Board of Governors of the Federal Reserve System

As part of its market intelligence gathering, Federal Reserve staff solicited views from a wide range of contacts on risks to U.S. financial stability. From August to mid-October, the staff surveyed 26 market contacts, including professionals at broker-dealers, investment funds, political advisory firms, and universities. Since the previous survey results published in May, concerns related to inflation, new COVID variants, and elevated risk-asset valuations have remained top of mind, while several new risks have surfaced, including possible fallout from Chinese regulatory changes, the risk of a sharply declining fiscal impulse, and the prospect of monetary policy tightening into a slowdown. Some other risks that ranked highly earlier this year declined in prominence, including fears of a disruptive rise in interest rates from heavy Treasury issuance and concerns related to increases in bank reserves. This discussion summarizes the most cited shocks in this round of outreach.

Persistent inflationary pressures

A majority of respondents cited the prospect of inflation pressures being more persistent than anticipated. A few noted that longer-lasting supply constraints in various product and labor markets could sustain inflation at elevated levels and potentially contaminate inflation expectations even as growth momentum stalls. Most contacts noted that the risk of sustained high inflation would likely be accompanied by monetary policy tightening, with potential effects on elevated risk-asset valuations. A few noted that a monetary policy response to stagflation risks would underpin a particularly sharp tightening of financial conditions.

Fallout from the Chinese regulatory tightening

Respondents also widely discussed market shocks and spillovers that could emanate from the Chinese authorities' de-risking campaign, with a focus on their efforts to reduce leverage in the property development sector. Several noted that the Chinese authorities appear willing to countenance more volatility than in the past as they pursue their deleveraging and regulatory goals, while worrying that officials could misjudge the scale of instability and contagion emanating from the campaign. Respondents focused largely on the extent to which the authorities would take measures to avert a disorderly default at Evergrande, the country's largest property developer, and attenuate broader property-sector and financial system stress.

Fall 2021: Most Cited Potential Shocks over Next 12 to 18 Months

Accessible Version | Return to text

Note: Responses are to the following question: "Over the next 12 to 18 months, which shocks, if realized, do you think would have the greatest negative effect on the functioning of the U.S. financial system?" EME is emerging market economy.

Source: Federal Reserve Bank of New York survey of 26 market contacts from August to October.

Spring 2021: Most Cited Potential Shocks over Next 12 to 18 Months

Accessible Version | Return to text

Note: Responses are to the following question: "Over the next 12 to 18 months, which shocks, if realized, do you think would have the greatest negative effect on the functioning of the U.S. financial system?" TGA is Treasury General Account. EME is emerging market economy. SLR is supplementary leverage ratio. CRE is commercial real estate.

Source: Federal Reserve Bank of New York survey of 24 market contacts from early February to early April.

New COVID-19 variants

Respondents remained focused on the risk of new COVID variants that could diminish the effectiveness of available vaccines and prolong pandemic effects on the global economy. A few noted risks of perpetual COVID mutations that lead to enduring behavioral changes amid recurrent outbreaks, with permanent effects on COVID-sensitive sectors.

Fading fiscal impulse

Several respondents raised concerns regarding the potential for a deeply negative fiscal impulse next year to weigh on an economy that is already showing signs of slowing momentum. A few contacts highlighted contentious debt ceiling negotiations and the prospect that legislated infrastructure spending would be lower than previously expected.

Escalation of U.S.–China tensions

As with previous surveys, a number of respondents also cited various geopolitical threats that could destabilize markets. Several contacts worried about the possible escalation of tensions between the United States and China, particularly surrounding Taiwan.

The FSOC, of which the Federal Reserve Chair is a member, was established by the Dodd-Frank Wall Street Reform and Consumer Protection Act. It is charged with identifying risks to the financial stability of the United States, promoting market discipline, and responding to emerging threats to the stability of the U.S. financial system.

In response to President Biden's Executive Order 14030 (regarding climate-related financial risk), the FSOC published its Report on Climate-Related Financial Risk on October 21, 2021.¹ The report summarizes members' efforts to identify and assess climate-related financial risks and outlines a number of recommendations encouraging members to expand their investments in the resources needed to fill climate-related data and methodological gaps, enhance climate-related financial disclosures, and assess and mitigate climate-related financial stability risks.

