Regional President Speech

EMBARGOED UNTIL April 4, 2016 at 10:15 A.M. U.S. Eastern Time OR UPON DELIVERY “Perspectives on Risks – Both Economic and Cyber” Eric S. Rosengren President & Chief Executive Officer Federal Reserve Bank of Boston Remarks at the Federal Reserve Bank of Boston’s 2016 Cybersecurity Conference Boston, Massachusetts April 4, 2016 * EMBARGOED UNTIL April 4, 2016 at 10:15 A.M. Eastern Time OR UPON DELIVERY * “Perspectives on Risks – Both Economic and Cyber” Eric S. Rosengren President & Chief Executive Officer Federal Reserve Bank of Boston Remarks at the Federal Reserve Bank of Boston’s 2016 Cybersecurity Conference Boston, Massachusetts April 4, 2016 Good morning. It is a pleasure to be able to welcome so many representatives of financial institutions to the Federal Reserve today, for what is an important program. An important role for leaders of financial institutions and their boards, of course, is monitoring and mitigating potential risks to their institution. Today I would like to briefly discuss, and offer my own views on, two areas of risk that I often hear about when I talk with bankers. At the outset, let me note as I always do that the views I express today are my own, not necessarily those of my colleagues at the Federal Reserve’s Board of Governors or on the Federal Open Market Committee (the FOMC). 1 * EMBARGOED UNTIL April 4, 2016 at 10:15 A.M. Eastern Time OR UPON DELIVERY * The first area of risk that I will comment on involves the economy. Early this year, concerns reemerged about the economic health of China and Europe, which led to significant volatility in both foreign and domestic financial markets. In reaction to that volatility, federal funds rate futures fell significantly, reflecting market expectations for only a very gradual increase in short-term interest rates. To preview my main point, my own sense is that financial markets may have reacted too strongly. My assessment is that the U.S. economy is continuing to improve despite the headwinds from abroad. If my forecast is right, it may imply more increases in short-term interest rates than are currently priced into futures markets – but, let me emphasize that my outlook still calls for a gradual pace of increases and, as always, the path should depend on incoming economic data. The second risk that I am going to touch on today is cyber risk, the primary focus of this gathering.1 It is a risk that institutions of all sizes are well aware of, and have been taking significant steps to mitigate. However, the ever-changing nature of the risk is why continued attention is so important. This is the topic that the speakers today are going to cover in some detail, I am pleased to say. For context, the risk of bank robbery or fraud had, in the past, been primarily a localized problem, with relatively few individuals able to pose a significant threat. With appropriate controls, the risks of large losses were quite low. However, with banking increasingly done via the internet and mobile devices, an attack can be conducted from anywhere in the world. Cyber criminals are looking for the targets of opportunity without regard to geographic location, and the existence of a global population of potential attackers looking for softer targets means 2 * EMBARGOED UNTIL April 4, 2016 at 10:15 A.M. Eastern Time OR UPON DELIVERY * increased risks. Without appropriate controls and defenses, the banking system could be at greater risk of a large loss – but fortunately, institutions of all sizes have been expending significant resources very strategically in this area,2 and bank supervisory examiners have been verifying that controls are in place. Nonetheless, as with the threat of terrorism – which has been so recently and tragically highlighted – cyber defense is an area where continued vigilance and continuous improvement are required. This has been a focus at the Boston Federal Reserve Bank, and the discussions today will touch on programs we are pursuing to support financial institutions as they continue to mitigate this risk. Economic risks Turning back to the economy, I would note that at the beginning of the year, problems in the domestic economies of many of the United States’ major trading partners began receiving significant attention. Several foreign central banks eased their monetary policy, and some financial markets became volatile. These global developments had an impact on U.S. financial markets, and many market participants began anticipating that U.S. monetary policy would be less likely to continue normalizing. Indeed, as of the end of last week, as shown in Figure 1, the federal funds futures market implied the belief that there would be roughly one more quarter-point increase by the end of 2016, and an additional quarter-point increase by the end of 2017. This extremely gradual path for reducing monetary policy accommodation would imply either a weak outlook for the 3 * EMBARGOED UNTIL April 4, 2016 at 10:15 A.M. Eastern Time OR UPON DELIVERY * economy or significant concerns that even if the expected outlook was benign, there were significant “tail” risks. My own view is that the outlook is not as