There are many examples of fraud that undermines said trust, such as identity theft when opening payment accounts, in “know your customer” procedures or to arrange and draw loans and credit; payment fraud, mainly in card transactions, transfers and remittances; and fraudulent offers of financial operations or services by unauthorised or unregistered operators, which are typically a prelude to actual fraud. More recently, though, new technologies and business models have paved the way for platforms and operators that, engaging in regulatory arbitrage, offer payment, credit or investment services without sufficient safeguards and transparency. Here I would specifically mention operators in the crypto-asset arena, which promise handsome rewards via apps, websites and apparently innocuous advertising, and sometimes even embed such offers in traditional payment service chains, making them harder to identify. Unfortunately, these practices do not distinguish between social groups, levels of financial literacy or risk profiles, and ultimately take a far greater toll on the more vulnerable groups, in particular young people and even teenagers, which is of particular concern. Against this background, and notwithstanding any action that might be taken by the public prosecution service, the courts or law enforcement authorities in relation to criminal offences, our role as supervisors is primarily a preventive one. This means oversight of advertising, ensuring that the registry of operators is fit for purpose and, very importantly, raising awareness of the risks among potential users and fostering their financial and digital education.
They must provide the tools for first responders to react quickly and investigate the source and impact of breaches, compromises and incidents. Most essentially, there is a need to balance the right mix of investments across prevention, detection and response capabilities vis-à-vis an organisation’s risk appetite. Not only are new and advanced tools needed to supplement existing protection solutions, but also new skills and culture need to be developed within existing security teams and the larger organization, more so within the ambit of digital financial services whereby regulatory compliance plays a major role in cybersecurity. 2/3  BIS central bankers' speeches  Regulatory compliance does not equal cybersecurity Regulations are designed to protect organisations, clients, and consumers against the potentially devastating consequences of cyber-attacks. Regulatory requirements for financial institutions have undeniably become tougher, and organisations are continuously burdened by the need to interpret what a fragmented global regulatory landscape means for their operations. Financial institution often find themselves chasing regulatory compliance, rather than leading independent security planning. Regulatory compliance by itself is not cybersecurity. When new cybersecurity requirements or frameworks are published, organisations must first determine their current security state and identify gaps. If routine testing and remediation are conducted, being compliant or meeting regulations should be easier to achieve. Of course, some parties will want or need to go above and beyond regulations. Too often, however, organisations find themselves in reactive mode.