Supervisors must ensure that banks improve their operational resilience by strengthening their ability to respond to and recover from cyber-attacks. At a minimum, mitigating cyber threats would require effective collaboration between regulators and the industry, adequate contingency and Central Bank of Kuwait - Public ‫ عام‬- ‫بنك الكويت المركزي‬  -4-  recovery plans by banks and sound security practices by all participants of financial market infrastructure. In Kuwait, we are in the process of putting in place an advanced platform for effective information sharing about cyber threats that can later be used at the regional level. Supervisors in this regard can leverage CPMI-IOSCO guidance that calls for ‘resilience by design’, encouraging to incorporate sound security features in the system right from its earliest stage of conceptualization. This approach will help address the potential cyber compromises that could stem from banks’ dependence on legacy technologies. To help strengthen cyber resilience of financial institutions, Financial Stability Board (FSB) is currently working on ‘identifying practices to help financial institutions recover from and respond to cyber incidents’. Next year, they are planning to release a toolkit of effective practices that banking industry can use in improving operational resilience against cyber threats. Coping with climate change The second emerging issue warranting our close attention is climate change. According to UN estimates, around 60 million people were affected by extreme weather events in 2018 alone. And within this year, we have witnessed the damaging impact of wildfire in California, hurricane in Bahamas, cyclone in Bangladesh and typhoon in Japan.

Materialization of such risks will not only disrupt vital financial services but will also undermine the security and confidence in the financial system. In fact, the scale and sophistication of cyber-attacks is already on the rise. Examples include data breach at Target of 70 million credit card users, a cyber-attack on Equifax compromising data of 143 million customers, and the hacking of over 100 million customers’ data at Capital One Bank. No wonder, cyber risk features as a key concern in different industry surveys. For instance, respondents to the Bank of England’s Systemic Risk Survey of 2H-2018 quoted the risk of a ‘cyber attack’ as the second major threat to the system, only behind the Brexit induced political risk. The growing threats of cyber risk need to be reflected in banks’ operational risk capital charge. Incidentally, the Basel Committee has revised its operational risk methodology by replacing the existing three techniques with a simplified Standardized Measurement Approach and expects that its implementation, due by January 2022, will increase capital risk charge for operational risk by 18% for a group of banks currently using Standardized Approach of the old regime. While it is not clear how much of the increase in operational risk charge is driven by the recognition of growing cyber threats, greater capital allocation for operational risk is a step in the right direction, given the increasing significance of such low probability but high impact risks. However, reliance on capital alone will not suffice.