Global technology companies, such as Facebook Messenger, Google, Apple and Samsung, are relevant providers of payment services. These companies are able to capitalise on their popularity among users. In the long term, this may adversely affect competition and efficiency, since it is difficult for other providers to challenge large networks. There is also a danger that the owners of popular technological platforms could exclude other payment service providers from offering services on their platforms. If this proves to be the case, this is a matter for the competition authorities. Under PSD2, also commercial undertakings can seek authorisation as payment initiation service providers. Mobile phone apps can combine direct advertising, loyalty programmes, storage of receipts with actual payments. Even so, banks will play a key role. Banks will also be able to provide payment services to persons who do not hold an account with the bank. This may strengthen interbank competition for payment customers. New technology must be used for the good of society. In principle, it is up to the business sector and customers to find suitable methods of payment. At the same time, we must ensure the security of the payment system. New payment service providers will increase the dissemination of payment information. This may also increase the risk that payment information gets into the wrong hands. Vulnerabilities related to accessing, processing and storing information may affect the public’s confidence in the payment system. It may ultimately be appropriate to implement new measures to ensure that this information is processed in a secure manner.

Cyber security The consequences of cyberattacks can be considerable. What we are now witnessing is probably just the beginning. We must find a suitable way to mitigate risk, without making our systems needlessly expensive. Cyber-security challenges are among the most significant challenges to our payment system. Without an efficient defence system, trust in the system can be undermined over time. For its part, Norges Bank is devoting considerable resources to securing its systems, oversight of activities and implementing measures to protect against cyber attacks. As part of oversight and supervision, we will increase our monitoring of cyber-security risks in the payment system. This requires cooperation, both nationally and internationally, to identify and combat cyberattacks. Nationally, this takes place through, for example NorCERT, part of the Norwegian National Security Authority (NSM), and for the financial sector through the Norwegian Financial Sector Cyber Security Center (FinansCERT) under Bits. The Nordic financial sector has established 3/5  BIS central bankers' speeches  Nordic Financial CERT as an extension of the Norwegian FinansCERT. The need for cooperation does not stop at a Nordic level. The challenges are international, and are shared by private financial undertakings, their service providers and subcontractors and authorities in many countries. Measures to promote cyber security are technically complicated and require specialist expertise. But it is management and boards of directors in institutions and companies that have the final responsibility and decide strategy and resource use. This responsibility cannot be delegated or outsourced to others. Owners and managers must be aware of their ultimate responsibility.