of their systemic risk. stress testing and stronger capital requirements have combined to greatly strengthen the resiliency of the u. s. banking system. at the banks subject to ccar, risk - based capital ratios have more than doubled since 2009. combined, these firms now have more than $ 1 trillion of common equity capital, and a ratio of common equity to risk - weighted assets of 12. 1 %, which is many multiples over the required ratio of tier 1 common in 2009. as a result of these changes, large u. s. banks are substantially more resilient to stress than in the past. at the same time, i believe our regulatory measures are most effective when they are as simple and transparent as possible, and it is prudent to periodically review all of our practices to ensure that they are achieving these goals. importantly, although ccar and our regulatory capital requirements share similar ends, they were developed separately, due to the exigencies of the crisis, and this has led to significant redundancies, which i will describe in detail in a moment. just to name one prominent example, we now have 24 different requirements for total loss absorbency, while before the financial crisis we had 3. perhaps there were some benefits to having overlapping approaches when we were still in the capital - building phase after the crisis. but now that banks have built significant capital stores, i believe the overlapping requirements should be combined for efficiency and simplicity. the stress capital buffer ( scb ) proposal last year, the board issued a proposal to address these redundancies. the proposal — known as the stress capital buffer — would simplify our regulatory regime by integrating the stress test with our non - stress capital rules. i believe the scb proposal stands as a good example of how our work can be done more efficiently and effectively, and in a way that maintains the resiliency of the financial system. for large bank holding companies, the scb would replace the fixed - for - all - times - and - for - allbanks 2. 5 percent risk - based capital buffer with a firm - specific buffer based on the firm ’ s most recent stress test results. this would integrate our stress testing capital requirements with our point - in - time capital requirements. and as a result, the two separate capital frameworks would be combined into one. firms would have to manage according to one integrated set of requirements and, when their capital is insufficient, would be required to rebuild their resili

better measure cyber risk will allow banks and supervisors to improve their understanding of the direct and indirect costs of a cyber disruption. an incident poses direct costs on an affected bank and its customers, as well as indirect costs to other market participants who are connected to the affected bank. for instance, researchers at the new york federal reserve bank recently modeled how a cyber incident could be transmitted through the 1 / 3 bis - central bankers'speeches u. s. financial system under a variety of circumstances. 3 the authors estimate how the impairment of a single large bank, a group of smaller banks, or a common service provider could be transmitted through the payments system and result in significant spillovers to other banks. spillovers to the broader financial system are estimated to be especially large when attacks are timed to maximize damage, further highlighting challenges that arise with protecting against cyber risk. in addition, the researchers estimate that the potential impact of a cyberattack is systematically greater during stressed financial conditions. this indicates that we need a deeper understanding of how cyber risk interacts with traditional challenges to financial stability. 4 many of the participants in today's conference are working on research that will advance our knowledge of cyber risk and financial stability, and i am looking forward to continuing to follow work in this area. despite progress in recent years, techniques to quantify cyber risk are still at a nascent stage, in part because of a lack of good data. better data on cyber threats and vulnerabilities will enable us to identify and assess threats to banks and the financial system. in addition, improved data on interconnectedness between financial institutions and service providers will help identify and measure the impact of an incident on the broader financial system. the ability to quickly identify patterns, connections, and vulnerabilities will enable quick response, and may mean the difference between a controlled event and one that has a serious impact. we are supporting efforts to further study this subject through public - private coordination groups. in addition, cyber incident reporting will provide better data on the frequency, severity, and locality of cyber incidents that will enhance our collective ability to respond to these events. i am heartened to see that many of the attendees and speakers at this conference come not just from the united states, but also from around the globe. today's globalized financial system and the global nature of cyber threats demand international coordination from both participants and regulators. in closing, i look forward to hearing more about what you all accomplish during the remainder of the conference,