DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and...
Transcript of DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and...
![Page 1: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/1.jpg)
DANMARKSNATIONALBANK 3 0 A P R I L 2 0 1 8 — N O. 4
REPORT
Denmarkhasanup-to-dateandefficientpaymentsinfra-structure.Thecoresystemsandsolutionsextensively complywithinternationalsecurityandefficiencystandards.Theinfrastructurerequirementsareregularlytightened.
DanmarksNationalbankmonitorstheeffortsofkeyactorstocomplywithinternationalcybersecurityguidelines.Notallhavemadethesameheadwayintheseefforts.Partoftheworkregardingcyberresiliencetakesplaceatsectorlevel.
AttherecommendationofDanmarksNationalbank,col-laborationwasestablishedtoidentifyandaddressrisksrelatedtointerdependenciesbetweenKronos,theVPsettlementsystemandtheretailpaymentsystems.Afinalmodelisexpectedtobeinplacebymid-2018.
Oversight of the financial infrastructure
Room for improvement
Important infrastructure
Cyber risks have been a focus area of Danmarks Nationalbank’s oversight in 2017
Payments averaging kr. 502 billionare settled each banking day
Cyber risks Kr. 502 billion
Read more Read more
CONTENT
2 SECUREANDEFFI- CIENTINFRASTRUC-TUREINDENMARK
5 INTERBANKPAY- MENTSINKRONER
8 INTERBANKPAY- MENTSINEURO
9 RETAILPAYMENTS
12 CLEARINGANDSETTLEMENTOF RETAILPAYMENTS
13 SECURITIESSETTLEMENT
17 SETTLEMENTOFFOREIGNEXCHANGETRANSACTIONS
![Page 2: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/2.jpg)
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
2
Secureandefficient infrastructureinDenmark
Denmarkisoneofthemostdigitisedcountriesintheworld,andpaymentsandfinancialtransactionsarewidelysettledbyelectronicmeans.Itisimport-anttosocietyandtoindividualconsumersandfirmsthatthisexchangeiseffectedinasecureandefficientmanner.TheDanishpaymentsinfrastruc-tureisdescribedinBox1.
Byinternationalcomparison,Denmarkhasanup-to-dateandefficientpaymentsinfrastructure.AsdemonstratedbyDanmarksNationalbank’soversight,thecoreinfrastructuresystemsandsolutionsextensivelycomplywithinternationalstandardsforsecureandefficientsystemsandsolutions1.
Instantpaymentscanbemadewithinseconds,andsecuritiesaresettledinaccordancewithbestpractice.Theperformanceofinfrastructuresystemsandsolutionsisstable,andsignificantbreakdownsordelaysarerare.Liquiditycanbedistributedsmoothlyamongthevariouspaymentandsettlementsystems,andgenerallythereisampleliquiditytosettlepaymentsbetweenbanks.Allthesame,thereisroomforimprovement.
Room for improvementDanmarksNationalbankhaspreviouslymaderecommendationsthathavenotyetbeenfullycompliedwith.Atthesametime,theworldandthepotentialinfrastructurethreatsareconstantlychanging,sowhatwassufficientyesterdaymaynotnecessarilybeadequatetomorrow.Bestprac-ticeisevolving,therebyenhancingrequirementsforinfrastructuresystemsandsolutions.
DanmarksNationalbankkeepsupanongoingdialoguewiththoseresponsibleforthecoresys-temsandsolutionssubjecttooversightabouttheworkregardingopenrecommendationsandotherareaswithpotentialforimprovement.Effortsaremadeonacurrentbasistoimprovethesecurityandefficiencyofthecoreinfrastructuresystemsandsolutions.
1 ForadescriptionofDanmarksNationalbank’soversight, seeDanmarksNationalbank,Oversight Policy,2015(link).
Danmarks Nationalbank’s oversight
DanmarksNationalbankoverseesthatpaymentsand
financialtransactionsinDenmarkcanbeeffectedina
safeandefficientmanner.Oversightcomprisesthecore
systemsandsolutionsintheDanishpaymentsinfrastruc-
ture:
• Kronos(interbankpayments)
• theSumclearing,IntradagclearingandStraksclearing
(retailpayments)
• theVPsettlementsystem(securitiestransactions)
• Dankort,Betalingsserviceandcredittransfers(the
mostimportantpaymentsolutions)
• InternationalsystemsofrelevancetoDenmark.
