strategy—Bringing the Americas and Basel Closer Together” (Speech, Fourteenth ASBA-BCBS-FSI High-level Meeting on Global and Regional Supervisory Priorities, Lima, 1 October 2019), https://www.bis.org/speeches/sp191001.htm.

⁹⁵ Bank for International Settlements, “FSI Publications,” https://www.bis.org/fsi/publications.htm?m=1%7C17%7C161.

⁹⁶ Senior officials at the Financial Stability Institute in written correspondence with the authors, May 2020.

⁹⁷ European Banking Federation, Global Financial Markets Association, and International Swaps and Derivatives Association, “International Cybersecurity, Data and Technology Principles,” letter, May 2016, https://www.gfma.org/wp-content/uploads/0/83/197/211/13187d1e-077f-43c5-85a1-1da370608a2b.pdf.

⁹⁸ Financial Services Sector Coordinating Council, “The Financial Services Sector Cybersecurity Profile,” October 25, 2018, https://fsscc.org/files/galleries/Financial_Services_Sector_Cybersecurity_Profile_Overview_and_User_Guide_2018-10-25.pdf.

⁹⁹ Financial Services Sector Coordinating Council, “The Financial Services Sector Cybersecurity Profile,” October 25, 2018, https://fsscc.org/files/galleries/Financial_Services_Sector_Cybersecurity_Profile_Overview_and_User_Guide_2018-10-25.pdf.

¹⁰⁰ European Banking Authority, “EBF Response to the EBA Guidelines on ICT and Security Risk Management,” accessed July 20, 2020, https://eba.europa.eu/node/82021/submission/62742.

¹⁰¹ Asia Securities Industry & Financial Markets Association (ASIFMA), “Response to Consultation Paper: Proposed Revisions to Guidelines on Business Continuity Management,” April 2019, https://www.asifma.org/wp-content/uploads/2019/04/final-asifma-response-to-mas-consultation-paper-on-guidelines-on-business-continuity-management.pdf.

¹⁰² SIFMA, “Quantum Dawn V Fact Sheet,” accessed January 5, 2020, https://www.sifma.org/wp-content/uploads/2019/11/QuantumDawnV-Factsheet_2019.pdf.

¹⁰³ FS-ISAC, “FS-ISAC Upcoming Events, Summits, Webinars and Exercises,” accessed July 20, 2020, https://www.fsisac.com/events.

¹⁰⁴ Chris Keeling, “Waking Shark II Desktop Cyber Exercise: Report to Participants,” November 12, 2013, https://www.bba.org.uk/wp-content/uploads/2014/02/Banking_3192106_v_1_Waking-Shark-II-Report-v1.pdf.pdf.

¹⁰⁵ Bank of England, “Sector Simulation Exercise: SIMEX 2018 Report,” September 27, 2019, https://www.bankofengland.co.uk/report/2019/sector-simulation-exercise-simex-2018-report.

¹⁰⁶ Shaun Waterman, “Bank Regulators Briefed on Treasury-Led Cyber Drill,” FedScoop, July 20, 2016, https://www.fedscoop.com/us-treasury-cybersecurity-drill-july-2016/.

¹⁰⁷ Financial Services Information Sharing and Analysis Center, “Exercises Overview,” accessed July 20, 2020, https://www.fsisac.com/hubfs/Resources/FS-ISAC_ExercisesOverview.pdf.

¹⁰⁸ David Milliken, “U.S. and UK to Test Financial Cyber-Security Later This Month,” Reuters, November 2, 2015, https://www.reuters.com/article/us-britain-usa-cybersecurity-idUSKCN0SR1DW20151102.

¹⁰⁹ European Central Bank, “UNITAS Crisis Communication Exercise Report,” December 2018, https://www.ecb.europa.eu/pub/pdf/other/ecb.unitasreport201812.en.pdf.