weak, and the tail risks not as elevated, as would be implied by this very gradual path.3,4 Figure 2 shows that futures markets attach a 41 percent probability to just one increase by the end of the year, and a 38 percent probability to no change at all this year. In other words, the futures markets assign a very high probability of one or zero increases in rates by the end of this year. It is important to remember that these market probabilities can change significantly, and rapidly. When weaker economic data are released, the probability of tightening built into futures markets falls; conversely, when stronger data are released, the probability of tightening is seen as increasing. Figure 3 shows that over the past two months, the probabilities have shifted significantly. The probability assigned to seeing no change in the federal funds rate this year was less than 30 percent two months ago, rose to over 50 percent one month ago, and most recently has returned to 38 percent. One reason for these changing probabilities has been the weak economic data, particularly from abroad. Figure 4 shows that European and Japanese stock markets weakened significantly in the middle of February, and still remained well below their levels in the middle of December. Figure 5 shows that the declines in U.S. stock markets were more modest, and have now rebounded to levels prevailing in mid-December of last year. Not only have the levels of stock indices improved, but so has volatility – as shown in Figure 6. The VIX – a measure of stock market volatility – rose significantly in February and then fell thereafter. Currently the VIX is somewhat below the level of mid-December. 4 * EMBARGOED UNTIL April 4, 2016 at 10:15 A.M. Eastern Time OR UPON DELIVERY * The exchange rate has also been volatile, as seen in Figure 7. The dollar was stronger on a trade-weighted basis earlier in the year. However, currently the trade-weighted data are below the level of mid-December. This is similar to the pattern of bond spreads in Figure 8. While the spread was elevated in February, it is now below the levels seen in the middle of December. With financial market volatility subsiding since earlier this year, it is to me surprising that the expected path of monetary policy embedded in futures markets is so low. A weak forecast doesn’t seem to explain the path expected for the funds rate (see Figures, 9, 10, and 11 for context).5 As I see it, the risks seem to be abating that problems from abroad would be severe enough to disrupt the U.S. recovery. Financial-market volatility has fallen, and most economic forecasts do not reflect expected large spillovers from continued headwinds from abroad. So, while problems could still arise, I would expect that the very slow removal of accommodation reflected in futures market pricing could prove too pessimistic. While it has been appropriate to pause while waiting for information that clarified the response of the U.S. economy to foreign turmoil, it increasingly appears that the U.S. has weathered foreign shocks quite well. As a consequence, if the incoming data continue to show a moderate recovery – as I expect they will – I believe it will likely be appropriate to resume the path of gradual tightening sooner than is implied by financial-market futures. Cyber risk Turning to the second risk I will address today, I would say that while economic risks have arguably abated somewhat, the same cannot be said for cyber risk. News stories on cyber 5 * EMBARGOED UNTIL April 4, 2016 at 10:15 A.M. Eastern Time OR UPON DELIVERY * attacks and cyber fraud have become more prevalent. No CEO, in any industry, can feel comfortable with the barrage of stories related to cyber intrusions. The ability to conduct financial transactions over the Internet and through mobile devices has resulted in major innovations in financial services. Banks and other financial institutions have invested heavily in technology, and in keeping that technology safe. Of course, it is notable that banks’ business lines are also increasingly challenged by new organizations that are primarily electronic. To the extent that so-called “fintech” entities compete directly with banks with similar products, they are not burdened by large brick and mortar operations or the regulatory oversight that comes with being a bank. It is important to examine whether these new innovators have fully captured the risks of economic downturns and the implications for their lending model. Whether or not customers fully appreciate that depositlike accounts do not carry deposit insurance, remains to be seen. Customers are looking for convenience; so not surprisingly, new applications and devices continue to evolve in new and unexpected ways. However, this rapid evolution generates risks. A proliferation of apps increasingly focused on customer convenience may not always focus as intensely on security. In addition, the consumer, rather than the financial institution, can often be the entry point that cyber criminals seek to exploit. I mention fintech because clearly banks must continue to evolve with and invest in these financial services innovations, and therefore should