They can also be seen through less direct linkages such as confidencerelated behaviors that are manifest in higher haircuts and margins or reluctance to do business with certain firms or types of firms, uncertainty about the true health of a firm, or the impact of fire sales on the valuation of a broad class of assets held by a broad range of investors. The fact that these costs are external to a given financial firm can lead to excess risk-taking. BIS central bankers’ speeches  3  The realization of these externalities during the financial crisis has had a profound impact on the Federal Reserve’s approach to supervision. Most specifically, they provided the practical experience to support the conceptual case for tightened prudential requirements for the largest, most systemically important institutions. This focus is seen in the mandate from the Dodd-Frank Act for the Federal Reserve to implement enhanced prudential standards, including higher capital standards, to mitigate the risks posed to financial stability by systemically important financial institutions. For example, both the Basel Committee for Banking Supervision and the Federal Reserve System have identified factors that contribute to a financial firm’s systemic importance through these types of externalities. These mechanisms are proxied for by observable metrics such as the size of the balance sheet, interconnectedness between firms, complexity of the business, cross-jurisdictional activity, short-term wholesale funding, and substitutability of certain activities.

Internally, the Federal Reserve has organized a supervisory program on cybersecurity that consists of subject matter experts from across the Federal Reserve System. Work is underway to enhance the analysis of IT examination data in conjunction with threat information to enhance risk-focused reviews during examinations. Through our discovery work with financial institutions, we have found that the state of cybersecurity readiness varies across firms. Supervisors are seeking to develop common principles to address cybersecurity issues and will work with other agencies to ensure that firms are dedicating resources and taking the appropriate actions to defend the operations that are critical to the financial services sector against cyber threats. This is particularly true for those risks that could be channeled through interconnected organizations and that could potentially have an impact on other firms and more broadly across the sector. •  Fintech The financial sector, like the broader U.S. economy and society, is becoming increasingly digital and there is considerable discussion of “fintech” – defined simply as the intersection between financial services and new technologies. A recent industry study, for example, reports that investment in fintech companies grew from $ billion in 2010 to $ billion in 2015.3 It is unclear, however, whether fintech will enhance or fundamentally disrupt the financial service and payments industries, or perhaps it is some combination of both. In any of these cases, however, supervisors will have a keen interest in monitoring the impact on the business models and risks of financial institutions and the way financial intermediation is done.