Cyber attacks pose the most serious threat to US financial institutions and the system as a whole, the chief executives of four of the nation’s largest banks told Congress yesterday.

Asked by Representative Bill Huizenga of Michigan to name the biggest risk facing the financial sector, the CEOs of Citigroup, Goldman Sachs, Morgan Stanley and Wells Fargo each singled out cyber threats.  

“Cyber, and specifically the potential impact on consumer data and data privacy,” said James Gorman, CEO of Morgan Stanley.

Charles Scharf, Wells Fargo’s CEO, simply replied: “Cyber”.

David Solomon, CEO of Goldman Sachs, named “cyber, central clearing risk and growing government debt around the world”.

Jane Fraser, Citigroup’s CEO, also picked out cyber security. “[It] keeps all of us up at night,” she said.

The bank CEOs were testifying at a hearing of the US House Financial Services Committee on May 27.

The CEOs of Bank of America and JP Morgan pointed to other concerns. “As a financial institution, the number one question is what the economy is going to do,” said BofA’s Brian Moynihan, while JP Morgan’s Jamie Dimon said he was worried about “public policy not being properly executed”.

Cyber attacks on banks have escalated since the onset of the Covid-19 pandemic, with the growth in digital banking and the shift to remote working providing an opportunity for hackers to target weak spots in banks’ defences. The deluge of cyber attacks shows no sign of subsiding. The Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) issued a joint warning on heightened cyber risks in January.

US president Joe Biden responded by issuing an executive order (14028) on cybersecurity on 12 May 2021.  

At a hearing of the Senate Banking Committee on Wednesday (May 26), Senator Bill Hagerty of Tennessee said the US Congress was prepared to introduce legislation to tackle the problem.   

“You’ve got bipartisan support here in the United States Senate to address this significant problem and I think with our largest banks we can make significant progress and set the standard, frankly, for our entire financial system,” Hagerty said.

US Treasury Secretary Janet Yellen has also signalled that the Financial Stability Oversight Council (FSOC) will examine cyber security at an upcoming meeting on 31 May 2021.

However, external experts say regulations and new laws will do little to thwart cyber attacks, and could even be counterproductive. “Multiple uncoordinated or piecemeal cybersecurity regulations and laws can actually make managing cyber risk both more difficult in terms of compliance, cost and transparency,” analysts at Fitch Ratings wrote in a note published on 25 March 2021.

They called for increased global coordination on cyber security and enforcement—a point echoed by Citigroup’s Fraser at the hearing. She described the sharing of intelligence as “critical” and said US intelligence agencies should play a bigger role in defending companies against cyber attacks.

To date, cyber attacks have not resulted in ratings downgrades for banks, but that may change. On May 24, S&P Global said it expected cyber-attacks to trigger more rating actions as cyber incidents become more frequent and complex.

S&P says it will consider cyber risks at both system-wide and entity-specific levels, and will scrutinise banks’ risk management policies, resilience and contingency plans in the event of attacks when making rating decisions.