Could a cyber attack cause a systemic impact in the financial sector?

There is not a uniform view of the link between cyber risk and systemic risk: some assume a direct link whereas others query the connection. Beyond nation states, the vast majority of independent cyber attackers are currently unlikely to have the capability to systemically impact the financial sector. The financial sector has a large number of environmental features which are conducive to a systemic cyber compromise. There are no current examples of systemic cyber risk crystallising and impacting the real economy but this does not prove an absence of risk. We conclude there is a credible case to link cyber risk to systemic risk in the financial sector. Recommendations for future consideration include: – Further development of the intelligence-led approach to cyber security. – Policy responses that seek to cut through sectoral, geographical and public/private boundaries. – Organisations should accept that compromises are likely to happen and therefore prioritise response and recovery activities. – Undertake further studies to better understand the relationship between data integrity and authenticity, trust in financial services and the potential for real-economy impact via a cyber attack. – A specific focus on risks associated with third-party dependencies.