We’ve also observed community banks participating with other banks on real estate lending, in part to better manage real estate concentrations. Community banks are also seeking to differentiate themselves from their larger competitors by marketing their more individualized customer service. In regard to liquidity, a number of community bankers have noted the influx in public deposits and the challenges associated with putting these deposits to productive use. Finally, although there has been a material improvement in asset quality over the last several years, it will be important for senior management to continue to be prudent in their underwriting practices and in monitoring any emerging risks in their portfolios. The economy continues to show a strong trajectory, but of course we need to remain alert to any potential slowdown. As Second District community banks grow in line with their national peers, we are encouraged by the increased reliance on core funding and strong asset quality. We will, however, continue to monitor developments that may pose a risk to the safety and soundness of the financial and banking system. Fintech A second major change for community banks—like all banking institutions—is the potential competition from new “fintech” firms. Since 2012 there has been over $ billion in US-based fintech investments including online lending-based platforms, capital markets, and payment and 2 2/4  BIS central bankers' speeches  settlement services.2 By offering traditional financial services to customers through new, innovative platforms and channels, these fintech firms pose a challenge to traditional banking business models.

A critical aspect of cybersecurity is the need for banks to adequately invest in safeguarding their systems and platforms by training their employees on how to identify potential cyber-attacks, mitigate vulnerabilities, and escalate issues appropriately. Moreover, to address potential insider threats, banks must establish and maintain robust protocols and controls in managing employees’ access to the firm’s systems and databases. Ensuring that sensitive firm data, personal information, and critical infrastructure are accessible only to those trusted employees who need access is vital to guard against accidental or intentional data loss, theft, or damage. 3/4  BIS central bankers' speeches  Supervisors expect that institutions create a strong risk culture around access control and vendor management. Employees are banks’ first lines of defense against cyber vulnerabilities, so investment in employee training is critical. By raising awareness about potential threats and vulnerabilities, a bank can equip employees with the knowledge and judgment to recognize attacks such as social engineering and mitigate the impact. In addition, training can reduce the probability that an employee will unintentionally cause a breach. For example, we have seen deficiencies due to weak internal controls and policies and procedures, which have led to increased exposure to cybersecurity risk. Institutions are expected to ensure service providers comply with applicable regulations that are consistent with safe and sound banking practices. Closing I’ve outlined three major, transformative changes and trends that all of us in this room— community bankers, regulators, and supervisors—are currently facing.