29 November 2018
Deputy Governor Rannveig Sigurðardóttir. Introductory remarks
at the 2nd Annual Nordic Cyber in Finance Conference, Helsinki,
29 November 2018
Let me begin by saying that this conference is both timely and
interesting for me, as I have only been in office for five months. Given
that I come from the monetary policy department at the Central Bank
of Iceland, cybersecurity has not been much on my agenda until now.
It is, nonetheless, a very important topic. The Central Bank of Iceland,
and other central banks are facing several new challenges in this area,
both in the financial sector generally and central banking more
specifically.
Last week I attended an interesting macroprudential policy conference
at Danmarks Nationalbank. The discussion paper prepared for that
While the sun is shining, prepare for a rainy
conference was called day.
Sitting there, I pondered what the discussion paper for this conference
-
today might be called. Perhaps something like The snowstorm is here
what do we wear?
Cybercrime is now the world's
fastest-growing type of crime. It has
shot up to second place on the list of the top ten business risks
worldwide, after not even making the list five years ago. The financial
sector is particularly important because it greases the wheels of our
economies, and cyber risks pose mounting threats to the financial
system.
Developments since the emergence of the internet show that new
technologies have brought with them new challenges. We only need to
think of robotics, artificial intelligence, blockchains, and smart phones
with 5G Wi-Fi to realize the extent of the changes that lie ahead for
financial services.
New technologies also bring opportunities. The Austrian economist,
Finance Minister, and banker Joseph Schumpeter demonstrated in the
1920s that successive waves of technological change raise productivity,
income, and living standards. However, we know from long experience
that technological change often results in costs involving new risks that
must be addressed in order to optimise the net benefit. So while FinTech
consumers' range of choices in financial intermediation, it
will broaden
also brings new risks, both to the security of transactions and to privacy.
To maintain financial stability and real economic activity, we need
payment and settlement systems that are secure. As a result,
cybersecurity has moved from being a technical issue to a central bank
issue. That is why the Nordic central banks have set up this forum for
discussion and cooperation so as to foster closer cooperation on cyber
resilience and cybersecurity. Today the focus is on financial market
infrastructure.
One of the questions being asked in this section of the conference is,
"What challenges are likely to emerge with new operating models and
new actors in the financial sector?"
As I said before, the FinTech
snowstorm is already here. The newest challenge with respect to
cybersecurity is the emergence of new players offering financial
services, some of whom have not provided financial services before.
The question therefore becomes: What technology are they using? Is it
established, or is it new and unknown technology?
We also know that attitudes towards security and operational risk are
important. But with tech firms rushing to offer new products to the
market, there is the risk of insufficient emphasis on security. This is a
-
risk that must be monitored not only for new products or for new
players, but also for incumbent businesses.
Tech giants like Google, Apple, and Alibaba look set to become
dominant players. Their advantage comes from providing cross-border
services and having already gathered significant information about
users. They are already present in the Nordic marketplace. This
development may lean towards monopolies, as it can create entry
barriers for new and smaller players in the market. If that proves to be
the case, it could have a negative impact on competition and go against
the aims of the PSD2 (the recent EU Directive on payment services in
the internal market (2015/2366). This risk is greater when the payment
mechanisms are outside the jurisdiction of the relevant state.
Then there is the question of supervision. Will the new solutions be
supervised, and if so, how? The challenge here is that many new
solutions are global, and thus outside the European Economic Area or
the European Single Market. Such supervision thus requires
crossborder cooperation among supervisors.
The challenge for the supervisor is also to maintain a comprehensive
overview of the market. For the legislator, it is a challenge to stay on
top of rapid technological developments, as rules tend to lag behind
technological changes. Financial market participants must commit fully
to guarding the system. Cybersecurity needs to be promoted at all
levels.
With respect to this fast-changing technology, keeping one step ahead
of antisocial elements is a constant challenge. As I see it, cooperation is
the only way forward. It is vital that all financial system entities work
- -
together on all fronts within and between countries to identify and
address vulnerabilities. We need to share both our successes and our
mishaps. We must do as mountain-climbers do - tie ourselves together
-
because we are all in this together: central banks, financial service
providers, FinTech firms, consumers, regulators, and politicians. And
our success in combining forces will determine whether we reach the
mountain peak or have to go back to base camp again.
All systems can break. This is why some of us still use paper banknotes,
even though they are not the most sophisticated technology. But their
security has been improved upon over recent centuries. Try imagining
what would have been the main topic at a conference in Florence at the
time of the first Medici's. As with paper money, the technologies we
are discussing here today will become more secure, although we will
encounter blizzards. Our role is to prevent or reduce the likelihood that
those blizzards will create systemic risk.