Granularity may not improve risk-sensitivity; it could even worsen it by amplifying model risk. And given that uncertainty, simpler metrics may often provide a more robust signal of solvency. (c) Risk-shifting and robustness A third argument used to justify risk-based frameworks is that they help defuse incentives to engage in “risk-shifting” or other types of regulatory arbitrage (Kahane (1977), Kim and Santomero (1988)). Risk-shifting refers to incentives to shift portfolios towards higher-risk, higher-return assets. These incentives are likely to be strongest when risk is not well aligned with return – for example, under an equally-weighted leverage ratio. Indeed, this powerful logic justified moving to risk-based capital standards in the first place. Historically, there have certainly been episodes when risk-shifting appears to have been important. For example, the movement by banks into Latin American debt in the 1980s; the loading-up on zero risk-weighted OECD sovereign debt in the 1990s; and the extension of zero-weighted 364-day lines of credit in the 2000s. Yet in these cases, the problems seem to have been generic - mis-calibration of risk weights. A few studies have looked at the evidence on risk-shifting more systematically. For example, Furlong (1988) looked at the behaviour of around 100 US bank holding companies after the introduction of the leverage ratio in 1981. While banks’ average riskiness increased, there was no difference in behaviour between regulatory-constrained and unconstrained banks. This suggests risk-shifting was not too potent a factor. Sheldon (1996) reaches the same conclusion when considering the move by international banks to Basel I.

Financial institutions must be convinced that there is a long term gain by hiring cyber risk specialists, including in-house specialists that can develop timely and customised solutions based on a deep understanding of the institution’s operating systems, business needs and organisational culture. There is also substantial scope for the financial  2  BIS central bankers’ speeches  industry to work more closely with telecommunications firms, internet service providers and other vendors to ensure that cyber criminals do not take advantage of external vulnerabilities to penetrate the security perimeter. In most countries, such initiatives lacked the coordination necessary to provide an effective system-wide defence against cyber crimes. Part of this change will be influenced by the attention and importance that supervisors place on the management of security risks. The role of supervisors and the public sector In the face of further digitisation of the financial sector, the responsibility of financial supervisors in ensuring the stability and integrity of the financial system will become increasingly challenging. Regulatory and supervisory frameworks need to be updated to acknowledge the significance of cyber security threats. It is necessary for us to establish a clear expectation on the management of such risks by financial institutions. We should outlined clearly in key areas that could cause threats such as outsourcing arrangements with third party service providers, stress testing, anti-money laundering requirements and business continuity plans.