Judge how cyber and ICT risks interact with financial risks, and show how cyber and ICT incidents at financial institutions can grow into systemic financial risk.
The idea
A cyber or ICT incident is first an operational event, but it moves into financial risk through several channels. Payment outages and trapped intraday balances create liquidity stress. A loss of confidence can trigger deposit withdrawals or withheld funding. Disrupted borrowers weaken credit quality, corrupted or unavailable data distorts prices and trading, and direct costs and fines reduce capital. It becomes systemic when it impairs a critical function that cannot be quickly substituted. It also becomes systemic when many firms share the same vendor, software or network, so that failures are simultaneous. Interconnection and information asymmetry amplify this. Participants cannot tell who is affected, so they withdraw from everyone, which can force asset sales. Exam point: systemic risk comes from common exposure, connectedness and confidence, not from the size of one firm's direct loss.
A practice question
Which feature most clearly turns a cyber incident at one institution into a potential source of systemic risk?
- The attack was technically sophisticated and used previously unknown vulnerabilities.Why not: Confuses attacker sophistication with systemic impact; a sophisticated attack on a substitutable firm stays contained.
- The direct loss at the affected firm is large relative to its own annual profit.Why not: Focuses on firm-level loss; systemic risk depends on connections and substitutability, not on the firm's own loss alone.
- The institution's shares are listed on a stock exchange and trade in large volumes.Why not: Treats listing as a transmission channel; being listed does not create operational dependence by others.
- It performs a critical function with few substitutes, or is closely connected to many firms. - correct
Systemic impact arises when a critical function is impaired and cannot be quickly replaced, or when connections spread the disruption. Firm-level loss alone does not make an event systemic.
A harder one
A ransomware attack takes a mid-sized bank's payment systems offline for three days. Which financial risk most directly materialises first?
- Credit risk, as all of the bank's borrowers default within the three days of the outage.Why not: Confuses a slow, indirect effect with the immediate one; borrowers do not default because of a short payment outage.
- Interest rate risk in the banking book, as market rates move because of the attack on the bank.Why not: Attributes the outage to a rate move; the incident does not change market rates.
- Liquidity risk, as payments cannot be settled and counterparties may withhold funding. - correct
- Model risk, as the bank's valuation and pricing models are made invalid by the outage.Why not: Confuses unavailability of systems with flawed models; models are not made invalid by an outage.
The immediate transmission of a payments outage is liquidity: inability to send or receive funds and loss of counterparty confidence. Credit and capital effects follow later.
The hardest tier
A banking system has deposits of USD 2,000 billion. A cloud outage affects banks holding 45 percent of the deposits. Affected customers withdraw 6 percent of those banks' deposits, and the affected banks hold liquid assets equal to 4 percent of their deposits. The shortfall at the affected banks is closest to:
- USD 18 billion - correct
- USD 54 billionWhy not: Reports the gross outflow (6% x 900) and ignores the liquid buffer that offsets it.
- USD 36 billionWhy not: Reports the liquid buffer (4% x 900) instead of the net shortfall after the outflow.
- Roughly USD 84 billionWhy not: Applies the 6% run to all USD 2,000 billion of deposits instead of only the affected 45 percent, then deducts the buffer.
Affected deposits = 0.45 x 2,000 = 900. Outflow = 0.06 x 900 = 54; buffer = 0.04 x 900 = 36; shortfall = 54 - 36 = 18 (USD billion). The incident becomes systemic because one provider hits many banks at once.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →