an essential element of financial stability. cyber risks threaten the core functions of the financial sector, including banking operations, payments and securities settlement. central banks and, more generally, public authorities may themselves be on the radar screen of cyber attackers ; cyber security is no longer a matter for specialists but a policy priority. the pillars of an effective cyber security strategy in today ’ s world, central banks, regulators and supervisors face the formidable challenge of ensuring that the technological revolution does not undermine trust and confidence in the financial system. this is no easy task : like acrobats walking a tightrope, the authorities must strike the right balance between potentially diverging forces such as innovation, complexity and the safety of the system. this entails enhancing and complementing the traditional regulatory and supervisory approaches with the adoption of an effective toolkit tailored to address cyber risks. from 2 billion in 2006. source : world economic forum, mitigating risks in the innovation economy. how emerging technologies are changing the risk landscape, ( september 2017 ). such as the wannacry campaign in 2017 and the corkow malware in 2015. in 2016 the g7 published a set of widely applicable recommendations encapsulating cyber security best practices for public and private financial entities. they were followed last october by the ‘ fundamental elements for effective assessment of cyber security for the financial sector ’. having in mind these g7 principles, i would like to focus the rest of my speech on the main pillars on which – from a central bank ’ s view – an effective strategy should be based : regulation, cooperation and risk awareness. the first pillar : regulation regulation is a crucial component of an effective strategy to ensure sustainable innovation and preserve cyber security. a number of european laws have recently introduced requirements and obligations for both private companies and public bodies in order to increase cyber security in critical sectors of the economy. a general framework is given by the network and information security directive ( nis - d ), which establishes security - related obligations for critical service providers, including credit institutions, stock exchanges and financial infrastructures. to guarantee data protection and the privacy of personal information, the general data protection regulation also imposes strict security requirements for private and public entities, including financial firms. specifically focusing on the financial field, the second payment services directive ( psd2 ) has introduced security requirements throughout the payment cycle : from payer authentication to communication between service providers, security risk management by financial firms and the reporting of major incidents to the authorities. the european

operating profits. profits fell overall by 40 per cent ; the roe on ordinary operations halved to 4. 5 per cent. the factors that are constraining bank profitability today will become more intense, responding to the recession with the usual lags. the commitment to curbing costs must be intensified and the economies foreseen in business plans must be achieved more quickly. the banks will be decisive in determining whether the crisis we are facing is more or less long - lasting, more or less deep. it is necessary to reconcile prudent management and capital soundness with the need not to deny financial support to firms with good potential for growth and a real ability to weather the crisis. it would be dereliction of duty if the banks and the bank of italy were to stray from the path of rigorous evaluation of creditworthiness. a healthy banking system is essential to growth ; it safeguards the savings entrusted to banks. however, it is equally important that in deciding on loans banks use all the information available, that they supplement statistical scoring methods which lose some of their predictive power at times of crisis with direct knowledge of customers and their real potential for growth and profitability in the long term. a banking system with local roots is of great value ; it needs to be exploited and where it has been lost it must be rebuilt. banks must take advantage of their grass - roots knowledge of customers and avoid over - reliance on automatic processes. there is ample scope for improvement. some banks, some of them large ones, are beginning to move in this direction, reviewing their organizational models and their decision - making procedures. what prudential supervision requires of banks capital italian banks ’ own funds are well above the regulatory minima and have remained so even through the worst of the financial crisis. the capital ratios of the leading banking groups increased in the first three months of this year. i have said, and i say again, that a strengthening is nonetheless necessary. it is not just a question of maintaining strong safeguards for stability ; we must compete on an equal footing with the foreign banks which have had to resort to massive injections of public money in recent months ; we must be prepared, as of now, to operate with a capital endowment that future regulations will require to be larger than at present. above all, capital strengthening is indispensable in order to face the deterioration in the macroeconomic situation without neglecting to give firms, households and the economy the support they need. during this phase the