of risks for all aspects of banking, from bank lending and trading to operational perils faced by a bank. with respect to basel iii, the final agreements are expected to be ready by the end of this year. generally, a lot can be learned from analysing data and looking at past experiences. but does this imply that we should eventually be able to answer the question “ have we done enough? ” with certainty? if you ask me, this is a hazardous interpretation of the question. by this i do not wish to demean the value of calculations and data - based assessments such as those accompanying basel iii. it ’ s more a matter of making sure they occupy the right place in our mind - set. therefore, my speech will explore the progress we have made towards achieving our idea of a regulatory and supervisory universe. to broaden the focus, i will start by presenting financial stability in an evolutionary framework. after that i will address the financial reforms introduced in europe since 2008, human resources for banking supervision in the ssm are expressed in full time equivalents ( fte ). bis central bankers ’ speeches looking at them through the lens of evolution in order to point out reforms that go beyond quantitative adjustments. let me express my pleasure at being invited to present these thoughts to the scientific community here at cape town university. scientists are known for testing politicians and legislators against the goals they have set. but it is also essential for scientists to engage in the debate about methodology and overarching goals. if we do not conduct the discourse on financial stability in an impartial manner, it is soon likely to be governed by short - sighted and narrow - minded arguments again. 2. beyond optimal regulation and supervision : approaching financial stability after the crisis optimality is an attractive analytical concept. but for good reasons, it never completely ruled policy for the financial sector. first of all, the complex nature of financial markets, products and entities prevents us from identifying the optimum. when calibrating policies towards a given optimum, it is necessary to combine models and numbers. but numbers can be incorrect and models can be wrong. complexity may even give rise to surprising side - effects. the issues stemming from our complex financial world are well - documented by now. andrew haldane gave that memorable speech about the dog and the frisbee – it covers the topic almost exhaustively. but the financial sector is not just complex. dozens of crises over the past few decades were followed by quick policy responses

main risks ; there are many but i would like to 2 / 5 bis central bankers'speeches highlight two of them. first, we have the risk that part of the financial sector slips out of the domain of banks and into the domain of non - banks. that ’ s already the case... yes, it ’ s already the case. the size of banks is now under control ; the large banks are handling risk much better than they were before the crisis. but the price to pay for that has been that part of the financial sector has moved to the domain of non - banks – investment funds, money market funds, etc. – which is regulated differently, where we don ’ t have the so - called macroprudential instruments, in other words, a way to control the bubbles, as one might say. these instruments barely exist, or don ’ t even exist at all, in the domain of market - based finance. that ’ s a challenge for regulators, particularly for the next cycle of european regulation over the next five years. do you think we need to create new regulatory instruments for this non - bank finance? yes, exactly. and the second risk i see – which is of a different nature – is cyber risk, the risk linked to cyber attacks. at the ecb, and elsewhere in europe, we are paying close attention to this issue. we can ’ t rule out the fact that the next financial crisis may come from a cyber attack on a big financial institution or a financial infrastructure. it ’ s our priority to prevent this risk. do you think the chances of a cyber attack are quite high? it ’ s fairly logical given that we ’ re already seeing cyber attacks against companies … ask any company director ; there are thousands of cyber attacks every day. we ’ re being tested all the time, including at the ecb. it ’ s part of being a company. but the financial system has weak points – there are systemic infrastructures that could be targeted by cyber attacks. at the ecb we ’ ve reacted by creating a forum – the euro cyber resilience board – which assesses the resilience of major european infrastructures. we ’ ve also reacted at the level of the g7, with a recent cyber crisis coordination exercise. has the ecb already experienced a major, significant cyber attack? we experience thousands of small ones every day, like everyone … so no “ massive ” attack? not for now, no. no significant attack