And the integration of RegTech and SupTech allowed data from financial institutions to flow directly into regulators’ data bases in machine-readable formats through Application Programming Interfaces or APIs. Supervisory officers, who used to spend long hours poring over spreadsheets and reports – cutting, pasting, and computing – began to use automated surveillance dash boards. They are able to track on a daily basis the consolidated exposures, credit quality, value-atrisk and other indicators of the banks under their purview. They are able to carry out stress tests and simulations not only of individual banks but also network analysis of risk transference across the financial system. 3/9  BIS central bankers' speeches  Compared to just ten years ago, technology has enabled supervision to become much sharper and surveillance of systemic stability more rigorous. Managing the Risks Posed by FinTech while Harnessing its Benefits The second big theme in financial regulation over the last 20 years is the rise of FinTech. Technology has always featured in financial services. But from about 2015 onwards, there was an explosion in the application of various technologies in financial services – by both regulated entities and unregulated FinTech firms offering niche financial products. FinTech transformed the way financial services were produced, distributed, and consumed. It has brought significant benefits to consumers, financial institutions, and the economy at large. It has helped to reduce costs, manage risks better, create new business opportunities, and improve people’s lives. But like all good things, FinTech brought in its wake new risks and new challenges for regulators.

Algor Bank was successfully resolved with minimal disruption. Thanks to efforts by the FSB after the Global Financial Crisis, the major jurisdictions that Algor Bank operated in had robust resolution regimes. With a clear resolution plan formulated, tested and discussed at the bank’s annual Resolution College prior to the crisis, home and host regulators were able to resolve Algor Bank in a smooth and timely manner. But the fact that a cyber attack could bring down the 20th largest bank in the world with a Tier 1 capital adequacy ratio of 16% revealed significant gaps in the global regulatory regime for technology risk. It was ironic that in an industry where there were detailed internationally accepted standards for capital, liquidity, and a range of prudential norms, there were no standards for cyber risk management. The FSB and standard-setting bodies swung into action and in 2025 produced a two-track set of reforms to deal with cyber risk, which is essentially borderless. 7/9  BIS central bankers' speeches  First, the FSB’s Cyber Security Standards, building on its Cyber Lexicon of 2018, established a minimum level of cyber hygiene for internationally active financial institutions. They set out harmonised standards for authentication, implementation of cryptography, intrusion detection, and incident reporting. Higher standards were set for G-SIFIs. G-SIFIs were required to put in place 24/7 cyber surveillance of all Internet-facing systems, undergo annual cyber vulnerability assessments by internationally certified cyber specialists, and carry out military-grade penetration tests.