ThisreportpresentstheconclusionsofDanmarksNation-
albank’soversightoftheDanishpaymentsinfrastructure
in2017.
Againin2017,DanmarksNationalbank’soversighthadparticularfocusonthemanagementofcyberrisksandrisksarisingfrominterdependenciesbetweentheinfrastructuresystems.Animportantpartofthisworktakesplaceatsectorlevel,i.e.incollaborationbetweenfinancialsectorpartici-pants.
Focus on cyber resilienceRecentyearshaveseenseveralseriouscyberat-tacks.TwoclearexamplesaretheattacksontheBangladeshicentralbanktwoyearsagoandonMaersklastyear.Accordingly,bothpublicauthor-itiesandprivateactorsacrossthefinancialsectorhavehadstrongfocusonestablishingthebestpossibledefenceagainstcyberattacks.
![Page 3: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/3.jpg)
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
3
The Danish payments infrastructure Box1
Eachbankingday1,paymentsaveragingkr.502billion,cor-
respondingtoalmostonefourthofGDP,aresettledviathe
Danishpaymentsinfrastructure.
Thepaymentsinfrastructureisthenetworkofsystemsthat
enablesconsumers,firmsandpublicauthoritiestoex-
changepaymentsandfinancialtransactions.
DanmarksNationalbank’spaymentsystem,Kronos,playsa
centralroleinthisinfrastructure,bothinrelationtosettle-
mentoflarge,time-criticalpaymentsbetweenbanks(inter-
bankpayments)andbyvirtueofDanmarksNationalbank’s
roleassettlementbankforotherpaymentandsettlement
systems.Interbankpaymentsamountingtokr.74billionare
settledinKronosonadailybasis.
Retailpaymentsarepaymentsbetweenconsumers,firms
andpublicauthorities,e.g.byDankortorascredittrans-
fers.Dependingontheirtype,retailpaymentsaresettled
throughtheSumclearing,theIntradagclearingorthe
Straksclearing.
ForeignexchangetransactionsinCLScomprisee.g.FXspot,
FXforwardandFXswaptransactions.
SecuritiestransactionsinVPcomprisetradinginbonds,
equitiesandinvestmentfundshares.Somesecurities
transactions,suchasequitiestransactions,areclearedvia
acentralcounterparty,CCP.However,thisappliestoonlya
limitedshareofthetotalturnover.
Thepaymentandsettlementsystemsintheinfrastructure,
i.e.CLS,VPandthethreeretailpaymentsystems(theSum-
clearing,theIntradagclearingandtheStraksclearing),settle
theirparticipants’netpositionsinKronos.Netpositionsare
calculatedbyoffsettingparticipants’claimsandobligations
intherespectivesystems.Nettingreducestheparticipants’
liquidityrequirementforsettlementconsiderablycompared
withasituationinwhichallpaymentsaresettledindividual-
ly.Forinstance,nettingreducesthedailyliquidityrequire-
mentforthesettlementofretailpaymentsfromkr.38billion
tokr.8billion,equivalenttoareductionof79percent.In
CLSandVP,nettingreducestheliquidityrequirementby97
percentand94percent,respectively.
Payment flows, billion kroner, averages per banking day in 2017
KronosInterbank payments
Retrailpayments
Sumclearing,Intradagclearingand
Straksclearing8
74
FXtransactions
CLS
Securities transactions
VP CCPs
10
155 10
7
225
8
38
1. Sometypesofpaymentcanbemade24/7/365,othersonlyduringbankopeninghours.However,forallpayments,finalsettlement
andexchangeofamountsbetweenbankstakeplaceonbankingdays,i.e.whenbanksareopenforbusiness.
![Page 4: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/4.jpg)
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
4
In2016,CPMI-IOSCOissuedguidanceoncybersecurityinpaymentandsettlementsystems.2TheguidancespecifiesthemoregeneralCPMI-IOSCOprinciples3of2012inviewofincreasingcyberrisk.DanmarksNationalbankregularlymonitorstheef-fortstocomplywiththeguidance.Notallhavemadethesameheadwayintheseeffortsasdescribedinmoredetailinthesectionbelowonoversightofindi-vidualpaymentandsettlementsystems.
Sectoral collaborationCyberriskisalsoaddressedatsectorlevel,includ-ingthecyberresilienceworkoftheFinancialSectorforumforOperationalResilience,FSOR,cf.Box2.
