Based on technical assistance to central banks by the IMF’s Monetary and Capital Markets Department and Information Technology Department, this paper examines fintech and the related area of cybersecurity from the perspective of central bank risk management. The paper draws on findings from the IMF Article IV Database, selected FSAP and country cases, and gives examples of central bank risks related to fintech and cybersecurity. The paper highlights that fintech- and cybersecurity-related risks for central banks should be addressed by operationalizing sound internal risk management by establishing and strengthening an integrated risk management approach throughout the organization, including a dedicated risk management unit, ongoing sensitizing and training of Board members and staff, clear reporting lines, assessing cyber resilience and security posture, and tying risk management into strategic planning.. Given the fast-evolving nature of such risks, central banks could make use of timely and regular inputs from external experts.
Finance and Development, September 2016
In February 2016, hackers targeted the central bank of Bangladesh and exploited vulnerabilities in SWIFT, the global financial system’s main electronic payment messaging system, trying to steal $1 billion. While most transactions were blocked, $101 million still disappeared. The heist was a wake-up call for the finance world that systemic cyber risks in the financial system had been severely underestimated.
The Icelandic financial system is large, concentrated and interconnected - banks and Non-Bank Financial Institutions (NBFIs) - domestically and internationally. There are 10 banks: 4 commercial banks and 6 savings banks, but the system is dominated by just three of the commercial banks (Arion banki, Íslandsbanki and Landsbankinn) that together account for 95 percent of banking assets. Cash use is declining as a percentage of point of sale (POS) transactions, leading to an increasing dependence on electronic payment means. The debit and credit cards used for most retail transactions rely on international communications with Visa and Mastercard.