Cyber-Crime, Securities Markets, and Systemic Risk

Abstract

About this Document The IOSCO Research Department produces research and analysis around IOSCO Principle's 6 (on systemic risk) and 7 (reviewing the perimeter of regulation). To support these efforts, the IOSCO Research Department undertakes a number of annual information mining exercises including extensive market intelligence in financial centres; risk roundtables with prominent members of industry and regulators; data gathering and analysis; the construction of quantitative risk indicators; a survey on emerging risks to regulators, academics and market participants; and review of the current literature on risks by experts. This holistic approach to risk identification is important in capturing those potential risks that may not be apparent in the available data (i.e. not necessarily quantifiable), or which may be currently seen as outside the perimeter of securities market regulation-but nonetheless relevant. One potential risk that has been strongly and consistently highlighted during recent risk identification activities (and in the 2012 IOSCO Securities Market Risk Outlook) is cyber-crime, especially as it relates to financial market infrastructures. As a first step towards engaging with this issue, the IOSCO Research Department, jointly with the World Federation of Exchanges, conducted a cyber-crime survey of the world's exchanges. This IOSCO Staff Working Paper Cyber-crime, Securities Market and Systemic Risk presents the results of this survey, as well as key insights on the current cyber-threat landscape and potential systemic risk aspects. This report and survey is intended as part of a series exploring perspectives and experiences with cyber-crime across different groups of securities market actors. The purpose of the series is predominantly to: (1) deepen understanding around the extent of the cyber-crime threat in securities markets; (2) highlight potential systemic risk concerns that could be considered by securities market regulators and market participants; and (3) capture and synthesize into one document some of the key issues in terms of cyber-crime and securities markets in order to increase general understanding and awareness.