Internally, the Federal Reserve has organized a supervisory program on cybersecurity that consists of subject matter experts from across the Federal Reserve System. Work is underway to enhance the analysis of IT examination data in conjunction with threat information to enhance risk-focused reviews during examinations. Through our discovery work with financial institutions, we have found that the state of cybersecurity readiness varies across firms. Supervisors are seeking to develop common principles to address cybersecurity issues and will work with other agencies to ensure that firms are dedicating resources and taking the appropriate actions to defend the operations that are critical to the financial services sector against cyber threats. This is particularly true for those risks that could be channeled through interconnected organizations and that could potentially have an impact on other firms and more broadly across the sector. •  Fintech The financial sector, like the broader U.S. economy and society, is becoming increasingly digital and there is considerable discussion of “fintech” – defined simply as the intersection between financial services and new technologies. A recent industry study, for example, reports that investment in fintech companies grew from $ billion in 2010 to $ billion in 2015.3 It is unclear, however, whether fintech will enhance or fundamentally disrupt the financial service and payments industries, or perhaps it is some combination of both. In any of these cases, however, supervisors will have a keen interest in monitoring the impact on the business models and risks of financial institutions and the way financial intermediation is done.

Asymmetric information also creates issues on the liability side of a bank’s balance sheet. The banks’ creditors – depositors or providers of funding – don’t have as much information about the health of the institution as insiders do. This asymmetry makes banks opaque and inherently fragile, which can subject them to runs. This type of “run risk” has been largely mitigated, at least in the case of retail depositors, by deposit insurance, access to lender of last resort facilities, and other elements of the bank safety net. Importantly, however, a broad safety net weakens market discipline of banks and can create incentives for excessive risk-taking. This contributes to the need for risk-sensitive regulation and supervision. Regulations can control risk-taking through a variety of means such as setting minimum requirements for capital and liquidity positions, while supervision can identify and constrain activities that are not well-captured through regulation but still affect a firm’s risk management, governance and control infrastructure. One common objective is to counter the incentive for excessive risk-taking by intermediaries. •  Externalities A second and distinct type of market failure that creates a need for public sector intervention stems from the externalities that the failure of a large, systemically important bank failure can have on the rest of the financial sector or the economy as whole. For example, the financial crisis vividly demonstrated how the distress of a large financial firm can destabilize broader financial markets and impact other financial firms. These effects can be seen through direct linkages via counterparty exposures.