As for banking supervision, the Banco de España, in compliance with the provisions of the Memorandum of Understanding of 20 July 2012, performed an internal review of its supervisory procedures. It created a Committee for this purpose which delivered its findings last October. This Committee made a series of recommendations which the Banco de España is considering and which have already led to changes in the organisational chart of the banking supervision department and in procedures. However, the implementation of the Supervisory Mechanism at the European Central Bank, which we expect to take place in about one year, will clearly involve the need for changes both to supervisory procedures and organisation. Consequently, we need to proceed prudently in this area, our adaptation to the new European model being our first consideration. Progress toward the banking union The decisive push towards banking union was given by the European Summit of June 2012, at a time of grave uncertainty and tensions in the euro area. Banking union must be understood, as conceived from the outset, as an essential step to sever the link between banking risk and sovereign risk and to bolster the soundness and irreversibility of Monetary Union. The banking union will be underpinned by three basic pillars: a single supervisor, harmonised resolution arrangements and a European resolution authority with a common resolution fund. To date, progress has been mixed in each of these three areas.

Supervisors need to ensure that cyber security becomes a permanent agenda in the board’s engagements with senior management. There should be on-going dialogue about emerging trends and vulnerabilities, and the measures in place to address them. This would raise awareness of security concerns and ensure that existing cyber security risk management practices are effectively integrated with the firm’s wider business strategy and risk appetite. It is equally important to ensure that the board of directors’ of the financial sector invests adequately in cyber security infrastructure systems and procedures. The amount of funds allocated should commensurate with the nature and scale of an institution’s business activities, and its strategic direction. 65% of respondents in an Ernst and Young survey in 2013 cited an insufficient budget as the primary challenge for information security functions to meet the demands of the business. As supervisors of the financial system, we should require financial institutions to continuously benchmark infrastructure and systems against leading best practices in cyber security. This includes the application of security testing measures to identify key potential vulnerabilities in a financial institution’s information security system. Financial institution ought to take a long term view on this matter. Supervisors can do more to encourage financial institutions to improve the response to evolving threats by ensuring continued access to external and internal expertise necessary to rapidly develop controls and defences that protect critical assets and operations. Today, the lack of skilled resources remains a key barrier to value creation in regard to information security.