Comprehensivemappingofthemostcriticalbusi-nessactivities,processes,systemsandfinancialsectorparticipantshasbeencarriedoutundertheauspicesoftheFSOR.Onthisbasis,adetailedan-alysisofpotentialrisksacrossinfrastructuresystemsandsolutionshasbeeninitiated,cf.belowontheworkconcerningrisksrelatedtointerdependencies.
TheFSORhasestablishedfinancialsectorcrisisresponseplanstoensurecoordinationacrossthesectorintheeventofe.g.anextensivecyberattack.DanmarksNationalbankchairsFSORandprovidessecretariatservices.Thecrisisresponseplansweretestedinboth2016and2017.Participationinthisworkservestoensure,forthesystemssubjecttooversight,compliancewiththeCPMI-IOSCOprin-cipleswhichrecommendparticipationinsectortests.
Furthermore,ithasbeendecidedatsectorleveltoestablishaDanishintelligence-ledredteamtestprogrammesettingoutcommonrequirementsforthetestingprocessthatparticipantsmustcomplete(link).Thepurposeoftheframeworkistoensurethatallparticipantswillbesubjecttoauniform
2 CPMI-IOSCOGuidanceoncyberresilienceforfinancialmarketinfra-structures(link)waspublishedbytheBankforInternationalSettle-ment,BIS,andInternationalOrganizationofSecuritiesCommissions,IOSCO.TheCommitteeonPaymentandMarketInfrastructures,CPMI,istheBIScommitteethatcontributedtoformulatingtheguidance.MembersoftheCPMIincluderepresentativesofalargenumberofcentralbankssuchastheECB,theFederalReserveBankandtheBankofEngland.
3 ThePrinciplesforfinancialmarketinfrastructures(link)werepublishedbyBIS/IOSCO.TheBIScommittee,CPMI,wascalledtheCommitteeonPaymentandSettlementSystems,CPSS,whentheprincipleswereformulated.Accordingly,theyarealsoreferredtoastheCPSS-IOSCOprinciples.
minimumlevelofcybertestingrequirements.AteamtosupporttheparticipantsduringthetestingprocesswillbeestablishedinDanmarksNational-bank.Redteamtestsareconductedasasimulatedcyberattackonsystemsinproduction,i.e.livetesting.
Assystemowners,DanmarksNationalbank,VPandFinanceDenmarkhaveallcommittedthemselvestoparticipatingintheupcomingDanishredteamtestprogramme.RedteamtestingisanimporttooltoverifyandstrengthencybersecurityandispartoftheCPMI-IOSCOcybersecurityguidance.
Financial Sector forum for Operational Resilience
Box2
TheFinancialSectorforumforOperationalResilience
(FSOR)wassetupin2016withthepurposeofincreas-
ingoperationalresilienceintheDanishfinancialsector,
includingcyberresilience.ParticipantsintheFSORin-
cludepaymentandsettlementsystems,dataprocessing
centres,thelargestDanishbanksandmortgagebanks,
financialindustryassociationsandauthorities.
ThetasksoftheFSORareto:
• ensureasharedoverviewofoperationalrisksthat
mayhaveanimpactacrossthesectorandcouldpo-
tentiallyposeathreattofinancialstabilityinDenmark
• decideonandensureimplementationofjointmeas-
urestoensurefinancialsectorresiliencetomajor
operationalincidents,includingcyberattacks
• createaframeworkforcollaborationandknowledge
sharing–withinthesector,betweendifferentsectors
andinternationally.
DanmarksNationalbankchairstheFSORandprovides
secretariatservices.
![Page 5: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/5.jpg)
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
5
Finally,ajointCERT4,NordicFinancialCERT,NFCERT,hasbeenestablishedatsectorlevel.Theobjectiveistocollect,shareanduseinformationoncyberthreatsandcyberattacksacrosstheNordiccountries. NFCERTalsoprovidesexpertassistancetoaddressanycyberattacks.TheCPMI-IOSCOcybersecurityguidanceemphasisesknowledgesharingasan importantaspectofbeingcyberresilient.
Risks arising from interdependenciesDanmarksNationalbankhaspreviouslyrecom-mendedastrengtheningofthecollaborationtoidentifyandaddressrisksrelatedtointerdepend-enciesbetweenKronos,theVPsettlementsystemandtheretailpaymentsystems.
