banking authority ( eba ) was delegated to issue secondary regulation. the guidance on cyber resilience for financial market infrastructures was published by cpmi - iosco in 2016. to ensure its harmonized implementation within the euro area, the eurosystem has delivered a cyber resilience strategy that national supervisors must adopt to enhance the cyber resilience framework of financial institutions. however, regulation alone is not sufficient to protect the financial system from cyber risks. indeed, excessive reliance on regulation may even have undesirable side effects owing to the complex interactions between different regulatory levels, such as domestic versus international legislation or economy - wide versus sector - specific rules. hence, other forms of intervention are necessary, such as cooperation. the second pillar : cooperation owing to the existence of externalities, individual intermediaries may lack sufficient incentive to contribute to the supply of a common good – cyber security – that would generate benefits for their direct competitors as well. they may be tempted, therefore, to free ride on the action of other companies and to under - invest in security - enhancing projects. in this situation, central banks, as third parties entrusted with preserving financial stability, may act as a catalyst to stimulate cooperation, centralized cyber threat intelligence and information sharing initiatives. 3 at european level, the recent establishment of the european cyber resilience board ( ecrb ) under the eurosystem cyber resilience strategy is a valuable example of virtuous cooperation among public authorities, financial market infrastructures and critical service providers to enhance the cyber resilience of the european financial ecosystem. financial authorities may also leverage such cooperative initiatives to promote effective practices and tools for cyber risk assessment, including simulations and tests, which are difficult for individual firms to implement in isolation. this is a new paradigm, in which authorities and regulated entities work closely together, complementing compliance with a collaborative approach. this allows the authorities to gain a deep understanding of the level of cyber resilience achieved and of any additional initiatives required. the third pillar : promoting risk awareness the third pillar of action focuses on the human factor, as in cyber security people are still the weakest link. for example, the spread of cyber extortion ( ransomware ) – which is becoming one of the major threats to digital businesses – can be attributed to several factors. some are technical, 4 but the threat intelligence may support financial institutions in taking the right decisions to prevent cyber attacks, effectively protect their critical assets and respond appropriately in the event of

digital transformation of the retail payments ecosystem cyber security – the balance between cooperation and regulation keynote speech by fabio panetta, deputy governor of banca d ’ italia at the joint ecb and banca d ’ italia conference rome, 1 december 2017 information and communication technologies play a fundamental role for people, businesses and the public sector. digital transformation is modifying the economic system and the whole of society at unprecedented speed. innovation is having a powerful effect on the financial sector. the value chain is becoming more complex, and the participation of non - financial providers is increasing. the tech giants as well as the new fintech start - ups are expanding the supply of innovative services to a broad and diverse customer base through new business models. as a result, confidence in the financial sector is no longer based on bilateral trust between customers and service providers but is dependent on the governance of digitalization and especially on the reliability and safety of the products offered. emerging risks in the digital ecosystem the increasing role of digital platforms is creating enormous benefits for users. at the same time it is offering ill - timed advantages for new groups of hostile agents, such as hacktivists, fraudsters and criminal and terrorist organizations. by exploiting the vulnerabilities within cyberspace, these agents may endanger the provision of digital services or disrupt critical infrastructures. the new risks are exacerbated by the complex network of interconnections that forms the digital ecosystem : the ‘ internet of things ’ is exploding and the number of interconnected devices is expected to grow at an unprecedented pace, to more than 200 billion in 2020. 1 the area at risk is expanding enormously. any weakness in security controls, any vulnerability in technology may offer an entry point for cyber attacks. in the financial sector, cyber attacks can create disruptions that propagate instantly and globally with effects that are hard to predict. recent cyber attacks, like the one against the central bank of bangladesh, exemplify the vulnerabilities – of both process and technology – that affect interbank payments and core financial infrastructures, which were once considered less exposed to cyber risks. as the financial stability board has emphasized, certain cyber attacks 2 show that the vulnerability of financial institutions is a systemic issue, although it is unlikely as yet to represent a real threat to global financial stability. these attacks were a wake - up call for regulators and financial authorities, emphasizing that the safety of cyberspace is not just a prerequisite for the reliability of financial services but also