Cyber Risk, Financial Stability and the Payments System

Cyber risk remains at the top of the list of risks to the financial system, and the financial system is well known as the primary target for hackers (see here, here and here). In response, financial institutions expend huge resources on protecting their information systems—by one estimate, well over $100 billion. Yet, private sector actions to prevent cyber losses fall short due to a glaring externality: since the damage is likely to spill over to other financial firms and to markets, individual firms cannot reap the full benefits of preventing cyber attacks.

To get a sense of the financial stability risks associated with cyber fragility, we need to understand the financial system in some detail. Unfortunately, financial networks are highly complex and vary significantly across markets and functions. They also evolve meaningfully over time. On top of these enormous challenges, assessing network vulnerabilities frequently requires institution- or transactions-level information that is normally not publicly available.

This brings us to the important recent work of Eisenbach, Kovner and Lee (EKL), who study the vulnerability of the U.S. large-value interbank payments system, Fedwire, to a cyber attack on one of the principal nodes of the payments network—namely, one of the top five banks. In this post, we highlight EKL’s analysis as a model for the assessment of cyber-driven network risks. We suggest how central bankers should react to a cyber attack on the payments system, and speculate about what is needed to prevent, as well as mitigate, cyber risks….

Stress Testing Financial Networks: The Case of CCPs

Following the crisis of 2007-09, in which AIG’s bilateral derivatives trades played a notable role, the G20 leaders called for central clearing of standardized derivatives. The resulting shift has been dramatic: central counterparties (CCPs) now clear about three-fourths of interest rate contracts, up from less than one-fourth a decade earlier (see Faruqui, Huang and Takáts).

By substituting a CCP as the buyer to every seller and the seller to every buyer, central clearing mutualizes and can—with appropriate margining, trade compression, position liquidation procedures, and reporting—reduce counterparty risk (see Tuckman). CCPs also contribute to financial resilience by promoting uniform margin standards, reducing collateral and liquidity needs, and making risk concentrations (like that of AIG in the run-up to the crisis) more transparent.

At the same time, the shift to central clearing has concentrated risk in the CCPs themselves. Reflecting economies of scale and scope, as well as network externalities, a few CCPs serving global clearing needs have grown enormous. For example, as of the last report at end-September 2018, open interest at LCH Clearnet exceeded $250 trillion. Moreover, the clearing activity of some CCPs lacks any short-run substitute. As a result, to avoid disrupting large swathes of the global financial system, any recovery or resolution plan for these CCPs must ensure continuity of service (see CCP Resolution Working Group presentation to the OFR Financial Research Advisory Committee). Finally, CCPs are the most interconnected intermediaries on the planet, making them channels for transmission and amplification of financial distress within and across jurisdictions. As then-Governor Powell clearly states in the opening quote, the safety of CCPs is central to the resilience of the global financial system.

We and Richard Berner have been studying how regulators use stress tests (see our earlier posts here and here) to assess the resilience of financial networks, including banks and nonbanks. In our joint work, we focus on CCPs due to their centrality, their extreme interconnectedness and their lack of substitutability. This post is based on our research….

Commentary

Money, Banking, and Financial Markets