¹¹⁰ Leigh Thomas, “G7 Countries to Simulate Cross-Border Cyber Attack next Month: France,” Reuters, May 10, 2019, https://www.reuters.com/article/us-g7-france-cyber-idUSKCN1SG1KZ.

¹¹¹ Leigh Thomas, “G7 Countries to Simulate Cross-Border Cyber Attack next Month: France,” Reuters, May 10, 2019, https://www.reuters.com/article/us-g7-france-cyber-idUSKCN1SG1KZ.

¹¹² UK National Cyber Security Centre, “Exercise in a Box,” 2019, https://exerciseinabox.service.ncsc.gov.uk/

¹¹³ Isabel Skierka et al., “CSIRT Basics for Policy-Makers: The History, Types & Culture of Computer Security Incident Response Teams,” Working Paper, New America and Global Public Policy Institute, May 2015, https://static.newamerica.org/attachments/2943-csirt-basics-for-policy-makers/CSIRT%20Basics%20for%20Policy-Makers%20May%202015%20WEB%2009-15.16efa7bcc9e54fe299ba3447a5b7d41e.pdf.

¹¹⁴ GEANT, “TF-CSIRT: Computer Security Incident Response Teams—GÉANT,” accessed July 20, 2020, https://www.geant.org:443/People/Community_Programme/Task_Forces/Pages/TF-CSIRT.aspx.

¹¹⁵ Isabel Skierka et al., “CSIRT Basics for Policy-Makers: The History, Types & Culture of Computer Security Incident Response Teams,” Working Paper, New America and Global Public Policy Institute, May 2015, https://static.newamerica.org/attachments/2943-csirt-basics-for-policy-makers/CSIRT%20Basics%20for%20Policy-Makers%20May%202015%20WEB%2009-15.16efa7bcc9e54fe299ba3447a5b7d41e.pdf.

¹¹⁶ Robert Morgus et al., “National CSIRTs and Their Role in Computer Security Incident Response,” New America and Global Public Policy Institute, November 2015, https://d1y8sb8igg2f8e.cloudfront.net/documents/CSIRTs-incident-response.pdf.

¹¹⁷ European Union Agency for Cybersecurity, “NIS Directive Details,” https://www.enisa.europa.eu/topics/nis-directive. Accessed September 26, 2020.

¹¹⁸ “FC3—Finance and Cyber Continuity Center: Israel’s National Financial CERT,” senior officials from the Israeli Ministry of Finance in written correspondence with the authors, April 16, 2020.

¹¹⁹ CERTFin, “CERT Finanziario Italiano (CERTFIN) - RFC 2350,” Bank of Italy, https://www.certfin.it/media/pdf/rfc2350.pdf. Accessed September 26, 2020.

¹²⁰ CERTFin, “CERT Finanziario Italiano (CERTFIN) - RFC 2350,” Bank of Italy, https://www.certfin.it/media/pdf/rfc2350.pdf. Accessed September 26, 2020.

¹²¹ GEANT, “TF-CSIRT: Computer Security Incident Response Teams - GÉANT,” accessed July 20, 2020, https://www.geant.org:443/People/Community_Programme/Task_Forces/Pages/TF-CSIRT.aspx.

¹²² Finance and Cyber Continuity Center, “FC3—Finance and Cyber Continuity Center: Israel’s National Financial CERT,” April 16, 2020.

¹²³ “FC3—Finance and Cyber Continuity Center: Israel’s National Financial CERT,” senior officials from the Israeli Ministry of Finance in written correspondence with the authors, April 16, 2020.

¹²⁴ “FC3—Finance and Cyber Continuity Center: Israel’s National Financial CERT,” senior officials from the Israeli Ministry of Finance in written correspondence with the authors, April 16, 2020.

¹²⁵ “FC3—Finance and Cyber Continuity Center: Israel’s National Financial CERT,” senior officials from the Israeli Ministry of Finance in written correspondence with the authors, April 16, 2020.