The Federal Reserve's work to identify and address climate-related financial risks is broadly aligned with the recommendations in the report.

Expanding the Federal Reserve's capacity to assess and mitigate climate-related financial risks

The Federal Reserve's November 2020 Financial Stability Report discussed how climate change may create or amplify risks to the financial system.² Following the January 2021 announcement of the creation of the Supervision Climate Committee (SCC), in March 2021, the Federal Reserve announced the formation of the Financial Stability Climate Committee.³ This Federal Reserve System staff committee complements the microprudential focus of the SCC and is undertaking work to identify links between climate change and financial stability, including by investigating how climate change can increase financial-sector vulnerabilities and looking for climate-related amplification channels.

Filling climate-related data and methodological gaps

As the FSOC report noted, the assessment of climate-related financial risks requires both data that regulators may be unaccustomed to working with and new methods to analyze those data. To address these challenges, the Federal Reserve is identifying additional data, technology, and modeling resources, including those available through other U.S. government agencies, that are needed to support the Federal Reserve's efforts to understand the financial and economic risks associated with climate change.

Enhancing climate-related disclosures

The Federal Reserve supports the FSOC report's emphasis on the need for consistent and comparable disclosures, which are fundamental to a rigorous and thorough analysis of climate-related risks. The Federal Reserve will work with FSOC colleagues to support the development and implementation of effective approaches in this area.

Assessing and mitigating climate-related risks that could threaten financial stability

The Federal Reserve is developing a program of climate-related scenario analysis, a tool increasingly used by individual firms and regulatory agencies, to evaluate the potential economic and financial risks posed by different climate outcomes. The Federal Reserve considers an effective scenario analysis program, which is designed to be forward looking over a period of years or decades, to be separate from its existing regulatory stress-testing regime. This undertaking is complex, and the Federal Reserve is committed to developing an analytically rigorous program that supports all of its statutory responsibilities.

Conclusion

Climate change poses significant challenges for the global economy and the financial system. The public rightly expects the Federal Reserve to work to ensure that the financial system is resilient to climate-related financial risks.

The Federal Reserve will share its progress and looks forward to coordinating with its FSOC colleagues to meet the critical challenges outlined in the FSOC report. As the Federal Reserve advances its understanding of the financial stability risks associated with climate change and gains experience with policies to strengthen the system, it will continue to work together with domestic and international colleagues to sharpen its responses.

Cyber risk, defined as the risk of loss from dependence on computer systems and digital technologies, has grown in the financial system. Cyber events, especially cyberattacks, are among the top risks cited in financial stability surveys in the United States and globally, presenting both microprudential and macroprudential concerns.¹ While substantial attention has been paid to improving resilience to cyber risk at individual institutions, this discussion focuses on the ramifications of cyber risk for the financial system and financial stability.

The implications of cyber events for the financial system are distinct from other financial system vulnerabilities because fire sales, liquidity freezes, and potential solvency issues may play out differently when stemming from a cyber shock. For example, if a cyber incident compromises a financial institution's data, the firm may be unable to carry out normal operations, in contrast to a traditional run. Enhancements in service offerings, such as longer operating hours of payment systems and shorter clearing and settlement windows, have left the financial system less downtime in which operations can be more easily restored after a cyber incident. More high-frequency trading means that greater volumes of transactions depend on instantaneous information flow. Uncertainty about the nature and extent of an incident may prompt runs on counterparties, competitors, or unaffected segments of the firm's operations. The 2021 ransomware attack on Colonial Pipeline, though not a financial firm, illustrates how a cyberattack can spark a run (in this case, a run on gas stations), amplifying the effects well beyond the original shock (in this case, on fuel distribution).

Cyber shocks may spread through the financial system through complex and often unrecognized interdependencies across firms, including a layer of exposures to shared technologies and third-party service providers. This layer is in addition to the connections from financial payments and exposures typically captured in measures of counterparty risk.

Another distinction of cyber risk is the possible intentional nature of events. Most cyber events experienced thus far appear to have been motivated by a desire to maximize profits rather than a desire to create havoc. However, a small group intending to cause widespread harm can target and time its attacks with the goal of impairing the financial system.

