A critical aspect of cybersecurity is the need for banks to adequately invest in safeguarding their systems and platforms by training their employees on how to identify potential cyber-attacks, mitigate vulnerabilities, and escalate issues appropriately. Moreover, to address potential insider threats, banks must establish and maintain robust protocols and controls in managing employees’ access to the firm’s systems and databases. Ensuring that sensitive firm data, personal information, and critical infrastructure are accessible only to those trusted employees who need access is vital to guard against accidental or intentional data loss, theft, or damage. 3/4  BIS central bankers' speeches  Supervisors expect that institutions create a strong risk culture around access control and vendor management. Employees are banks’ first lines of defense against cyber vulnerabilities, so investment in employee training is critical. By raising awareness about potential threats and vulnerabilities, a bank can equip employees with the knowledge and judgment to recognize attacks such as social engineering and mitigate the impact. In addition, training can reduce the probability that an employee will unintentionally cause a breach. For example, we have seen deficiencies due to weak internal controls and policies and procedures, which have led to increased exposure to cybersecurity risk. Institutions are expected to ensure service providers comply with applicable regulations that are consistent with safe and sound banking practices. Closing I’ve outlined three major, transformative changes and trends that all of us in this room— community bankers, regulators, and supervisors—are currently facing.

As you all know, the banking industry is confronting a series of emerging challenges and environmental changes such as a rising interest rate environment, new businesses and technologies that may disrupt the traditional financial services industry, and novel cyber-threats that seek to exploit our highly interconnected society. In addition, over the past year or so, we’ve witnessed significant turnover in the leadership at federal regulatory bodies including the Federal Reserve, the FDIC, and the OCC, which has the potential to change the regulatory environment. And, finally on the legislative front, Congress is currently considering the Economic Growth, Regulatory Relief, and Consumer Protection Act, which if passed in current form would entail the most significant statutory change to the U.S. banking regulatory framework since the passage of the Dodd-Frank Act in 2010. All of this change presents both opportunities and threats. For my remarks today, I’d like to explore three specific changes that are relevant for community banks: first, a shift in community banks’ business models in response to market changes and regulatory pressures; second, the growing competition and potential disruption introduced by “fintech” firms; and third, the critical threat that cybersecurity risks pose to all community banks. Following my remarks and throughout the day, I look forward to hearing from you about these forces as well as on other changes, trends, and challenges that you and your firms are facing.