Since 2015, cybersecurity issues attract an increasing level of attention, and regulators have produced a large number of regulatory texts, both at national and international levels. This was called for to trigger the appropriate response and efforts from the industry. It helped the sector to reinforce its safeguards. Nevertheless, we must ask ourselves whether the multiplication of new regulations can have a counterproductive effect. From the panelists’ interventions, two issues need to be addressed: • First, we should avoid the possible proliferation of texts by standardsetters for banking, payments, securities services, insurance and/or financial markets. The FSB has already provided such evidence in a stock-taking exercise performed in 2017. Regulators are paying attention to cyber risks, and while they share the same objectives, regulatory texts tend to differ across regulators and as a result add to firms’ burden in terms of compliance with these various regulations, with  Page 3 sur 6 little marginal gain. Clarity would be enhanced by reducing the multiple variations in the formulation of requirements across institutions. In turn, regulators’ efforts would be streamlined and their experts employed more effectively. How can we better coordinate regulation? Obviously, a “principle-based” regulation on cybersecurity is preferable, rather than increasingly prescriptive standards, too rigidly “rules-based”. Supervision completes regulation. Principle-based regulation would give supervisors some room for manoeuvre to modulate their expectations to the risk profile of the institutions. • But then, we should also pay attention to the risk of regulatory arbitrage. Regulatory differences can create opportunities.
If not all regulations are aligned, some private actors could (re)locate their IT systems in less-demanding jurisdictions. This is the reason why we need homogeneity among international regulatory texts with the largest outreach. Who could lead this coordination role on cybersecurity regulation? The G7 expert group has been extremely successful in producing “Fundamental elements”, but this group has no standard-setting role and its texts can only guide regulators in their work. I believe the FSB is best placed to engage the dialogue with the various standard-setters to foster the alignment of their texts, as well as to conduct global outreach, and limit the proliferation of working groups. II. Information Cyber threats are increasing, but adequate and consistent measurement is challenging. I would like therefore to make two proposals: About incident reporting. Many reporting obligations on cyber incidents have emerged, requested by various authorities. But these incident reports give little  Page 4 sur 6 information to measure the intensity and sophistication of threats and their evolution. The indicators requested vary from one report to another and this limits the scope of diagnosis and comparisons. The institutions themselves can struggle to transmit information about their incidents in different formats and with different details to the various authorities in charge. FSB agreed on a “cyber lexicon”. 1 As we have done in the past for operational risk, I recommend that we work on a common categorization of cyber incidents to better measure the impacts of attacks, and better understand their evolution. About information sharing and threat intelligence.