ThiscollaborationhasnowbeenformalisedasaworkinggroupwiththeparticipationofDanmarksNationalbank,VPandFinanceDenmarkandwiththeobjectiveofidentifyingandassessingrisksrelatedtointerdependenciesandensuringthatrobustmeas-uresareinplaceforaddressingandcounteringtherisksidentified.
Risksmayarisee.g.asaresultof:
• theinteractionbetweeninfrastructuresystemswhichentailsthatoperationalproblemsinonesystemmayaffectsettlementinothersystems,orthatexternalrisks,forinstanceacyberattack,mayspreadbycontagionbetweenthesystems
• thedependenceonjointcriticalcommunicationsnetworksandjointuseofkeyITserviceproviders.
Theworkinggrouponinterdependenciesisdevel-opingajointmethodformanagingrisksarisingfrominterdependencies5.Thejointmethodistobeanchoredintheriskmanagementpoliciesoftheindividualparticipants.
Throughout2017,theworkinggroupalsomappedexistinginfrastructureandbusinessprocessesandidentifiedanumberofrisksrelatedtointerdepend-
4 CERTstandsforComputerEmergencyResponseTeam.
5 Theworkinggrouphasdefinedinterdependenciesas:businessprocessesand/ordataflowsacrossinfrastructuresandunderlyingsystems,ornetworkssharedbyseveralparties,whereoperationalfailuresmayinteractinsuchawaythatoneormorepartiesareun-abletocarryontheirbusinesseswithoutcollaboratingonrecovery.
encies.Thoseriskswillbeassessed,andifariskisdeemedtoexceedthejointlyagreedriskappetite,initiativestocounterthiswillbelaunched.
RiskmanagementandmonitoringofrisksrelatedtointerdependenciesisanongoingprocesstobejointlyundertakenbyVP,FinanceDenmarkandDan-marksNationalbank.Thefinalcollaborationmodelisexpectedtobeinplacebymid-2018.
Interbankpaymentsinkroner
Interbankpaymentsarepaymentsbetweenfinancialinstitutions.Suchpaymentsaretypicallycharacterisedbybeingtime-criticalandofhighvalue,andhencetheyaresettledinreal-timegrosssettlement,RTGS,systemsthatsettlepaymentsindividuallyandimmediately.
KronosisDanmarksNationalbank’sRTGSsystemforinterbankpaymentsinDanishkroner.Itisalsousedforthesettlementofmonetarypolicyoperationsandnetpositionsfromconnectedpaymentandsettle-mentsystems.
UseThereare88directKronosparticipants,mainlyDanishbanks,mortgagebanksandbranchesofforeignbanks.
In2017,approximately5,000interbankpaymentsweresettledviaKronoseveryday,correspond-ingtoadailyvalueofkr.74billion,cf.Table1,comparedwithkr.83billionin2016.Thevalueofmonetarypolicyoperationsintheformofsaleofcertificatesofdepositincreased,butthatispri-marilyattributabletotheparticipants’depositswithDanmarksNationalbankoftenexceedingtheirindividualcurrentaccountlimits.DanmarksNa-tionalbankconvertsthatpartoftheparticipants’depositswhichexceedstheircurrentaccountlimitsintocertificatesofdeposit.
![Page 6: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/6.jpg)
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
6
Operational reliabilityKronosuptime6exceeded99.9percentin2017,whichissatisfactory.However,oneincidentcausedthesystemuptimeinonemonthtobelowerthantheagreedservicelevel.Asaresultofnetworkprob-lems,Kronosparticipantswereunabletosendandreceivepaymentsforashortperiodon30March2017.ManualprocedureswereinitiatedtoensurethatCLSsettlementcouldbecompletedwithinthetimelimitsset.
In2017,Kronoswasalsoaffectedbyanumberofminorincidentsthatdidnothaveanyimpactonitsuptime,however.Itisassessedthatallincidentsweresatisfactorilyfollowedup.
6 TheuptimeisthetechnicaluptimesuppliedbyKronos’sITserviceprovider.Operationaldisruptionscausedbyothercircumstancesarenotincluded.
