The system’s vulnerability can be reduced in a number of ways, for example through wellestablished cooperation within the financial industry and between the industry and the authorities, sound security procedures and recovery capabilities. System owners are responsible for the resilience of their own systems. Norges Bank monitors the systems under its supervision to ensure that satisfactory defence mechanisms are in place. A number of payment system participants have outsourced the operation of their systems to a few ICT service providers. This is a source of concentration risk. The failure of key service providers could bring important parts of the payment system to a halt. The problems at EVRY on 6 October 2017 affected approximately 40 banks in Norway, as well as Norway Post and Telenor. This incident illustrates the potential broad repercussions of the failure of a key ICT service provider. Such concentration risk is difficult for individual system owners to address alone. The entire infrastructure served by the provider is exposed to risk, not merely the individual system. ICT service providers are not subject to the same regulation and supervision as licensed banking and payment system participants. It is Norges Bank’s view that the authorities should explore how 3/5  BIS central bankers' speeches  key ICT service providers can best be supervised. Such an evaluation must be based on the work of the ICT Security Commission, which publishes its report in December 2018. Distributed ledger technology Distributed ledger technology (DLT) offers interesting opportunities.
When the P27 initiative was announced, the BRO project was put on hold in order to consider whether a future common Nordic infrastructure as proposed by the P27 banks could be a satisfactory replacement. Norges Bank has engaged in joint discussions with the other Nordic central banks since P27 was launched. The central banks have given preliminary feedback on the P27 project and appreciate the project’s ambition to improve payment system efficiency in the Nordic area. At the same time, there are issues that need to be addressed before the authorities can take a position on any transition from domestic infrastructures to a common Nordic solution. This process may take time and will also involve authorities other than the central banks. Security legislation is one of these issues. If P27 is realised, it will probably be viewed as an important critical infrastructure for the countries involved. National security concerns may influence the conditions governing whether a payment system infrastructure can be operated across national borders. In the case of Norway, one likely condition could be that satisfactory contingency arrangements must be in place in Norway. Domestic control of the payment system must be possible in a crisis. The European Central Bank has launched a European solution for real-time payment settlement in central bank money called Target Instant Payment Settlement, or TIPS. The system is scheduled to commence operations this month and may be expanded to include non-euro area countries.