During a speech entitled ‘The art of bending without breaking – banking on operational resilience’ Frank Elderson, Member of the Executive Board of the ECB and Vice-Chair of the Supervisory Board of the ECB, has set out the European Central Bank’s current view on operational resilience regulation.
The speech was given at the joint European Banking Authority and European Central Bank international conference on ‘Addressing supervisory challenges through enhanced collaboration’ which took place in Frankfurt on 4 September 2024.
Highlights from the speech include:
Operational resilience is a cornerstone of regulation
Mr Elderson confirmed that operational resilience is a cornerstone of the mission of prudential supervisors to keep banks sound. The goal of regulation is to ensure that banks build up and maintain adequate operational resilience. “While operational risk management aims to minimise the likelihood and impact of operational risks, operational resilience assumes that disruptions will inevitably occur. Hence banks must protect themselves from threats, and be able to respond to disruptive events, recover and learn from them in order to be able to ‘deliver critical operations through disruption’,” he stated.
Three core pieces of operational resilience were highlighted during the speech. Mr Elderson said:
- “Operational resilience has now been engraved in the marble of supervision: the Basel Core Principles. They now explicitly cover operational resilience, including enhanced requirements for aspects ranging from governance and business continuity planning to third-party dependency management. The revised Core Principles will help supervisors around the world to encourage banks to increase their resilience to operational threats. Such threats are unlikely to decline given heightened geopolitical, cyber, and climate and nature-related risks.
- “Moreover, the Digital Operational Resilience Act (DORA), which will apply as of 17 January 2025 in the EU, will help to further boost operational resilience. Among other things, DORA provides a robust framework requiring banks to foster a culture of continuous IT and cyber risk management.
- “In the banking union, we flagged addressing deficiencies in banks’ operational resilience frameworks as one of the SSM supervisory priorities for 2024-2026. This means, for instance, conducting on-site inspections of banks’ cybersecurity management or targeted analysis of banks’ outsourcing arrangements with third-party providers, including potential concentrations of risk in certain providers.”
IT and cyber risks are challenging banks’ operational resilience
Mr Elderson highlighted the difficulties that banks are facing in terms of IT and cyber threats and stressed the importance of prioritising cyber resilience alongside operational resilience. He stated:
“In order to help banks pinpoint their vulnerabilities to cyber risks, earlier this year we conducted a cyber resilience stress test. It wasn’t a stress test in the traditional sense, with capital impact. Instead, it was a qualitative exercise aimed at encouraging banks to better understand how well they would be able to respond to and recover from a successful cyberattack while maintaining their critical functions and services.
“The cyber resilience stress test showed that, although banks do have high-level response and recovery frameworks in place, there is room for improvement.
“Banks need to ensure that their recovery capabilities are sufficient to handle even worst-case scenarios, and that they can protect customers’ assets and data, and in doing so maintain confidence in the banking system.
“We are therefore calling on banks to prioritise operational and cyber resilience and ensure that this resilience is integrated into their core business strategies. This will enable them to adapt and respond proactively to the fast-paced changes in the cyber threat landscape.”
Cloud outsourcing risks were also stressed in the speech, with this being seen as another key challenge for banks’ operational resilience. An important area here is concentration risk, with Mr Elderson pointing out that:
“The Bank of England has estimated that more than 70% of banks and 80% of insurers rely on just two cloud service providers. Ultimately, the failure of either of these providers could have a significant negative impact on markets and consumers, and on financial stability. This level of concentration implies that operational incidents may become more correlated among financial institutions that outsource critical functions to a common critical service provider.”
He went on to confirm that further work is being done in this area:
“Clearly, cloud outsourcing risk doesn’t stop at national borders; it affects multiple jurisdictions. We’ve therefore teamed up with other prudential authorities to conduct a joint review into cloud outsourcing practices. This will enable us to better understand how banks are adopting cloud technology and the risks it may pose. For instance, we’re collectively exploring banks’ third-party risk management practices and their business continuity plans, as well as their exit strategies – including stressed exits.”
Board weaknesses seen
Speaking about the importance of investment in human capital for operational resilience, Mr Elderson stated that: “Banks must ensure that employees at all levels of the organization have the appropriate skillset, whether they are experts or managers. Soberingly, from our analysis of the effectiveness of banks’ management bodies we can see that there are still boards that lack in-depth IT expertise, which may ultimately put into question the collective suitability of the board. We expect all boards to have a sound understanding of IT and cyber risks so that they can assess the impact of these risks on banks’ various business areas.”
