Canada's central bank has begun working with the country's six largest lenders to boost the cyber-resilience of the wholesale payments ecosystem as part of a wider effort to improve industry collaboration in the fight against hackers.
Speaking at the Payments Canada conference in Toronto, Bank of Canada chief operating officer Filipe Dinis said of the new initiative: "The goal is to have a rapid, collaborative approach to recovery should a key participant be affected by a serious cyber security event, such as the corruption of critical data that results in a prolonged operational outage."
With the scale and sophistication of cyber attacks against the financial sector growing, Dinis told his audience that it is "no longer enough for each institution to maintain its own alarm system. While doing so provides a certain level of protection and comfort, we need to invest in system-wide defences."
This includes third parties, which are a growing operational risk, as they carry out more and more critical work for banks in areas such as data services and cloud computing. Dinis cited a recent report from the global Financial Stability Board organisation, which warned that reliance on these third parties could pose a systemic risk to the whole system.
Last year, 180 participants in three different cities took part in an exercise simulating the operational failure of a key financial market infrastructure, which would have halted major Canadian debt and equity markets for more than 30 hours.
Said Dinis: "Perhaps the most important lesson we learned is the value of trusted relationships and partnerships among regulators, financial system participants and other sectors. Individual firms in the financial system know their own business but don’t always understand all their connections with others. This can lead to decision making that ignores threats to the system.
"We also discovered—and this is certainly not unique to this exercise—the importance of coordination and communication protocols in the event of a systemic crisis. At such a stressful time, the last thing we want is confusion and ambiguity. We are now developing improved protocols to address this shortcoming."