The Reserve Bank of Australia has warned that cyber security, cloud and AI are creating operational risks for the financial sector with potential “systemic implications” should things go wrong.
In a speech to the Australian Finance Industry Association Conference yesterday, the assistant governor of financial system Brad Jones declared the three digital technologies as an “outside risk” and threat to the stability of the sector.
He noted there was “no historical precedent to guide” the sector through emerging technology-enabled risk, adding that industry would ultimately be responsible for boosting their resiliency against adverse effects.
Jones predicted that AI, in particular, would “offer enormous opportunities for the financial system and wider economy, but [that] managing the associated risks will not be straightforward.”
He concurred with US Securities Exchange Commission chair Gary Gensler, who also warned that AI could magnify a shock on the financial system.
“Contagion and herding risk is one potential channel, where parties could come to rely on similar models and data aggregators that are trained on similar data and so generate similar actions – including in a crisis,” Jones said.
“Because the underlying models are complex and typically developed outside of the financial regulatory perimeter, system-wide vulnerabilities could be brewing in a way that is not obvious to financial institutions or supervisors.”
The use of outsourced technology services from ‘big tech’ companies also posed an operational risk, because the providers often sat “largely operating outside the financial regulatory perimeter,” Jones said.
“Banks and financial market infrastructures are considering moving some services to the cloud, and for sound reasons. But exposure is concentrated in a select number of service providers and an outage could leave many institutions unable to perform critical functions,” he said.
“Concerns about governance, risk management, platform concentration risk and responsiveness in a crisis have also been raised in respect to the use of emerging technologies by financial institutions, such as distributed ledgers.
“And in some jurisdictions, Australia included, ‘big tech’ has sought to move into payment services (including through digital wallets) without the regulatory oversight typically imposed on other financial service providers.”
Cyber risks were also ever-present, Jones said, though he noted that multi-faceted action across industry, regulation and government at least existed in that space.