SPEECH SPEECH BY GOVERNOR LARS ROHDE AT THE ANNUAL MEETING OF THE DANISH BANKERS ASSOCIATION 5 December 2016 CHECK AGAINST DELIVERY Thank you for inviting me to speak. I have these two key messages today: 1. Increased digitisation is good news for customers, banks and society in general. 2. Increased digitisation also makes the sector more vulnerable to destructive hacker attacks, but Danmarks Nationalbank and the sector are continuously working to prevent this. *** The Danes have gone digital – and very much so. There are more mobile phones than people in Denmark, and nearly all homes are online. In fact, digital readiness is higher in Denmark than anywhere else. [Chart 1] Technological advances have changed the way banks operate. New possibilities have paved the way for a number of initiatives that have made the financial sector more efficient. This benefits the sector, and it benefits the Danes. With increased digitisation, more processes can be automated and customers can increasingly serve themselves. This reduces the need for branches and employees – a trend that has been seen for some years as this chart shows. [Chart 2] Page 1 of 5 Technology has made digitisation a competitive parameter, which means that all banks are trying to attract customers by offering the best digital products. However, it has also opened the door to increased competition from new actors, who will be able to enter areas that used to be completely dominated by the banks. Competition is good, and there are no indications that we will have less competition in future. In fact, we can expect fiercer competition as a result of the EU's new Payment Services Directive, PSD2, which could be a game changer for the financial sector. PSD2 allows third parties – with the customer's consent – to gain direct access to perform transactions in a customer's bank account. A third party could be e.g. a coffee chain, an airline company or another bank than the one where the customer has a deposit account. The point is that PSD2 allows new actors to offer payment services without providing deposit accounts. Once they have got a foot in the door, they will also be able to offer other services, such as loans, which are actually sources of income for the banks – unlike payment services. The Danish banks have been good at moving with the times and developing their own digital products. Examples are mobile payment solutions, which have become very popular among the Danes. These solutions have helped to prevent foreign actors from gaining significant market shares in Denmark until now. Obviously the limited size of the Danish market also plays a role. Increased digitisation makes heavy demands on the individual banks if they are to keep up with technological advances and remain competitive. That is expensive. Typically it requires substantial investment, and in this respect the size of the bank is a factor. The large banks are better positioned to develop their own digital solutions. Conversely, the small banks rely on collaboration with e.g. a data centre or a larger bank in order to be able to offer the solutions requested by customers. Digital developments may increase the spread between small and large banks, as the large banks can typically benefit from economies of scale. So increased digitisation will contribute further to the downward trend in the number of banks. [Chart 3] Page 2 of 5 *** Increased digitisation also involves a degree of vulnerability. The financial sector relies on complex IT systems. Every day, nearly kr. 600 billion is transferred between accounts via those systems. That is equivalent to more than one quarter of Denmark's gross domestic product. And that makes the Danish financial sector an obvious target of cybercrime. So today we are facing other threats than previously. There are still people like the Olsen Gang [Chart 4], but modern-day threats are radically different and may affect society as a whole. In a historical perspective, cybercrime is a new type of crime, which can be committed from Herning, Hong Kong or anywhere else. We have already witnessed many attacks on financial institutions around the world. The attack on the Bangladeshi central bank made global headlines and was a warning that cyberattacks are becoming increasingly sophisticated. The threat could well be even greater if it comes from organised hacktivism, terrorism or actual state-sponsored attacks. An extensive attack that affects several critical actors or systems in e.g. the payments infrastructure could potentially paralyse the whole sector or significant parts of it for a while. Hence, unauthorised access to financial sector computers could constitute a systemic risk and ultimately threaten financial stability. Even less serious attacks can – if they occur repeatedly – weaken confidence in the financial system. This would be particularly critical if it were to happen at a time when the sector is already struggling – as it was in the autumn of 2008, for example. That is the systemic angle which makes the cyber threat an issue for Danmarks Nationalbank. One of the reasons why there is a systemic risk is that the Danish banks and mortgage banks are closely interconnected via payment and settlement systems handling large values. Moreover, the financial institutions use the same data centres, network service providers, etc. Consequently, it is important that all key links in the chain are very strong. Page 3 of 5 The Danish Financial Supervisory Authority and Danmarks Nationalbank have examined the cyber resilience of 15 of the largest and most important financial sector participants. Although a survey of this type is subject to certain caveats, our conclusion is that, overall, cyber resilience is at a reasonable level – but there is room for improvement. The risk of unauthorised access to or sabotage of important IT systems calls for IT security measures that perhaps received little attention previously. Traditionally focus has been on severed cables, power outages or software errors. We still need to take these factors into account, but cybercrime poses new questions and requires new answers. It is important to remember that attacks to computer systems are not unintentional. There are criminal minds at work, and they are constantly fine-tuning their methods. So the threats are changing all the time. This means that an attack may actually be difficult to detect in time. Our survey shows that the individual sector participants are working with these challenges, but it also shows that the highest levels of security and protection against cyberattacks have generally been achieved by organisations with a cyber strategy which has been approved by the board of directors. In other words, a strategy laid down by top management has helped to ensure focus on these issues throughout the organisation and to target efforts. Interconnectedness and the resultant interdependence between virtually all sector participants mean that information-sharing and collaboration are essential if we are to stem the tide of attacks that will undoubtedly come in the future. First and foremost, I would like to emphasise that collaboration is necessary – especially in situations where there is a potential threat to financial stability. That is why we have established the FSOR – the Financial Sector forum for Operational Resilience. Page 4 of 5 The FSOR is a forum for collaboration between authorities and all key financial sector participants [Chart 5]. Its task is to implement "joint measures to ensure financial sector resilience". The focus is on preventing failures, but also on handling them if they, nevertheless, occur. The ambitious vision for this collaboration is that we should be best in class in Europe when it comes to counter the threat from cybercrime. The first specific initiative was the large-scale test of the financial sector's crisis response plans conducted the week before last. It really put the sector's ability to work together and coordinate efforts in the event of an extensive cyberattack on critical systems to the test. It was an educational experience. We all learned a few lessons and came home with knowledge that we can use in our further efforts. And fortunately it was only a test. But if it becomes necessary, we are ready. It is better to activate the crisis response one time too many than one time too few. One of Danmarks Nationalbank's tasks is to ensure that the Danish economy is robust. An important element of a robust economy is a financial sector with a robust infrastructure. There is more work to do for the whole sector, but focus must be on the efforts made by the individual sector participants. Thank you for your attention. Page 5 of 5