Payment security must improve, Norges Bank warns

Norway’s payment system needs to be upgraded to respond to growing cyber security threats, the central bank warned today (May 25).

Norges Bank also said it will decide on the design of the next-generation settlement system by the end of 2025.

It will assess and test various models for a central bank digital currency (CBDC) until 2025. In the same period, it will also decide the design of its next generation settlement system, its latest financial infrastructure report said.

“Risks have intensified and the threat landscape has expanded,” said deputy governor Pål Longva. “Maintaining a secure payment system requires the efforts of individual entities and effective public-private co-operation. Cyber incidents can quickly spread across sectors and contingency work in the various sectors must therefore be viewed in a broader context.”

Norges Bank and the financial supervisory authority of Norway have introduced a framework for testing the banking and payment systems’ cyber resilience. This is Tiber-NO, the national adaptation of the ECB’s Tiber-EU framework, which includes simulating cyber attacks.

The first round of tests under this system began in autumn 2022, and are scheduled to be completed in autumn 2023.

The financial structure report highlighted that the payments system depends on other key infrastructure such as the electric grid, telecommunications and the internet. “Measures that increase the security and contingency arrangements of other critical infrastructure are therefore crucial for the payment system,” noted the report.

Following the Russian invasion of Ukraine in February 2022, and sanctions on Russia, unknown attackers sabotaged the Nord Stream pipeline carrying Norwegian gas to Europe. Earlier this month, the UK and Norway signed a security partnership to prevent attacks on infrastructure, including gas pipelines and cables. This agreement includes exchanging intelligence.

In this regard, the report stressed Norges Bank has “on several occasions pointed out that the payment system and other critical societal functions are dependent on a very few key IT service providers and data centres”.

New technology opportunities

The payments sector is being rapidly transformed by technology, offering new methods and providers, the report noted.

Norges Bank’s research on CBDC design options is assessing whether the public should have access to a central bank digital currency. “A CBDC raises complex issues, and the current payment system in Norway functions well,” the report said. “This implies we should not proceed with undue haste.”

Norges Bank is also debating whether the current settlement system is fit for purpose or whether it should adopt the Eurosystem’s T2 framework. It is also talking to the European Central Bank on the possible participation on its possible participation in Target instant payment settlement.

“We will face important choices when designing the payment system,” said Longva.