A key part of this is to make certain that banks and financial markets perform their functions efficiently, and that their business poses no systemic threat to the financial sector and the economy. Hence, for a long time now, the main focus of bank regulation and supervision have been to ensure that banks manage their exposure to risk effectively. These include exposure to credit risk, market risk, liquidity risk, and operational risk. Much progress has been made in honing the approach for a more accurate assessment and a more effective management of risk, culminating in the Basle II, which is a global standard for bank’s risk management. BIS Review 18/2008  1  But, in spite of what has been achieved, mishaps can and do happen. From time to time, we still read about banks suffering large losses that originate from the under-management of these risks. More often than not, the losses are linked to a breach of internal controls or systems that have been put in place to rein in excessive risk-taking in the first place. Ladies and gentlemen. On the security risk aspect, the growth of electronic banking and real-time funds transfer have made the challenge of risk management even greater, as the nature of security risk to banks has shifted considerably. Clearly, the main concern now is not so much about ensuring property security or preventing theft of physical assets, but about ensuring information security and preventing identity theft.
The concern is not so much about control over access to restricted areas and cash vault, but about ensuring proper authorized access to the IT systems and the electronic funds transfer network. And the issue is not so much about keeping bank premises open after a major disaster, but about ensuring that all key banking operations and network continue to function uninterrupted under a proper business continuity plan. These are aspects of modern security risks to banks. They are part of the broader operational risks, which have received greater attention as the business of banking moves further and further away from face-to-face transactions. In Thailand, to address this challenge, we as bank supervisors, have over the past years provided best-practice guidance to the local banking industry in a number of important areas, including loss data collection, business continuity management and plan, IT security, outsourcing, and IT disaster recovery. In addition, Basel II will, for the first time, impose an explicit capital charge on banks for operational risks, on top of the traditional credit and market risks. Implementation of Basel II in Thailand will begin at the end of this year, and the preparation for its implementation is progressing on schedule. I am confident that with the implementation of Basel II, the quality of risk management by banks in Thailand, especially with respect to operational risks, will improve further. I have taken a lot of your time in this opening remark. But the topic of today’s seminar is important.