On average, greater intermediation would likely support more economic activity in the short-run but with a higher probability of disruption later on.7 Finally, point C represents an outcome from a policy regime that is not efficient. A different mix of policies could increase intermediation or decrease risk (or both) with no associated trade-offs. Point C is never a good outcome. Examples of such policies might be a burdensome compliance regime for activities that a bank doesn’t engage in, redundant data requests from the official sector, or a risk management system that does not address the most material risks. To summarize, both point A and point B can be thought of as efficient outcomes, where the only way to support more financial intermediation is to accept higher risk. To be clear, one point on the efficient policy frontier is not necessarily better than another, and changes in policy to move between them reflect policymakers’ choices to promote social welfare. By contrast, point C is inefficient, and changes in the policy mix that push outcomes toward the efficient frontier are likely to be welfare-enhancing. The official sector should always be looking for opportunities to move the financial sector toward the frontier.
Rather, building upon the theme of your prior panel discussion, the risk that dominates from my parochial view is the escalating and evolving cyber threat to our financial and payment systems, representing the challenge of our generation. The orientation that I want to pursue, reflecting this audience, is not what we are doing within the Federal Reserve to harden our critical infrastructure. While that is a manic and consuming preoccupation it is not my focus today. Instead, I want to concentrate on endpoint security vulnerabilities to the payments system, in which partnership with the institutions in this room represents an indispensable element of success. Historically, market infrastructures have operated on the presumption that endpoint security is 1/4  BIS central bankers' speeches  principally the responsibility of the endpoint, and infrastructure security is principally the responsibility of the operator. In the United States, the legal framework for wholesale funds transfers codifies that presumption, with each actor assigned responsibility for that part of security most within its control. Yet, in the present environment endpoint security breaches can have serious implications for public confidence in the integrity of the network as a whole, even in circumstances when the operator’s infrastructure, applications, and security perimeter have not been compromised. A series of recent high profile events have underscored dramatically this endpoint security risk, a theme that has also captured the attention of global policy makers.