be attuned to the cyber risks that come with online and mobile delivery.6 The cyber criminal can be anywhere there are computer links. They may very well be hard to find, submerged in the large volume of transactions and data handled by financial institutions. But they also have the potential to launch massive attacks, 6 * EMBARGOED UNTIL April 4, 2016 at 10:15 A.M. Eastern Time OR UPON DELIVERY * quickly ballooning from complete anonymity to a large-scale threat. These challenges make it important that CEOs, management, and boards of directors understand the risks that are posed. Ideally, cyber thefts can be significantly mitigated. Maintaining good cyber security and keeping personnel and software up to date is critical. However, it is important to be able to quickly understand what is happening to other organizations and even across industries. As you will hear later today, the Boston Fed tries to be quite active in this regard, to make sure that news of threats gleaned by the central bank or other financial institutions quickly becomes known, and that appropriate actions are taken. I would also highlight the importance of having protocols ready, should a breach occur. Resiliency is important, as is recovering critical operations in a timely fashion. Finally, having a communication plan to address concerns of customers, vendors, and regulators – with a clear understanding of where decision rights are held – can mitigate problems in the event of a breach. Of course, bank regulators and supervisors from the Fed and other agencies are attuned to cyber risks, and work with financial institutions on an ongoing basis to ensure defenses are robust and opportunities for the spread of problems are constrained. Cyber risks make it imperative that we all work together to ensure that resiliency, monitoring, detection, and recovery capabilities are operational in the financial system. Concluding Observations In summary and conclusion, I would observe that some of the economic concerns from earlier this year seem to be receding. As the economic risks abate, financial market expectations 7 * EMBARGOED UNTIL April 4, 2016 at 10:15 A.M. Eastern Time OR UPON DELIVERY * of a very slow removal of monetary policy accommodation could, it seems to me, prove unduly pessimistic. I personally expect that a stronger economy, at essentially full employment and with gradually rising inflation, will lead to more tightening than is currently priced into the futures market expectations for the next two years. The risks in the cyber realm are, unfortunately, not abating. Banking organizations need to continue to evolve as these risks morph, and as new innovations and expectations of convenience introduce new challenges to security. I hope the discussion over the course of today will help prepare you for those challenges. Thank you. 1 For additional perspective on cybersecurity as a financial stability issue, see January 2015 remarks by Eric S. Rosengren at: http://www.bostonfed.org/news/speeches/rosengren/2015/013015/013015text.pdf 2 Of course, cyber risk also encompasses third-party service providers to financial institutions, so there is a need for vigilance in managing these relationships and entry points. 3 Note that the Federal Reserve Board of Governor’s Advance release of table 1 of the Summary of Economic Projections has a steeper path particularly in 2017. However, this reflects modal forecasts and may not capture the tail risks that may be priced into the futures market. See the table at: http://www.federalreserve.gov/monetarypolicy/fomcprojtabl20160316.htm 4 The higher SEP forecasts were revised down about one-half percentage point from the December forecasts, as Committee members responded to international developments and the implications for the U.S. economy. However, even after this adjustment, the path is steeper than captured in the federal funds futures rates. 5 As previously suggested, one possible explanation could be a very weak private sector forecast for the economy. However, the policymaker forecasts in the March SEP expect a declining unemployment rate, a rising core inflation rate, and a real GDP forecast quite similar to the current economic forecasts from most of the private sector forecasters – and not much different than we have experienced over this economic recovery. So, a weak forecast doesn’t seem to explain the low path expected for the funds rate. The path could suggest that the market is weighing the risks from abroad more heavily than I am. 6 Obviously, the traditional model of knowing customers at the branch provides little protection when business takes place over network connected devices. 8 

Eric Rosengren (2016, April 3). Regional President Speech. Speeches, Federal Reserve. https://whenthefedspeaks.com/doc/regional_speeche_20160404_eric_rosengren

@misc{wtfs_regional_speeche_20160404_eric_rosengren,
  author = {Eric Rosengren},
  title = {Regional President Speech},
  year = {2016},
  month = {Apr},
  howpublished = {Speeches, Federal Reserve},
  url = {https://whenthefedspeaks.com/doc/regional_speeche_20160404_eric_rosengren},
  note = {Retrieved via When the Fed Speaks corpus}
}