In framing this question, I asked my team to identify the cascading elements of supervisory guidance, oversight requirements, compliance regimes, and maturity frameworks with which we must contend related to risk management and information security. Their list in reply included 17 elements, admittedly some of which are self-induced and at different states of maturity and implementation. All are well intended, all are well designed, and all seek to address different and meaningful dimensions of the control environment. At the same time, compliance across this waterfront has become a consuming pre-occupation, and arguably one that if we are not careful can intrude upon the more tangible actions, and commitments, to increase the resiliency of our infrastructures and enhance the security of our networks. Make no mistake: some form of risk management and control framework and corresponding policy and oversight guidance is absolutely essential to ensure a necessary discipline and accountability. This is not a call for a collective policy/supervisory/industry confab to craft a consolidated and harmonized uber-framework applicable to all parties in every circumstance— that would be as naïve as it is impractical. Indeed, the proliferation of frameworks can serve as a useful prism to ensure that no stone is left unturned in the development of an FMI’s resiliency and security regime. It is an appeal for awareness among standards bodies, supervisors, directors, and other organizational hierarchies that their individual actions, as rational and defensible as they may be, can have a suffocating effect in the aggregate.

There are many examples of fraud that undermines said trust, such as identity theft when opening payment accounts, in “know your customer” procedures or to arrange and draw loans and credit; payment fraud, mainly in card transactions, transfers and remittances; and fraudulent offers of financial operations or services by unauthorised or unregistered operators, which are typically a prelude to actual fraud. More recently, though, new technologies and business models have paved the way for platforms and operators that, engaging in regulatory arbitrage, offer payment, credit or investment services without sufficient safeguards and transparency. Here I would specifically mention operators in the crypto-asset arena, which promise handsome rewards via apps, websites and apparently innocuous advertising, and sometimes even embed such offers in traditional payment service chains, making them harder to identify. Unfortunately, these practices do not distinguish between social groups, levels of financial literacy or risk profiles, and ultimately take a far greater toll on the more vulnerable groups, in particular young people and even teenagers, which is of particular concern. Against this background, and notwithstanding any action that might be taken by the public prosecution service, the courts or law enforcement authorities in relation to criminal offences, our role as supervisors is primarily a preventive one. This means oversight of advertising, ensuring that the registry of operators is fit for purpose and, very importantly, raising awareness of the risks among potential users and fostering their financial and digital education.