Many community bankers are taking a proactive, forward-leaning approach to these new technologies with a focus on how they can be leveraged to improve their business and benefit their customers. Among the opportunities community bankers have highlighted during our discussions are: technological solutions that reduce back office costs; more efficient loan processing; and an improved customer experience through smartphone applications and other mobile technology. This proactive perspective leverages innovation as a strategic differentiator and competitive advantage, rather than just a means to enhance efficiency. The speed and magnitude of these changes also have implications for us as supervisors. We must keep pace and understand the risks associated with innovation so that we can appropriately focus our supervisory efforts on new operational, compliance, and reputational risks. For example, Supervisory and Regulatory Letter 13–19, “Guidance on Managing Outsourcing Risk,” provides supervisory expectations on partnering with outside vendors. While supervisors can provide some focus on emerging risks, it is ultimately the responsibility of each firm and its board to identify the relevant risks associated with new technologies and make appropriate and prudent business decisions for their institutions and customers. Cybersecurity The potential benefits associated with these new technologies are accompanied by the risks posed by cybersecurity. Cybersecurity risks, the third topic on my list, continue to raise challenges for all types of firms in the financial system, ranging from supervised banks to financial utilities to non-bank financial firms to government agencies.

A critical aspect of cybersecurity is the need for banks to adequately invest in safeguarding their systems and platforms by training their employees on how to identify potential cyber-attacks, mitigate vulnerabilities, and escalate issues appropriately. Moreover, to address potential insider threats, banks must establish and maintain robust protocols and controls in managing employees’ access to the firm’s systems and databases. Ensuring that sensitive firm data, personal information, and critical infrastructure are accessible only to those trusted employees who need access is vital to guard against accidental or intentional data loss, theft, or damage. 3/4  BIS central bankers' speeches  Supervisors expect that institutions create a strong risk culture around access control and vendor management. Employees are banks’ first lines of defense against cyber vulnerabilities, so investment in employee training is critical. By raising awareness about potential threats and vulnerabilities, a bank can equip employees with the knowledge and judgment to recognize attacks such as social engineering and mitigate the impact. In addition, training can reduce the probability that an employee will unintentionally cause a breach. For example, we have seen deficiencies due to weak internal controls and policies and procedures, which have led to increased exposure to cybersecurity risk. Institutions are expected to ensure service providers comply with applicable regulations that are consistent with safe and sound banking practices. Closing I’ve outlined three major, transformative changes and trends that all of us in this room— community bankers, regulators, and supervisors—are currently facing.