¹²⁶ “FC3—Finance and Cyber Continuity Center: Israel’s National Financial CERT,” senior officials from the Israeli Ministry of Finance in written correspondence with the authors, April 16, 2020.

¹²⁷ Brian F. Tivnan, “Financial System Mapping,” November 7, 2018, https://www.mitre.org/publications/technical-papers/financial-system-mapping.

¹²⁸ Telis Demos, “Banks Build Line of Defense for Doomsday Cyberattack,” Wall Street Journal, December 3, 2017, https://www.wsj.com/articles/banks-build-line-of-defense-for-doomsday-cyberattack-1512302401.

¹²⁹ Sheltered Harbor, “Sheltered Harbor - About,” accessed July 20, 2020, https://shelteredharbor.org/index.php/about#who.

¹³⁰ Stacy Cowley, “Banks Adopt Military-Style Tactics to Fight Cybercrime,” New York Times, May 20, 2018, https://www.nytimes.com/2018/05/20/business/banks-cyber-security-military.html.

¹³¹ Rob Nichols, Gregory Baer, Jim Nussle, Kevin Fromer, Steven Silberstein, and Kenneth Bentsen to Financial Institution CEOs, May 14, 2019, https://www.shelteredharbor.org/images/SH/Docs/Sheltered_Harbor_Trade_Assn_Exec_Letter_Genericfinal_051619.pdf.

¹³² Rob Nichols, Gregory Baer, Jim Nussle, Kevin Fromer, Steven Silberstein, and Kenneth Bentsen to Financial Institution CEOs, May 14, 2019, https://www.shelteredharbor.org/images/SH/Docs/Sheltered_Harbor_Trade_Assn_Exec_Letter_Genericfinal_051619.pdf.

¹³³ Federal Deposit Insurance Corporation and Office of the Comptroller of the Currency, “Joint Statement on Heightened Cybersecurity Risk,” January 16, 2020, https://occ.gov/news-issuances/bulletins/2020/bulletin-2020-5a.pdf.

¹³⁴ U.S. Federal Financial Institutions Examination Council, “Cybersecurity Resource Guide for Financial Institutions,” October 2018, https://www.ffiec.gov/press/pdf/FFIEC%20Cybersecurity%20Resource%20Guide%20for%20Financial%20Institutions.pdf.

¹³⁵ For the purposes of this section, exchanges refer to those that operate in a regulated and secure market, and are distinct from “cryptocurrency exchanges.”

¹³⁶ European Central Bank, “Cyber Resilience Oversight Expectations for Financial Market Infrastructures,” December 2018, https://www.ecb.europa.eu/paym/pdf/cons/cyberresilience/Cyber_resilience_oversight_expectations_for_financial_market_infrastructures.pdf.

¹³⁷ Darrell Duffie and Joshua Younger, “Cyber Runs: How a Cyber Attack Could Affect U.S. Financial Institutions,” Hutchins Center on Fiscal and Monetary Policy, Brookings Institution, June 2019, https://www.brookings.edu/research/cyber-runs/.

¹³⁸ World Federation of Exchanges, “WFE Response to the EU Commission’s Digital Operational Resilience Framework for Financial Services: Making the EU Financial Sector More Secure,” March 2020, https://www.world-exchanges.org/storage/app/media/regulatory-affairs/WFE%20response%20EU%20Consultation%20Digital%20Resilience%20FINAL.pdf.

¹³⁹ Rohini Tendulkar, “Cyber-Crime, Securities Markets, and Systemic Risk,” Joint Staff Working Paper of the IOSCO Research Department and World Federation of Exchanges, July 2013, https://www.world-exchanges.org/storage/app/media/research/Studies_Reports/2013-cyber-crime-securities-markets-amp-systemic-risk.pdf.

¹⁴⁰ Rob Stock, “Five Eyes cybersecurity Agencies Will Be Involved i