Prepared by Tatsushi Okuda. The paper has benefited from the synergies and association with the ongoing work for the IMF’s Global Financial Stability Report. The author would like to thank the BCCh and CMF staff for the helpful discussions.

This database is prepared by leveraging an application to scrape data from relevant cyber sources, which is then reviewed and coded by the research team. Note that this database covers only the incidents that had media coverage, and many of those which were blocked by the targets are not included. Indeed, according to Trend Micro, in Chile, the number of malware detections, email threat detections, and malicious URL detections in the first half of 2021 were, respectively, over 2 million, 47 million, and 1 million, which were much larger than the number of incidents reported by this database.

The IMF assessed cybersecurity risk in several Financial Sector Assessment Programs (FSAP) (Switzerland in 2019; Belize and Norway in 2020; Mexico, South Africa, and the United Kingdom in 2022; Iceland and Sweden in 2023) and provided Technical Assistance (e.g., Trinidad and Tobago in 2023).

Information and data are from the University of Maryland CISSM Cyber Attacks Database and the BCCh’s FSRs.

D-SIBs are designated annually using a methodology developed by the CMF, based on the one from the Basel Committee and with the favorable agreement of the BCCh. The current D-SIBs were designated in March 2023.

This observation is consistent with the empirical literature which documents that cybersecurity risk is priced in equity markets (Jamilov et al., 2021; Florackis et al., 2023).

Moreover, the CMF experienced cyberattacks in March 2021 while these attacks did not disrupt the CMF’s platforms or services, as the organization promptly activated cybersecurity protocols and containment measures to ensure the continuity of services.

During the pandemic, the number of online bank accounts was boosted as these accounts were used for the transfer of state aid to lower-income households and due to the greater use of online purchases. This shift led banks to expand their digital offerings and close offices. The rise of online bank accounts may also partially reflect Banco Estado’s introduction of Cuenta RUT in 2006 which is a demand account featuring simplified opening procedures, no income prerequisites, and no maintenance fees.

The growth rate of Chilean banks’ nominal IT expenses in the 2010s (threefold) is similar to that of U.S. banks (Modi et al., 2022; He et al., 2023). Because the inflation rate has been moderately higher in Chile than in the U.S., the growth rate of real IT expenses may be modestly higher in the U.S. than in Chile.

For example, in its 2022 annual report, Banco de Crédito e Inversiones reported that it invested US$ 80 million to cybersecurity. Aldasoro et al. (2022a) empirically document that the firms which invest more in information technology security tend to be more resilient to cyberattacks.

According to their 2022 annual reports, Chilean banks have contingency plans for cybersecurity incidents and regularly conduct cybersecurity training for employees. They also adopt international standards for the best practices to address cybersecurity risk including ISO/IEC 27001 (information security management), National Institute of Standards and Technology (NIST) cybersecurity framework, and the Payment Card Industry Data Security Standard (PCI-DSS). Some banks hire cybersecurity specialists as executives, such as Chief Information Security Officers (CISOs).

The indicator is calculated based on the quality and coverage of data protection policy, organizational structure, internal control, and privacy-enhancing technologies etc., and provided by MSCI.

This indicator is calculated based on three types of vectors: i) security practices, ii) the presence of malware or unwanted software, and iii) employee activities, and provided by Bitsight. In its 2022 annual report, Banco Santander Chile explicitly commits to scoring 800 points in this measure.

In terms of privacy data management scores, Chilean banks outperform their OECD peers; however, this may be indicative of sample selection bias, as samples from advanced economies encompass both large and small banks, whereas samples from emerging economies only include large banks. Regarding sample size, that of the cybersecurity rating is much larger than that of privacy data management scores.

Bouveret (2018) estimates the potential aggregate costs of cyberattacks to range between 10 percent to 30 percent of banks’ net income. While there exist indirect costs, such as reputational damage which can have serious, long-lasting financial impacts, the literature has not yet covered this cost as it is difficult to estimate.

i) Internal fraud: misappropriation of assets, tax evasion, intentional mismarking of positions and bribery, ii) External fraud: theft of information, hacking damage, third-party theft and forgery, iii) Labor practices and business safety: discrimination, workers’ compensation, employee health and safety, iv) Customers, products and business practices: market manipulation, antitrust, improper trade, product defects, fiduciary breaches and account churning, v) Damage to physical assets: natural disasters, terrorism and vandalism, vi) Business interruption and systems failures: utility disruptions, software failures and hardware failures, and vii) Execution, delivery and process management: data entry errors, accounting errors, failed mandatory reporting and negligent loss of client assets.

This ‘external fraud’ includes self-induced fraud by customers.

‘Internal fraud’ is included to consider the possibility that employees caused cyber incidents.

The impact is calculated by dividing annual gross operational losses by risk-weighted assets.

