broaden their scope from financial institutions to third parties. but even with such an instrument at hand, successful supervision will always require a degree of adaptability – it will always require the capacity to identify and understand new risks and threats, and adapt accordingly. to successfully do this, consistent and constructive collaboration between financial institutions, third parties, and supervisors, will remain at the heart of cyber resilience. another part of dora is that a financial institution's leadership will need to be highly involved in cyber security. this is fully in line with what de nederlandsche bank has been working on for some time now – increasing the boardroom's cyber knowledge and expertise. whenever corporate digital strategy is discussed, somebody who knows the ins and outs of cyber security should have a seat at the table. so, i am very pleased with the regulatory advancements. but, compliance alone is not a financial institution's recipe for success. however important, it is a mere ingredient. 3 / 5 bis - central bankers'speeches financial institutions themselves are responsible for the entire recipe. and just as a professional kitchen can't operate without basic ingredients like salt and pepper, a financial institution must have its basic cyber security ingredients in place. without the salt and pepper of cyber security, a financial institution is a sitting duck for cyberattacks. you could think, for instance, about drafting and implementing a security policy – a policy that explicitly describes who gets access to your offices, how people should protect their hardware and software, and how new employees should be screened. or how digital vulnerabilities, like necessary software updates, are managed. or whether a cyber security crisis plan and team are set up. and most importantly, the basic ingredients of cyber security should not just be put in writing. they should not just be items on people's to - do list. everyone, from staff to top management, in - house or third party, everyone must understand why this is important. the article on the'secret life of passwords'i talked about a few minutes ago, reveals how important the why is for people. the author of the article spoke to dozens of people about their passwords, and he found that a lot of passwords have rich background stories. a lot of passwords are a motivational mantra. a lot of them are a daily reminder of something important, someone important. of course, this is exactly what makes passwords potentially unsafe. this is exactly what hackers aim for

that credit institutions are facing. firstly, not having adequate controls to prevent, for example, money laundering or terrorist financing will be unacceptable for regulators, who - as illustrated by the fines levied against abn amro in the united states - will not hesitate to take formal measures against your institutions. secondly, and perhaps even more importantly, involvement in serious compliance related incidents can lead to reputational damage, the impact of which may be even larger than that of regulatory interference. as confidence remains one of the financial sector ’ s cornerstones, a substantial impairment of an institution ’ s reputation could very well lead to its collapse. nevertheless, whereas the basel accord, of course, requires institutions to set aside capital to cover credit -, market and operational risk, “ compliance risk ” is not covered. is this a missed opportunity? should the drafting panels of the new capital accord have spent time on a concept like “ compliance capital ”? in my opinion, requiring institutions to set aside capital to cover losses from compliance incidents is not the issue. i believe that it is justified that the basel committee has not included compliance risk in its capital accord. whereas ( potential ) credit losses can be financially compensated by holding additional capital, compliance incidents will not be mitigated by financial means. after all, compliance incidents will impact the reputation of a credit institution, which cannot be measured in financial terms. compliance is not a financial matter, but a matter of principle. nevertheless, the question about the position of compliance continues to intrigue me. you will undoubtedly be aware that pillar ii ( the so - called supervisory review process ) of the new capital accord deals ( amongst others ) with the treatment of risks that are not fully covered by the requirements under pillar 1 14. under pillar ii, the accord requires banks to address all material risks faced in the capital assessment process, even those risks that cannot be measured or quantified precisely 15. banks are expected to further develop techniques for managing unquantifiable risks like reputational risk 16. although the language in the capital accord gives the impression that ‘ something ’ needs to be done, it also implies that holding additional capital for unquantifiable risks is not the solution. so, what then is the solution? i would argue that, whereas it remains necessary to mitigate compliance risks, a more structured and coherent approach is necessary. as previously discussed, banks are faced with challenges like the increasing globalization, issues with the corporate governance of complex institutions, the continuously changing understanding