ignazio visco : challenges for the financial sector in adapting to cyber threats speech by mr ignazio visco, governor of the bank of italy, at the g7 conference on " cybersecurity : coordinating efforts to protect the financial sector in the global economy ", bank of france, paris, 10 may 2019. * * * today we are discussing how cyber risk is evolving in the financial sector, and what we should do about it. to set a course of action for the future, i believe we should go back to one fundamental question : why did financial authorities get involved in cyber defence in the first place? our overarching goal has always been to preserve a high degree of trust in the financial system. this is by no means limited to cybersecurity – it is our raison d ’ etre. that is why we regulate financial risk - taking and why we do not grant disreputable players any licence to banking activities. that is also the reason why we make sure that vital systems such as payment infrastructures are not taken down by hackers. when it comes to financial risk - taking, we all acknowledge that markets fail to deliver socially optimal results on their own, hence regulation and supervision are needed. the same argument applies to cyberspace. financial firms have their own reasons to protect themselves. they do not want to lose their credibility and their customers because of a cyberattack. but this is not enough. cyber vulnerabilities have extensive negative externalities – individual entities such as financial institutions do not have the incentives nor the means to internalise them all. authorities need to rectify this. the nature of cyberspace is such that externalities are not contained within national borders, or within any single sector. one important source of cyber risk for supervised entities is their increasing reliance on third - party suppliers who fall outside the jurisdiction of financial authorities. in the past, attackers have leveraged vulnerabilities in the it systems of third parties to strike financial institutions. in the g7 fundamental elements for third party cyber risk management in the financial sector published last year, we introduced tenets on the appropriate management of third - party risk. we must now accelerate work on implementation. when it comes to third parties who operate in regulated sectors, such as energy and telecoms, the different authorities must step up their coordination and cooperation efforts. there are two dimensions to cooperation. first, within each country there needs to be a cohesive national system of

efficient and more robust, immune to the perverse incentives that led to the accumulation of excessive risks that generated the crisis. consistent implementation of the agreed reforms at the national level is the arena where the effectiveness of international cooperation will be tested. in the absence of a global enforcer the only practical way forward is to strengthen both the peer review process and the reach of international institutions, in primis the imf, which retains the responsibility for surveillance over the global financial system. significant progress has also been made in setting up top - down, system - wide oversight arrangements at the national, regional and international levels. these arrangements are designed to deliver more encompassing surveillance, with broadened macro - prudential perspectives and better mechanisms for triggering actions on identified risks. examples include the european systemic risk board in europe, the financial services oversight council in the us, and the imf - fsb early warning exercise to assess macro - financial risks and systemic vulnerabilities at the global level. a lot remains to be done in this, in many respects, unchartered territory. we now need to improve analytical tools, design instruments of intervention, elaborate organizational arrangements by which the different authorities can effectively share information and, especially, coordinate actions to prevent and to manage critical situations. a painful lesson of the recent crisis – and the many preceding it – is that the authorities did too little to act upon “ early warnings ” that, though weak and imprecise, were often clear enough to have warranted more forceful preventive action. challenges even more severe lay ahead on the macroeconomic policy front. here the risk is very tangible that, with the emergency now over, a purely domestic orientation again prevails in economic policy decisions – a tendency of which some signs are unfortunately already evident. the consequence would be larger imbalances, increasingly erratic capital flows, and greater exchange rate volatility – all factors that ultimately can hamper the recovery. it is imperative to resist such tendencies and abide to the pledge – repeatedly stated by the g20 – to work together to ensure a lasting recovery and set the world economy on a path of strong and sustainable growth. a “ new bretton woods ” is perhaps a rhetorical exaggeration but we do need a common realization that the present, weak cooperation arrangements for managing the world economy are inadequate. greater interdependence requires stronger policy cooperation and some form of disciplining mechanism to ensure that national policies are mutually consistent. stronger cooperation in turn necessarily