The maximum stress is calibrated to the maximum impact of historical operational losses to assets in the annual frequency panel dataset of all individual banks in 2019–22. The impact on capital ratios under the stress is calculated by multiplying the impact of historical operational losses on capital ratios by the ratio between maximum stress and historical impact in terms of operational losses to assets. The same applies to the calculation of the operational loss to capital to operational risk.

The capital to operational risk is calculated by dividing the risk weighted assets for operational risk by 12.5, and the loss to capital ratio is calculated by dividing annual gross losses by the capitals to operational risk. Note that the share of risk-weighted assets for operational risk is around 10 percent among Chilean banks.

The database is also expected to include the operational losses from the cyberattacks which were not reported in the media and thus are not included in CISSM Cyber Attacks Database. Aldasoro et al. (2020b) reported that while operational losses from cyber incidents represent a small fraction of total operational losses, they can significantly impact the total operational value-at-risk. Cohen et al. (2019) also suggest that cyber loss data shares a risk profile similar to non-cyber operational losses. This allows for the application of existing operational risk modeling techniques to assess the financial impact of cyber risk.

The outflows from unsecured wholesale deposits are assumed to decrease high-quality liquid assets (HQLAs) by forcing banks to sell them. The outflows are also assumed to reduce their unweighted exposures to the deposits. The former channel decreases the LCRs while the latter channel increases the LCRs. Outflow rates for the deposits are assumed to remain unchanged.

Cyberattacks often occur during financial stress (Eisenbach et al. 2023) and thus, banks should continue to satisfy the 100 percent LCR requirement after cyberattacks.

Note that the LCRs decrease to some extent if same outflow rates from secured wholesale funding are additionally assumed because the outflow rate assumptions for the item are low. However, the results remain overall unchanged.

On June 27, 2014, Bulgaria’s largest domestic bank, First Investment Bank (FIB), experienced a 10 percent deposit run due to false emails and social media rumors about a liquidity shortage, prompting the bank to use a government-provided liquidity assistance scheme.

However, it should also be noted that the implemented Basel III liquidity requirement provides incentives for banks to continue holding HQLAs to meet a 100 percent LCR regulatory requirement, even after the unwinding of the FCIC.

17 banks are operating in Chile, in which six are D-SIBs (Banco de Chile, Banco de Crédito e Inversiones, Banco del Estado de Chile, Banco Santander-Chile, Banco Itaú Chile, and Scotiabank Chile) as of March 2023, accounting for around 90 percent of bank assets.

For example, on June 27, 2017, Ukrainian banks and companies fell victim to a cyberattack by Russian hackers using the NotPetya virus. This malware spread rapidly through a software update for accounting programs, affecting a wide range of businesses, financial institutions, and government agencies. According to the National Bank of Ukraine’s December 2017 Financial Stability Report, the attack impacted 35 percent of the Ukrainian banking sector by net assets and 32 percent by household deposits, with most banks facing operational difficulties for several days. Foreign multinational companies were also affected through their Ukrainian subsidiaries (Crosignani et al., 2023).

According to their 2022 annual reports, Chilean banks have implemented measures to mitigate the cybersecurity risk from third-party IT suppliers such as setting cybersecurity standards for suppliers.

The database is prepared based on banks’ publicly disclosed data.

On October 23, 2023, a Chilean telecommunications company, GTD, suffered a ransomware attack that affected part of its Infrastructure as a service (IaaS) platform, disrupting online services. According to the media, about 3,500 firms were impacted by this incident. This incident highlights the importance of the third-party IT supplier risk in Chile. Moreover, in terms of the concentration of IT service providers, cloud computing services are reported to be highly concentrated globally (Carney, 2019).

Payment systems (PS), central securities depositories (CSD), securities settlement systems (SSS), central counterparties (CCP) and trade repositories (TR) are designated as FMIs (BIS, 2012).

For example, in 2016, the Committee on Payments and Market Infrastructures and the International Organization of Securities Commissions published ‘Guidance on cyber resilience for FMIs’ (BIS, 2016), and in 2022 they published ‘Implementation monitoring of the PFMI: Level 3 assessment on Financial Market Infrastructures’ Cyber Resilience,’ which summarized the adoption status of the guidance above in each country (BIS, 2022b). Additionally, one of the critical service providers in payment systems, the Society for Worldwide Interbank Financial Telecommunication (SWIFT), a global messaging network used by financial institutions to send and receive information is imposing SWIFT Customer Security Programme on users, to improve information sharing among SWIFT users, to increase the level of security awareness and education, and to establish a set of mandatory security controls that SWIFT customers must implement.

