Dr. Firas Raad, World Bank’s Country Manager for Malaysia, Distinguished Guests, Ladies and Gentlemen. Good morning and welcome to Sasana Kijang. Bank Negara Malaysia is delighted to host this Conference on Governance, Risk and Controls in the Era of Disruption. Let me begin by sincerely thanking our joint host, the World Bank Group for working with us to put together a rich programme that speaks directly to issues that I am sure are keeping at least some of us awake at night.
In the year 2000, the English author and academic, Sir Malcolm Bradbury wrote this: “We no longer live in the Age of Reason. We don’t have reason, we have computation. We don’t have a tree of knowledge, we have an information superhighway. We don’t have real intelligence, we have artificial intelligence. We no longer pursue truth, we seek data and signals. We no longer have philosophers, we have thinking pragmatists. We no longer have morals, we have lifestyles.”
This rather grim view of the world was written almost two decades ago. Since then, the extent of technological change and disruption that has come to define our world gives these words a significance that few could have imagined.
For central banks and financial regulators, technological changes have far reaching implications – in particular on the structure of financial markets, banks and other financial institutions.
Corporations around the world from every industry, origin and size, are directing enormous resources towards investments in technologies that are transforming the way they conduct business. The global annual spend on business technology is estimated to be close to US$4 trillion in 2019 . Of this, financial services firms rank in the top quartile of annual spend to revenue. Global investments in financial technology start-ups are reported to have chalked up another US$22 billion in the first half of 2019 , driven by a combination of interest and demand from consumers for new fintech propositions and the scaling up of challenger and collaborative fintechs.
These developments raise important questions for the conduct of monetary policy, the management of payment systems, financial regulation and supervision, and even the very concept of money as the lifeblood of any economy.
On many fronts, we find ourselves in unchartered territory – often uncomfortably so.
In response, central banks and financial regulators are similarly expanding resources both to better leverage technology in performing our core functions of promoting monetary and financial stability, and to defend against its attendant risks. Central to both these goals is our ability to evolve – and in many respects, re-define – our governance, risk and control environment for the age of disruption.
Why is this necessary? Because new financial technologies are presenting significant opportunities, but also enormous challenges for central banks and financial regulators.
They hold out the promise for achieving broader and more inclusive access to financial services, characterised by greater speed and convenience, and lower costs. The emergence of new financial institutions and multiple payment systems could dramatically improve financial intermediation and reduce concentration risks. Greater access to data also carries tremendous value for better surveillance and policymaking.
However, these developments also carry with them new risks and challenges – from more interconnected systems through which risks can transmit in and across organisations and financial systems; to concerns associated with privacy, misinformation, security and criminal abuse. Moreover, as financial systems continue to undergo major technological transformations, their resilience remains largely untested during periods of crisis.
Technological disruptions will continue to push the limits of our ability to identify and pre-empt risks. This will also increasingly place authorities who are responsible for financial stability, at odds with a desire to encourage and not stifle innovation. Managing this balance will require us to approach governance, risk and controls with fresh lenses.
For Bank Negara Malaysia, this has entailed a number of strategic imperatives. The first has been a sharper focus on strengthening regulation and supervision to promote resilience. The Bank recently published new standards on risk management in technology for financial institutions and strengthened our expectations on the management of outsourcing risks by firms. Financial institutions will also be required to develop recovery plans for surviving a range of stressed scenarios, a key objective of which is to preserve the continuity of critical economic functions performed by systemic financial institutions.
Work is also in progress to establish a financial sector cyber threat intelligence platform. The platform which will be operational in the coming year, seeks to overcome barriers to critical information sharing on cyber threats and will have the capacity to collate, aggregate, analyse and share cyber threat information from multiple sources in real time. We have also doubled our approved headcount for IT supervision to ensure that we continue to provide adequate coverage of technology risks in the financial system in our supervisory activities.
Second, the Bank has sought to encourage a more nimble response to innovation in the financial sector. Along with a number of other regulators, the Bank introduced its regulatory sandbox in 2016 to enable firms to test innovative solutions in actual production with appropriate safeguards, while suitable regulation that is fit-for-purpose is developed. At a practical level, this has led to important changes in the way the Bank works, leveraging on “agile” teams where small, cross-functional and dynamic groups are formed to observe, gather feedback, efficiently assess and formulate regulation iteratively.
