Amid rising cybersecurity threats, global policy-makers are examining financial market infrastructure firms’ plans for dealing with potentially fatal attacks.
The International Organization of Securities Commissions (IOSCO) and the Bank for International Settlements’ Committee on Payments and Market Infrastructures (CPMI) issued a joint discussion paper on Thursday that aims to explore how central counterparties (CCPs), such as clearing and settlement firms, plan to address “non-default losses,” such as major cyberattacks, that could cripple these firms.
In the wake of the global financial crisis, which introduced a clearing obligation for over-the-counter derivatives markets, CCPs have become increasingly important to the world’s financial system, the paper noted.
As a result, the resilience of CCPs in the face of losses and liquidity shortfalls — regardless of whether they come from a firm’s default or a non-default event such as a major cyberattack — “has become critical for financial stability.”
“Non-default events can threaten a [CCP’s] viability as a going concern and its ability to continue providing critical services,” the regulators said in a release.
Given the threat, financial market infrastructure firms “must take action and have policies, procedures and plans” for dealing with these kinds of threats, along with “a sound risk management framework to mitigate and manage those risks,” the regulators said.
While the subject of non-default losses is addressed in the global regulators’ existing principles and guidance, “there is limited common understanding” of firms’ current practices, the paper noted.
The paper outlines current practices at industry infrastructure firms, and aims to “advance industry efforts and foster dialogue on the key concepts and processes used by CCPs,” it said.
Among other things, it covers practices for identifying loss scenarios; quantifying potential losses; implementing, testing and acting on plans for addressing losses; governance; and transparency regarding these plans.
The deadline for responses to the paper is Oct. 4.