The Reserve Bank (RBA) has categorised the threat of cyber incidents to financial institutions and the broader financial system as high.
In its latest Financial Stability Review, the RBA referenced the recent Optus cyber incident, noting that it “demonstrated that there can be indirect implications for the financial system of cyber attacks”.
“This, along with a number of other large-scale cyber incidents over the past year, has highlighted the need for regulators and financial institutions to continue building cyber resilience,” the central bank said.
It welcomed the government’s action towards removing legal barriers to Optus temporarily sharing approved customer data with financial institutions to allow them to implement enhanced monitoring.
“APRA has instructed banks to tighten their controls further where possible to limit the risk of fraud. A cyber attack of this size has potential systemic implications, as an increase in fraudulent activity associated with the leaked information could undermine confidence in banks,” the RBA said.
It also flagged climate change as a “key long-term risk for the financial system”, one that will “need to be carefully managed by financial institutions”.
“The Australian financial system is vulnerable to physical risks through direct losses on assets from climate events, and transition risks that arise from changes to policies and the economy in the move towards lower emissions,” the RBA said.
The bank also suggested that the major banks’ continued link to financial thermal coal could be forgiven given their collective commitment to restrict lending to the sector.
“It will take time for financial institutions to adjust their lending and risk management practices in response to the risks and opportunities from climate change,” the RBA said.
The bank noted that Australian financial institutions are also still in the process of embedding climate risk into their risk management frameworks, with a recent APRA self-assessment survey finding that 23 per cent of institutions did not have metrics to monitor climate risks.
“Financial institutions will need to continue to invest in systems and processes to understand and manage climate-related risks, including by collecting, analysing and disclosing appropriate data; work done by global and Australian regulators on climate-related disclosures and taxonomies should assist with this,” the RBA said.
In August, the head of domestic markets at the RBA, Jonathan Kearns, stressed in a speech to the Credit Law Conference in Sydney that climate change can significantly affect the prices of assets if it reduces future cash flows and makes them more volatile.
“Climate change risks can manifest in different ways for different types of financial entities. If financial entities mismanage their climate risks, they are also exposed to liability risk,” Mr Kearns said.
Mr Kearns urged financial market participants and regulators to “act now to best manage the financial risks and facilitate the associated opportunities”.
Currently in Australia, the five largest banks are conducting a Climate Vulnerability Assessment under the guidance of the APRA.
This exercise, Mr Kearns explained, should assist the Council of Financial Regulators’ (CFR) work regarding the development of climate-related disclosures.
Average temperatures in Australia have risen 1.4 degrees since 1910, and climate scientists are predicting that with current policies, average temperatures will rise around 2.7 degrees above pre-industrial levels by 2100.
“We have seen how climate change is already affecting people’s lives in Australia and around the world, and it will keep doing so”, Mr Kearns said at the time.
“But our actions over the coming years will obviously affect the ongoing path of climate change.”
