You are here
Next financial crisis may be triggered by a cyberattack, says MAS chief
EMERGING technologies help reduce risks in the financial sector, but they may also accentuate some risks or even create new ones, such as cyberattacks and runaway algorithms, warned Ravi Menon, managing director of the Monetary Authority of Singapore.
In his keynote address at an annual forum by the Australian Securities and Investments Commission in Sydney on Monday, he said cyberattacks, which are less visible and often hit many firms at the same time, are a growing threat to the financial ecosystem, and that financial technology (fintech) could accentuate this risk.
"As more financial services are delivered over the Internet, there will be growing security and privacy concerns from cyber threats," he said. "And maybe even systemic concerns. It is not inconceivable that the next financial crisis is triggered by a cyberattack."
Cyber risk management will thus be the new frontier for global regulatory efforts and supervisory co-operation to address these emerging threats.
He noted that the financial sector has benefited from technological innovation, as is evident from the growing use of digital payments and a wide variety of financial operations; big data is being used in many areas of finance to gain richer insights into customer behaviour and needs, to detect fraud or anomalies in financial transactions and to sharpen surveillance of market trends.
But various risks lurk. Take for example, the nascent use of robo-advisors - software algorithms that recommend a portfolio based on investor preferences and rebalance the portfolio automatically. Shouldn't such robo-advisors be subject to capital requirements, since the financial risks presented by them are similar to that by traditional fund managers, Mr Menon asked.
They also present higher technology risks in the form of runaway algorithms or cyber criminals stealing customer information, not to mention potential systemic or macro-financial risks.
"The failure of a robo-advisor could potentially lead to contagion among other algorithm-driven service providers. This could present systemic risks if investors seek to withdraw their investments in securities through fire sales," he added.
The pro-cyclicality arising from algorithms is another unknown, as the interaction between algorithms could exacerbate market trends.
But Mr Menon suggested that regulators guard against taking approaches that are too pre-emptive when dealing with the uncertainties of fintech; instead, they need to keep pace with innovation.
Turning to how the MAS responds to fintech, he said it uses a regulatory sandbox to test new ideas in a confined environment. The Singapore regulator has also started using techniques such as clustering and network analysis in its supervision of the financial markets and its monitoring of anti-money laundering and countering financing of terrorism risks.
"We are working to develop algorithms that can detect and identify trading accounts suspected of syndicated activities," he said, adding that MAS will soon set up a dedicated unit on supervisory technology to synergise these efforts and to sharpen its supervisory practices.
On cyber security, MAS has collaborated with the Financial Services Information Sharing and Analysis Centre (FS-ISAC) to establish an Asia-Pacific Regional Intelligence and Analysis Centre. The centre will encourage regional sharing and analysis of cybersecurity information within the financial services sector. It is expected to begin operations soon.
Mr Menon noted that, nine years on from the global financial crisis, the financial industry continues to be plagued by egregious misconduct, and financial regulation remains a work in progress.
Regulators must "evaluate the effects of the reforms put in place and make adjustments where appropriate, to maximise their effectiveness and minimise their costs".
But ultimately, it is the financial institution's responsibility to foster "a culture that motivates the right ethical behaviour and responsible risk-taking in the markets" as there are limits to what externally imposed rules can do, he said.