Within the low-value payment system (involving credit cards, checks, and ATMs), CCA (Centro de Compensación Automatizado), a privately-owned for-profit corporation, operates alongside low-value clearinghouses. Moreover, implementation of Low Value Payment Clearing Houses (CPBV) is in progress; CCA will start to operate ‘Clearinghouse for interbank Electronic Funds Transfers’ at the end of 2023-early 2024, and the BCCh is currently reviewing internal rules of other six CPBVs.

Moreover, according to the BCCh’s FSR, the BCCh has promoted incorporating the Chilean peso into the Continuous Linked Settlement (CLS) in Switzerland, the world’s leading provider of FX settlement services. If successful, integrating the LBTR system with interbank payment systems in other countries via CLS would heighten cybersecurity risks for Chilean financial sector while it also enhances the efficiency of financial activities.

These charts are created based on the ‘Yellow Book Statistics,’ which is the statistics about payments and financial market infrastructures in Latin American and Caribbean Countries and published by the Center for Latin American Monetary Studies (CEMLA). The methodology follows the structure of the BIS Red Book, and national central banks prepare the data with the support of CEMLA.

This is based on Level 1 self-assessments. Chile has not participated in level 2 (peer review) and level 3 (peer benchmarking) assessments.

The reports are available here: Systema LBTR, ComBanc, DCV, CCLV, and ComDer.

In Chile, the National Institute for Standardization (INN) authenticates the ISO standards.

The charts of cryptocurrency used in this study are created based on the estimates by Chainalysis, the blockchain data platform. It should be noted that so far financial stability risk from cyberattacks on cryptocurrencies are limited. For example, global banks’ exposures to cryptocurrencies are limited, according to the Basel III monitoring report in 2022.

The vulnerability of DeFi to cybersecurity threats is connected to the reliance on smart contracts—computer codes stored on the blockchain and activated when specific conditions are met. All transactions occur on the blockchain, and the codes overseeing DeFi protocols are publicly accessible. While this transparency aims to improve transactions among blockchain users, it also exposes DeFi to cybersecurity risks. Hackers can scrutinize the computer codes to pinpoint vulnerabilities and strategically exploit transaction data to maximize the impact of their cyberattacks.

The charts of fintech firms used in this study are created based on the joint study by Finnovista and Inter-American Development Bank and Fintech Radars by Finnovista, which publishes research and periodical reports on the state and latest trends of Fintech innovations in Latin America.

In Chile, 20 percent of operation fintech firms are foreign, most of which are Colombian, Mexican, and Argentinian.

For example, Chile published its National Cybersecurity Policy 2017–2022, with the goal of promoting a free, open, safe, and resilient cyberspace. Afterwards, in 2018, Chile established the Computer Security Incident Response Team (CSIRT) under the Ministry of the Interior and Public Security to strengthen and promote cybersecurity practices, policies, laws, regulations, protocols, and standards in state administration and critical infrastructures. Chile also joined international initiatives such as the Cyber Security Program, developed by the Organization of American States (OAS). Moreover, In June 2022, Chile introduced a computer crimes law, covering offenses like system attacks, unauthorized access, data interception, forgery, fraud, and device abuse, with penalties based on severity. In December 2023, Chile’s National Cybersecurity Policy for 2023–2027 was introduced. It advocates for the establishment of the National Cybersecurity Agency and the National Registry of Cybersecurity Incidents and aims to enhance the resilience of information infrastructures and facilitate internal and international coordination.

The Cybersecurity and Critical Information Infrastructure Framework Bill, which aims to create a National Cybersecurity Agency and establish procedures for protecting essential services, drawing from EU regulations like NIS 1 and NIS 2 Directives, and Spain’s critical information infrastructure protection rules, is discussed under the congress. The bill includes definitions for terms like cyberattack and cybersecurity and sets minimum requirements for incident prevention, containment, resolution, and response. It also proposes the creation of entities such as the National Cybersecurity Agency and the National Registry of Cybersecurity Incidents. The bill on personal data protection is discussed under Congress. The bill aligns with international standards, such as the EU’s GDPR, to protect people’s rights and freedoms regarding their personal data, while also proposing the establishment of a national authority for personal data protection. The National Consumer Service (SERNAC) currently manages personal data protection in consumer affairs and will do so until a dedicated data protection authority is established.

The CEF was created in 2011, and it is chaired by the finance minister and includes the CMF president, the Pension Superintendent, and the BCCh Governor as a permanent invitee and advisor.

Note that payment providers engaging in fintech activities are already subject to cybersecurity regulations issued by the CMF.

The CMF presented detail of the regulations on FMIs in 2018 and 2023. Note that Chile received Technical Assistance on cybersecurity policies by the IMF in 2017 (Abarca, 2023).

Additionally, in collaboration with the IMF, the Monetary Authority of Singapore conducted bottom-up cyber stress testing on banks’ capital ratios and liquidity ratios (LCRs) (Goh et al., 2020).