In June 2016, the Financial Stability Oversight Council (“FSOC” or the “Council”) released its Annual Report.  The Council discussed the continued “pressing concern” of cyber threats and vulnerabilities and also focused on emerging innovation in FinTech and the risks imposed by new technologies.  FinTech innovation is occurring with new financial products, delivery mechanisms, and business practices such as marketplace lending and distributed ledger position.  The Council noted that these can lower transaction costs and improve efficiency, but also acknowledges the attendant risks.  The risks include credit risk associated with the use of untested underwriting models and embedded risks that are difficult to foresee.  

The Council acknowledged that companies in the sector have made significant investment in cybersecurity in the past few years but urged companies to continue.  It noted that cybersecurity incidents create significant operational risk.  This risk impacts critical services in the financial system, which ultimately affects financial stability and economic health.

FSOC made three specific recommendations to build on prior recommendations:

• Information Sharing – The Council recommended continued development of efforts to improve information sharing. Information that should be shared includes the full scope of information useful to cybersecurity professionals, which includes technical details, how the incident developed, and what tools and tactics were used.  The Council also appealed to various agencies including the Treasury and the Department of Homeland Security to support efforts to implement the cyber-sharing provisions of the Cybersecurity Act of 2015.
• Baseline Protections – The Council recommended the adoption of the National Institute of Standards and Technology Framework for Improving Critical Infrastructure for Cybersecurity (the “Framework”).  The Framework is an evolving guide, but the Council recommended it to be used as a basis to establish a common-risk based approach and that its lexicon should be adopted.  The Council also identified cross-sector coordination with those in the energy, telecommunications, and technology sectors as crucial.
• Response and Recovery – The Council described how a significant cybersecurity incident affecting the financial services sector has the potential to affect financial stability.  It appealed to government agencies and the private sector to prepare to respond to such incidents through developing robust sector-wide plans for responding to a significant cybersecurity incident.  

On innovation, the Council noted its critical place in the long-term health of the U.S. financial system.  It defined innovation in this area as the means by which market participants respond to changing marketplace demands, make use of new technology, and adapt to evolving regulatory constraints. The Council identified new financial products, delivery mechanisms, and business practices as offering improved efficiencies and lower costs while noting they may also embed risks that are difficult to foresee. 

The Council keyed in on two specific evolving practices, marketplace lending and distributed ledger systems.  With marketplace lending the Council noted specific risks in the evolving practice due to reliance on untested algorithmic underwriting and the possible deterioration in underwriting and loan administration standards.  On distributed ledger systems, the Council noted risks associated with the limited experience market participants have working with these systems, citing examples of Bitcoin trade delays that have increased dramatically.  Distributed ledger systems can reduce the reliance on certain market infrastructure, which was relied upon by regulators to regulate market activity.  These systems can also span regulatory boundaries, making oversight and enforcement difficult.  The Council urged regulators to continue to monitor and evaluate the implication of how new practices and products affect regulated entities and financial markets to see if they may pose risk to financial stability.

In addressing evolving FinTech innovation and cybersecurity in its Annual Report, FSOC underscored the importance technological developments play in ongoing financial stability.  Expect the Council to continue to monitor these trends and make these issues a priority.