IMF provides framework to analyse cyber risk for the financial sector

The increased risk of cybercrime is well known to all. Attacks against large companies has meant that the International Monetary Fund have taken action by publishing a working paper which predicts the average annual losses to financial institutions.

The IMF framework has provided a startling wake up call to the financial sector after it warned that annual losses faced by financial institutions could reach over three hundred billion US dollars. RPC have written recently discussing the rise in cybercrime and the impact it could have on insurance. However, the warning given means that such amounts may be above the limit of some insurance premiums and therefore mean companies end up in financial difficulty

The problem is no longer an academic one. Figures released by the Office for National Statistics (ONS) show that cyber-related crime against businesses increased by 63% in 2017. The figures however are likely to be even greater, as in 2016, it was estimated that only 30,000 of the 1.8 million cybercrimes were reported. Loss of revenue, future business and consumer confidence are just some of the outcomes of a cyber-attack.

Considering the severity of the threat from cybercrime, the IMF (in their working paper "Cyber Risk for the Financial Sector: A Framework for Quantitative Assessment") have created a framework, which can be used to calculate the annual potential losses to the financial sector. Financial institutions are typically more vulnerable to such attacks because of the amount of reliance they have upon highly interconnected networks.

The framework will be particularly useful for the financial services sector, given the requirement to hold risk capital for operational losses arising from cyber-attacks. The system is created by using actuarial science and operational risk measurement to provide an estimate of how much capital a firm needs to have in order to cover the losses.

Of most concern is the announcement that in 5% of the worst cases, the average loss could be half of the bank's net income, raising serious questions as to whether it could realistically survive. This will of course have wide reaching implications, not just for the financial sector, but for the economy as a whole.