Strategies for reducing traditional financial stability vulnerabilities may be less effective for addressing cyber vulnerabilities. Capital and liquidity can reduce the likelihood of solvency runs and serve as a buffer for cyber-related losses—and thus may help contain some amplification—but they may not do much to prevent runs if customers fear a loss of access to their funds. They also may not speed up the restoration process. In addition, cyber vulnerabilities are not transparent to counterparties, and affected firms may be reluctant to disclose attacks, which could allow attacks to spread longer and to more firms.

Cyber risk in the Federal Reserve framework

The Federal Reserve's financial stability monitoring framework distinguishes between shocks to and vulnerabilities of the financial system. That framework naturally translates to considering cyber risk to financial stability (figure A).

A. Transmission of Cyber Shocks to Affect Financial Stability

Shocks associated with cyber risk are cyber events—occurrences, whether malicious or not, in an information system or network. Cyber events can be external or internal in origin.

For a cyber event to affect financial stability, it must first exploit firm-level vulnerabilities so that the event becomes an incident—an event that impairs the firm. Firm-level vulnerabilities are weaknesses in a firm's cybersecurity and ability to recover from a cyber event before damage is done. Potential adverse firm-level effects include a loss of funds or data, data corruption, and disrupted operations.

System-level vulnerabilities are features of the financial system that can amplify and spread a cyber incident so that the incident disrupts the system's functioning. Examples of system-level vulnerabilities include interconnectedness from financial and digital exposures, data and operational dependencies, markets with dominant firms and a lack of available substitutes for critical services, the time sensitivity of payments, and the level of confidence in financial relationships.

Cyber incidents that sufficiently disrupt the financial system's functioning can affect financial stability. Consequences could include a lack of availability or accessibility of critical services, data, or funding; a loss of confidence, resulting in runs and asset fire sales; or disruptions to payment flows or price discovery. Less significant cyber incidents could also affect financial stability by interacting with and amplifying other financial system vulnerabilities. This prospect is made more likely by the possible intentional nature of cyber events.

Examples through the lens of the framework

While no cyber incident has yet significantly impaired the financial system, four examples illustrate the application of the framework and the ways in which a more significant incident may do so. The first example is a cyberattack directed at a bank holding company that impairs the firm's data. For instance, in 2019, the data of more than 100 million Capital One customers were accessed after an attacker exploited a vulnerability in the firewall configuration of the bank's cloud-based infrastructure. A cyberattack that affects data at multiple large financial institutions could lead to a broad loss of confidence in the security of the financial sector. If the institutions' data are corrupted during the attack, the recovery process could be extensive.

The second example is a cyberattack on a financial market exchange that disrupts trading. In 2020, distributed denial-of-service attacks overwhelmed the website of New Zealand's Exchange (NZX). The exchange had to halt trading in cash, debt, and derivatives for most of four days, which disrupted access to price information for assets traded only on its exchange. NZX was vulnerable because it lacked adequate defenses and a response playbook. An attack that shuts down trading at a large and interconnected financial market exchange could disrupt price information more widely, as well as clearing and settlement, and trigger a loss of confidence.

An attack on a third-party vendor represents the third example. In 2020, a nation-state actor inserted malware into a routine update of network management software sold by SolarWinds, a third-party vendor. SolarWinds customers, which included large financial institutions, were infected by the malware when they installed the software update. The attack opened a backdoor through which the attackers could have exploited the customers' computer systems. While financial institutions do not appear to have been the intended targets, if they had been, the outcome for financial stability could have been much worse, as the attackers reportedly had access to the computer systems for some time.²

Finally, a study by Federal Reserve Bank of New York staff simulated the extent of a hypothetical cyberattack that prevents one of the five most active banks from sending payments for one day.³ Using data from 2018, the study found that, on average across trading days that year, 31 percent of banking-sector assets (excluding the directly affected bank) would face compromised liquidity. The majority of forgone payments in a disruption support other financial market activity, so the original disruption could have broad ramifications.

Data gaps

While there is extensive ongoing supervisory attention to firm-level cyber resilience, data gaps remain, particularly for monitoring system-level vulnerabilities. At the firm level, consistent data on cyber incidents are needed. At the system level, measures of digital interdependencies and the speed with which backup systems and providers can be quickly enabled would be beneficial. Federal Reserve staff are working to help close these data gaps and improve understanding of amplification through tabletop exercises and premortem and postmortem studies of cyber events.