matthew elderfield : effective enforcement – encouraging compliance and good practice opening remarks by mr matthew elderfield, deputy governor of the central bank of ireland, to the central bank enforcement conference, dublin, 11 december 2012. * * * i would like to welcome you to the first conference on enforcement that we are hosting at the central bank of ireland. we are very glad to be hosting this event and that you are able to join us here today. enforcement is an important element of our regulatory strategy at the central bank. our approach of assertive, risk - based supervision is underpinned by having a credible enforcement deterrent in place. effective enforcement certainly has a corrective element that is designed to ensure accountability for non - compliance with regulatory requirements, both by firms and – as i would like to talk about briefly in a moment – ideally also for individuals. but effective enforcement is much more powerful than simply being about bringing a particular firm or its management to account. the broader benefit, which supports supervision, is the deterrent effect of enforcement. if firms think there is a credible risk that their own non - compliance with regulatory standards would lead to sanctions from the central bank, then that provides a very powerful motivation to boards of directors and senior management teams to ensure a high standard of conduct. the fact that the central bank has sanctioned firms and has published details of these sanctions has made some in the industry uncomfortable and leads to pleas to ease up on the use of the enforcement tool. we do not apologise for taking enforcement actions or publicising them. there is no deterrence value unless firms, investors, consumers and the public are aware that we will respond with enforcement action where behaviour and practices fall short. i am firm in my belief that this is a necessary and best practice element in the regulatory toolkit of the central bank. and, unless these sanctions are published with enough detail about what occurred and the sanctions imposed the deterrent effect will be diluted. we have purposefully made an effort to be more explicit and detailed in the publicity statements involving enforcement sanctions. the purpose of this is to provide greater transparency to industry, the markets and the public about the nature of breaches that have been committed. the publication of the enforcement action has a reputational impact on the firm and management concerned. a consequence of this approach is that the impact of our enforcement efforts is greater because, frankly, the message is clearly communicated to industry and the public that breaches will not be tolerated. consequently all firms are

cyril roux : cybersecurity and cyber risk address by mr cyril roux, deputy governor ( financial regulation ) of the central bank of ireland, to the society of actuaries in ireland risk management conference “ cybersecurity and cyber risk ”, dublin, 30 september 2015. * * * many thanks to the society of actuaries in ireland for inviting me to address such a distinguished audience of risk and insurance professionals. the conference agenda covers a number of substantial topics, and i am pleased to speak to you about one that is rapidly moving up the central bank ’ s supervisory agenda : cybersecurity and cyber risk. raising awareness of cybersecurity risk we know a lot about the financial risks such as interest rate, liquidity and credit risk that contributed to the crisis from which we are emerging. we also know that the next crisis is unlikely to be the same as the last one. that ’ s why we monitor other categories of risks, such as operational risks, faced by supervised firms and by the financial system as a whole. operational risks come in many guises, and we pay in particular close attention to it risks. financial firms are evermore dependent on their information technology. the share of financial services provided online to their customers continues to grow, and the inner workings of financial firms, as well as their relationships with their vendors and suppliers, are wedded to their information systems. regulated firms are thus exposed to large scale it risks on a number of fronts. when part of their it systems fail, their business is impaired, and, in time, so are their reputation, their finances, and ultimately their survival. regulated firms perform critical economic functions on behalf of the general public and businesses. their logical resilience and safety is, if anything, even more important than the security of their business premises. accordingly, the central bank expects regulated firms to have robust governance and policies frameworks around their data and information systems, including their outsourced functions. regulated firms need to identify, monitor and mitigate their it risks. within that universe of it risks, i wish to focus today on cyber risk, a growing risk that has serious implications for prudential supervision, consumer protection and financial stability. the irish insurance industry appears to share the same view. cyber risk is at the top of your firms emerging risk concerns, according to the 2015 pwc insurance survey. however, not all irish firms regulated by the central bank assess their exposure to cyber risk properly, and not