  10  Visa Europe, based in the UK and a subsidiary of Visa Inc, executed all 18.9 billion Visa transactions in Europe in 2015. These peaked at 2,000 transactions per second in the pre-Christmas period. 11  And third, although each of the pipes is distinct and serves a discrete purpose, they operate together to provide a seamless global network of functions that Michael Godfrey could not have imagined. The operations behind a routine financial transaction – issuing corporate debt, adjusting a pension fund portfolio or hedging against the risks of commodity price increases – will typically involve a wide range of financial market infrastructure firms over many jurisdictions (see diagram A). 8  https://www.cmegroup.com/company/files/cme-group-overview.pdf http://www.eurexclearing.com/clearing-en/about-us 10 http://www.swapclear.com/what/clearing-volumes.html 11 https://www.visaeurope.com/enabling-payments/processing 9  5  All speeches are available online at www.bankofengland.co.uk/speeches  5  Diagram 1: Example of an international commodity hedge  Diagram 2: Example of equity issuance  6  All speeches are available online at www.bankofengland.co.uk/speeches  6  These global pipes have proved pretty robust. In the last crisis financial market infrastructure proved resilient, including during the most testing time of Lehman’s collapse. But their use is growing, in part because they increase efficiency and lower cost – and in part because they reduce risk and authorities have mandated market participants to use them. 12  In line with this, post crisis, authorities internationally agreed that there needed to be a corresponding increase in the regulatory expectations of FMIs.

In the UK, the Financial Policy Committee of the Bank of England (FPC) formally recognised this risk to financial stability in June 2013. It recommended that the authorities should assess, test and improve the resilience of core parts of the UK financial sector to cyber attack. The FPC has maintained oversight of this programme of work which has included a number of strands, not least the ‘CBEST’ vulnerability testing of critical financial firms and FMIs. 15  Improving resilience to cyber risk is one part of the Bank’s wider work on broader operational resilience. Operational resilience is not a technical issue, especially for the infrastructure firms that need to act as ‘systemic risk managers’. It must begin in the boardroom. The Bank has worked with supervised firms to improve governance, so that standards can be maintained or strengthened, and threats responded to, without regulatory or supervisory pressure. The Bank of Bangladesh incident also shows why, given the critical nature of the services provided by SWIFT, effective international coordination in its oversight is essential. Oversight of SWIFT is led by the National Bank of Belgium (NBB) as SWIFT is a Belgian company. However, the NBB has for many years conducted the oversight of SWIFT in coordination with other central banks, including the Bank of England. These arrangements proved important in maintaining the confidence of regulatory authorities worldwide in the aftermath of the attack. And the oversight arrangements have now been extended in scope to cover the implementation of the crucially important customer security programme.