Clearing in its simplest and original form simply refers to mechanisms for adding up each member’s claims and liabilities to the other members before settlement so only the net amount is paid or owed. The earliest clearing houses were places where banks literally put the receipts recording their respective claims and liabilities on the table at the end of the day so they could be netted off against each other. Such clearing mechanisms still operate in some payment systems though the most important payment systems that settle the highest value payments nowadays operated by central banks work on a gross basis in real time to reduce risk. (Real-time gross settlement of high value payments allows immediate, final and irrevocable settlement of obligations across central bank accounts.) However, we still talk of payments in a currency ultimately ‘clearing’ across the books of the central bank of that currency, for example as in ‘dollar clearing’ across the books of the New York Fed. Central clearing, however, does not mean the clearing inherent in payment systems but the infrastructure that allows financial market participants to manage the risks they face from their counterparties in financial contracts that can last for months or even decades.
In the UK, the Financial Policy Committee of the Bank of England (FPC) formally recognised this risk to financial stability in June 2013. It recommended that the authorities should assess, test and improve the resilience of core parts of the UK financial sector to cyber attack. The FPC has maintained oversight of this programme of work which has included a number of strands, not least the ‘CBEST’ vulnerability testing of critical financial firms and FMIs. 15  Improving resilience to cyber risk is one part of the Bank’s wider work on broader operational resilience. Operational resilience is not a technical issue, especially for the infrastructure firms that need to act as ‘systemic risk managers’. It must begin in the boardroom. The Bank has worked with supervised firms to improve governance, so that standards can be maintained or strengthened, and threats responded to, without regulatory or supervisory pressure. The Bank of Bangladesh incident also shows why, given the critical nature of the services provided by SWIFT, effective international coordination in its oversight is essential. Oversight of SWIFT is led by the National Bank of Belgium (NBB) as SWIFT is a Belgian company. However, the NBB has for many years conducted the oversight of SWIFT in coordination with other central banks, including the Bank of England. These arrangements proved important in maintaining the confidence of regulatory authorities worldwide in the aftermath of the attack. And the oversight arrangements have now been extended in scope to cover the implementation of the crucially important customer security programme.