Since its establishment, over 80 solutions have been evaluated for testing in the sandbox. Of this, about a quarter have piloted or are preparing to pilot their solutions in the sandbox, with some already having graduated to offer their solutions in the broader financial system. The insights gained have led to adaptations of existing regulations as well as the development of new frameworks for firms that exit the Sandbox. They have also informed the Bank’s thinking on regulating innovation, with lessons taken in the development of the digital bank framework which will be issued for consultation very shortly.
The idea of the sandbox has since been replicated internally within the Bank as an avenue for staff to prototype new solutions that will improve the way the Bank works. This includes new technological applications in regulation and supervision, surveillance, data analytics, communications and in the delivery of the Bank’s public services.
The third imperative has been to ensure alignment in the Bank’s governance and culture with our digital objectives and priorities. At the Bank, we are keenly minded that it’s the people and the risk culture, or “the way we do things around here” that ultimately matters.
This arguably remains the most difficult part of our journey. Digitalisation is driving disruption, and the digital world is inherently complex – in its logic, design, development and delivery. We have put in place strengthened and more integrated governance arrangements to direct our digital strategy, policy and standards. At the same time, we recognise that our digital goals and aspirations can only be achieved through the values and behaviours of staff that promote inclusivity (between those that have technological skills and those that don’t); accountability (that is, the effective and responsible use of technology); effective collaboration that breaks away from working in silos; and an appropriate level of risk-taking that is compatible with a more agile and responsive organisation.
And so we have taken pains to be specific and deliberate in our approach to building a digital culture within the Bank. This starts with being clear across the organisation on our tolerance for higher risks associated with disruptive innovations – through the development and communication of our digital risk appetite. We are shifting conversations on new digital initiatives away from the technical solutions themselves, to a greater focus on the business process transformations that they are intended to serve, and that is what we measure and track.
We are also investing heavily in equipping our people with the knowledge, skills and confidence to make sound judgment calls in an environment where the pace of change is occurring at a dizzying speed, and our ability to anticipate risks is likely to be more constrained. At a practical level, this means being more precise about escalation, decision and communication protocols, while allowing more flexibility in internal policies to allow business lines to respond swiftly to emerging situations. It also means allowing more dynamic structures to evolve within the organisation to support specific strategic business use cases, such as our cloud centre of excellence.
In an era of disruption, efforts to reduce the complexity of financial products and services to the average person could become more challenging. A key reason for this is the dramatically increased access to financial solutions for people from every walk of life, whether they are suited for them or not. To reap the promise that such access brings of opportunities to reduce inequality and improve standards of living, it is imperative that individuals are sufficiently confident and capable of making wise financial decisions.
This brings me to the fourth strategic priority of the Bank – which is building financial capability among the Malaysian public to navigate opportunities and risks in the changing financial landscape. It has long been our conviction that encouraging a population that is both financially and digitally literate is a necessary and vital condition to harness the full potential of fintech and contain its risks.
To that end, the Government recently launched Malaysia’s National Strategy for Financial Literacy which includes a specific focus on helping consumers protect themselves against fraud and exploitation, and embrace innovation more confidently in the digital era. In the area of remittances, our work to improve conditions for the use of formal remittance channels by leveraging on technology, particularly by workers and small businesses across the country, has led to substantial reductions in the cost of remittances. This has been accompanied by a marked increase in the volume of remittances now captured through formal channels as a result of our outreach and education efforts which also benefitted greatly from our four-year collaboration with the World Bank under the Greenback initiative.
Ladies and gentlemen,
As central banks and financial regulators, the opportunities and challenges confronting us in the era of disruption are both internal and external. Internally, we share many of the same concerns and pressures that firms in general face in dealing with technological disruptions. Externally, however, we are confronted with broader issues of financial stability and consumer protection that will continue to challenge existing regulatory frameworks and approaches. How we think about governance, risk and controls need to take both perspectives into account, and will demand a high degree of organisational agility.
In closing, I would like to take another crack, if I may, at Malcolm Bradbury’s reflections. “We live in the Age of Disruption. We have algorithms, data and signals, and so we must aspire for greater insight and understanding. We have greater uncertainty, and so we must aspire for greater predictability in our actions. We have greater access for all, and so we must equally aspire towards greater confidence for all. We have thinking pragmatists, and so we must complement them with philosophers of information and human capacity for change. We have digital-driven lifestyles, and so we must strive to preserve shared values that promote societal well-being.”
I think we would do well to keep these goals in mind in our efforts to strengthen governance, risk and controls in the era of disruption. On that note, let me welcome you once again to the Conference and wish you productive discussions ahead.
Thank you very much.
