UK banks on cyber threat alert, says BoE’s Haldane

Operational risk and cyber threats have jumped to the top of the list of major risk concerns flagged by many of the chief risk officers of the UK's largest banks, according to Andy Haldane, executive director for financial stability at the Bank of England.

Haldane told a UK Treasury Select Committee hearing this morning that he has regular meetings with the risk heads at UK banks to gain feedback about the potential risks that could hurt the financial sector. "In the prior meetings, the focus had been on the usual suspects, the euro crisis, the slump in the economy, asset prices going pop – but when we sat down six months ago and went around the table, four of the five identified cyber risk as being at the top of their lists," Haldane said.

The Bank of England official said it was "interesting" that the fifth firm didn't have the threat of operational problems or cyber-attacks on its list at all, but that situation had now probably changed.

Haldane said it was clear that the "understanding and management" of operational and cyber risk "is still at an early stage", and "what is true of financial firms is at least as true for financial infrastructure". But Haldane, who is also a member of the central bank's Financial Policy Committee (FPC), said attacking the UK's financial infrastructure would be a "good avenue to wreak havoc".

It was unclear if UK bank risk managers had upgraded their concerns about cyber risks due to reports about countries stealing sensitive information from institutions in rival nations, as well as more recent accusations that the US and UK security services have accessed private information of their citizens from major internet service providers.

Asked by the Committee who should be responsible for taking action to guard against cyber threats to the financial system, Haldane said "the overarching responsibility probably does lie with the government looking across sectors, and that currently is where responsibility resides".

"We, as the FPC and the Bank of England, do have some responsibility in respect of the financial sector to ensure its state of preparedness is adequate, that we understand where firms are and, as importantly, that we understand the interlinkages between firms," Haldane said. "So the Bank and FPC will have a role in addition to wider government, which will hold the ring on this."