As evidenced by panel 4, little information on cybersecurity is actually shared, due to sensitivity issues and trust. A pragmatic approach is for financial authorities to engage bilaterally in Memoranda of Understanding (MOUs) with authorities with whom they share mutual trust. Singapore and Hong-Kong already paved the way. This can be done between G7 countries and among other trusted countries as well. III. Preparation for cyber crisis management through large scale exercises The third panel showed how valuable crisis simulations are in the building of an operational preparatory capacity. The exercises organized so far, at domestic or regional levels, allowed us to acquire experience in coordinating a response and the recovery during a major incident. Our ambition must be as high as the risks to which our evolving and interconnected financial systems are exposed to, due to the increasing sophistication of cyber-attacks. In other words, and this is something that clearly emerged from today’s discussions, a more global approach to cyber resilience exercises is needed. In this regard, let me briefly insist on the G7 joint crisis management exercise to be held in early June, coordinated by Banque de France. We will have an excellent opportunity to assess our ability to exchange information and take collective decisions in a mock crisis situation. Good and clear communication 1  FSB, 12 November 2018. Page 5 sur 6 will be essential, underlying the critical role of the communication protocol designed in this regard. But preparation against cyber threat is a moving target.

Since 2015, cybersecurity issues attract an increasing level of attention, and regulators have produced a large number of regulatory texts, both at national and international levels. This was called for to trigger the appropriate response and efforts from the industry. It helped the sector to reinforce its safeguards. Nevertheless, we must ask ourselves whether the multiplication of new regulations can have a counterproductive effect. From the panelists’ interventions, two issues need to be addressed: • First, we should avoid the possible proliferation of texts by standardsetters for banking, payments, securities services, insurance and/or financial markets. The FSB has already provided such evidence in a stock-taking exercise performed in 2017. Regulators are paying attention to cyber risks, and while they share the same objectives, regulatory texts tend to differ across regulators and as a result add to firms’ burden in terms of compliance with these various regulations, with  Page 3 sur 6 little marginal gain. Clarity would be enhanced by reducing the multiple variations in the formulation of requirements across institutions. In turn, regulators’ efforts would be streamlined and their experts employed more effectively. How can we better coordinate regulation? Obviously, a “principle-based” regulation on cybersecurity is preferable, rather than increasingly prescriptive standards, too rigidly “rules-based”. Supervision completes regulation. Principle-based regulation would give supervisors some room for manoeuvre to modulate their expectations to the risk profile of the institutions. • But then, we should also pay attention to the risk of regulatory arbitrage. Regulatory differences can create opportunities.