The additional features also trigger out-of-band notification when changes occur to a participant’s processing options. For example, a customer might assign a senior manager without operational responsibilities to be notified at an out-of-band email address when designated processing options are changed or thresholds exceeded. We believe that these enhancements have resulted in meaningful risk reduction for individual customers and the payments system at large, and have generated renewed awareness of the critical importance of strong endpoint security controls. Also last Fall, the Reserve Banks offered additional protection to depository institutions with assets under a designated size against uncapped losses due to fraudulent payment activity through an expansion of our real time monitoring capabilities. The program, which depository institutions were strongly encouraged to adopt, helps to limit losses from unauthorized Fedwire Funds transfers by rejecting those that would exceed a depository institution’s net debit cap. The rejection of a Fedwire Funds transaction provides another opportunity for the institution to verify authorization for, and fund, the transaction, thereby reducing the financial risk to the institution and its account holding Reserve Bank. In June 2016 the Reserve Banks amended Operating Circular 5, which governs electronic access of depository institutions to Federal Reserve Financial Services, by adding an information security appendix. Of particular note, the appendix sets out requirements for customer information security programs designed to protect the environment and systems used to access Reserve Bank services and applications.

Adherence to the terms set forth in the operating circular represents an indispensable element of a depository institution’s endpoint security program, designed to protect both the individual institution and the network at large. Attention to these security responsibilities regrettably is no longer the exclusive 2/4  BIS central bankers' speeches  purview of technologists and auditors, but compels awareness and direct engagement of executive management and directors. Collectively, these measures represent material enhancements in endpoint security controls supporting the payment system. At the same time, given an escalating threat environment that is not static, we cannot stand still. Therefore, looking forward, we are presently considering another wave of application level enhancements to give depository institutions greater control of their payment activity, such as an exploration of tools that will identify anomalous payments relative to historical patterns; contemplating a further expansion of real-time monitoring to include all depository institutions; and considering adoption of an assurance program to enhance confidence that external endpoints are operating in adherence with security requirements. We recognize, especially in the resiliency and security domains, that either intentionally we are progressing or inevitably we are regressing; given the technological sophistication and guile of our adversaries, there is no idleness. Conclusion Let’s pivot in conclusion from the age of electronic payments to the payment form of antiquity. Many of you will shortly tour the gold vault, the largest such repository in the world, representing approximately one third of the world’s known supply.