In other words, perhaps uniquely in the constellation of the Federal Reserve System, my colleagues and I work for you. My standing before you represents a visceral reminder of our accountability to depository institutions, independent of size, which rely upon our services to send and receive time critical payments; to maintain and permit the transfer of Fedwire eligible securities; and to provide cash services to support the needs of consumers and commercial establishments. It is with this orientation that I offer these remarks today, which reflect my own views and do not necessarily represent those of the Federal Reserve Bank of New York or the Federal Reserve System. The theme of today’s conference, appropriately, has been “Navigating Future Risks for Community Banks”. Allow me to elaborate upon the single risk that dominates from my vantage, regrettably not a “future risk” but an all too present one, and to highlight some of the measures that we are taking in response. The risk to which I refer is not a function of regulatory pressure, or capital demands, or an evolving economy, or compliance challenges, or the proliferation of new technologies, or an unprecedented season of payments innovation, or the challenging competitive landscape. All of these may represent very real risks, and no doubt occupy your consciousness, to borrow the lyrics of a prior generation, “eight days a week”.
Rather, building upon the theme of your prior panel discussion, the risk that dominates from my parochial view is the escalating and evolving cyber threat to our financial and payment systems, representing the challenge of our generation. The orientation that I want to pursue, reflecting this audience, is not what we are doing within the Federal Reserve to harden our critical infrastructure. While that is a manic and consuming preoccupation it is not my focus today. Instead, I want to concentrate on endpoint security vulnerabilities to the payments system, in which partnership with the institutions in this room represents an indispensable element of success. Historically, market infrastructures have operated on the presumption that endpoint security is 1/4  BIS central bankers' speeches  principally the responsibility of the endpoint, and infrastructure security is principally the responsibility of the operator. In the United States, the legal framework for wholesale funds transfers codifies that presumption, with each actor assigned responsibility for that part of security most within its control. Yet, in the present environment endpoint security breaches can have serious implications for public confidence in the integrity of the network as a whole, even in circumstances when the operator’s infrastructure, applications, and security perimeter have not been compromised. A series of recent high profile events have underscored dramatically this endpoint security risk, a theme that has also captured the attention of global policy makers.