In historical terms, the real exchange rate has only remained so high for short periods. The Central Bank thus openly stated its view that the exchange rate was unsustainably high and must weaken. However, the timing and pace of the depreciation was unknown. BIS Review 60/2007  1  Following the privatisation programme that was completed in 2003, the Icelandic banks expanded very rapidly. Privatisation unleashed an enterprising spirit and the resolve and ambition to enter new territory. The banks sharply stepped up their activities outside Iceland by acquiring foreign financial companies and establishing branches. These radical changes are reflected in the growth of the three largest Icelandic banks’ total assets from the equivalent of 96% of GDP at the end of 2000 to roughly eightfold GDP at the end of 2006. A distinctive feature of Iceland’s financial sector is that no foreign banks operate directly in the country. However, the domestic banks have become less Icelandic, so to speak. The greater part of their operations are now in other countries. The bulk of their revenues and profits are generated abroad, in the other Nordic countries, the UK, Luxembourg and elsewhere in Europe. As a result, their revenue base is significantly broader and they are less exposed to cyclical fluctuations in the Icelandic economy than before. All the same, if the Icelandic economy were to weaken significantly, reports about it could affect the banks’ potential for securing foreign financing.
3  http://www.bankofengland.co.uk/publications/Pages/fsr/2015/jul.aspx. 4  http://www.bankofengland.co.uk/financialstability/fsc/Pages/cbest.aspx. 2  BIS central bankers’ speeches  2. Recovery capabilities  3. Effective governance  1. Defensive capabilities  Yesterday’s Financial Stability Report (FSR) describes defensive capabilities as capabilities that “enable firms to identify and withstand attack.” This is important from a financial stability point of view not only for those firms that, as part of the cyber programme, we have identified as ‘core’ to the sector, but also relevant to their suppliers and other firms they trade with. It implies a level of resilience that goes beyond basic cyber hygiene but aims instead to ensure that firms are in a position to manage Advanced Persistent Threats (APT). While not wanting to go into too much detail on the cyber work programme 5, three key themes are relevant here. •  The first is that cyber is not just about technology. People matter. More often than not attackers may seek to exploit potential weaknesses in personnel, to establish a bridgehead for attacks. It is therefore essential that firms have the right arrangements in place so that all staff understand cyber risk and their responsibilities for information assurance. •  The second is that cyber requires investment. In people and in systems. Underinvestment in cyber defences may mean that firms are behind the game in terms of their ability to respond to crystallised threats. For example, they could risk misdiagnosing a cyber attack as an internal IT failure rather than a deliberate attack.