Payments in Kronos Table1
Kr.billion,averagesperbankingday
2013 2014 2015 2016 2017
Interbank payments 96.1 92.0 99.3 83.0 76.3
-Ofwhichcustomerpayments 10.3 11.0 12.8 11.5 11.8
Monetary policy operations 33.5 25.5 37.5 28.7 38.6
-Ofwhichsaleofcertificatesofdeposit 33.4 24.9 37.3 28.6 38.6
-Ofwhichmonetarypolicylending 0.2 0.6 0.2 0.1 0.0
Transfers to settlement systems 196.5 329.5 389.6 292.7 335.4
-OfwhichfortheSumclearing,IntradagclearingandStraksclearing 130.1 272.2 332.3 240.0 284.7
-OfwhichforVPsettlement 44.7 40.9 40.8 37.0 35.9
-OfwhichforCLS 21.8 16.5 16.5 15.7 14.8
Net positions settled 21.7 25.8 27.6 25.1 24.7
-OfwhichtheSumclearing,IntradagclearingandStraksclearing 3.1 7.0 7.6 7.6 7.8
-OfwhichVPsettlement 11.5 12.2 12.7 10.6 10.5
-OfwhichCLS 7.1 6.5 7.2 6.9 6.4
LiquidityOverall,Kronosparticipantshadampleliquidityforsettlementofpaymentsin2017.Chart1showstheparticipants’excessliquiditycover.
Traditionally,theliquidityrequirementisparticu-larlyhighondayswhenauctionsoffixedratebulletbondsforfinancingadjustableratemort-gageloansaresettled,i.e.typicallyatthestartoftheyearandattheendofthequarterlysettle-mentperiods.TheampleliquidityamongKronosparticipantscontributedtosmoothsettlementofpayments.
![Page 7: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/7.jpg)
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
7
International standardsKronosobservesthevastmajorityoftherequire-mentsintheCPMI-IOSCOprinciples.In2017,Dan-marksNationalbankcontinueditsworkonthefourareaswithpotentialforimprovementthatwereidentifiedinitsassessmentofKronosin2016.Thisincludestheworktomanagerisksarisingfrominter-dependencies,cf.above,andtoanalyserisksarisingfromindirectparticipation,cf.below.TheotherareaswithpotentialforimprovementareexpectedtobeaddressedwhenKronos2goeslive.
InNovember2017,DanmarksNationalbankpublishedananalysisofindirectparticipationinKronos.ThemajorityofindirectparticipantsareforeignbankssettlingpaymentsinDanishkronerviadirectparti-cipants.Indirectparticipationisagoodsolutionforbankswithoutin-depthknowledgeoftheDanishmar-ketorthenecessaryoperationalcapacityfordirectparticipation.Inthisway,settlementofkronerislefttoparticipantswhohaveDanishkronerasamajormarketandwhothereforehaveastronginterestinensuringthatsettlementisassmoothaspossible.
Byperformingthisanalysis,KronoscomplieswiththeCPMI-IOSCOrequirementforidentifyingandman-agingrisksassociatedwithindirectparticipation.
Stress tests DanmarksNationalbankperformsannualstresstestsofliquidityinKronos.Thepurposeofthestresstestsistomeasuretheeffectonthesettlementofpaymentsandtheliquidityoftheparticipantsundervariousformsofstress.Astressscenariomayincluderemov-ingamajorparticipantfromthesettlementofpay-ments,orlimitingtheparticipants’intradaycredit.Inpractice,apaymentssimulatorisusedtocomparetherespectivestressscenariostoabenchmarkscenariocorrespondingtotheactualsettlementofpaymentsinKronos.In2017,thetestshowedthatKronosisresilienttotheliquidityshocksinflictedonthesystembythestressscenarios.TheeffectofthesettlementofpaymentsislimitedandcanbemitigatedbymeansofKronos’contingencyprocedurestosettlecriticalpay-ments.Byperformingannualstresstests,DanmarksNationalbankcomplieswiththeCPMI-IOSCOrequire-mentforstresstestingliquidityinthesystem.
Participants’ liquidity requirements in Kronos Chart1
0
100
200
300
400
500
600
Kr.billion,dailyobservations
2013 2014 2015 2017 20182016
Available liquidity
Maximum liquidity requirement
Minimum liquidityrequirement
Note: Availableliquidityistheparticipants’totallineplustheircurrentaccountbalanceswhenKronosopensat7:00am,from24June2013includingamountsreceivedinVPsettlementcycle30at7:05am.Themaximumliquidityrequirementcorrespondstotheliquiditythattheparticipantsneedforsettlementofallthatday’spaymentswithoutdelay.Theamountdependsonthesequenceofthepaymentswithintheday.Theminimumliquidityrequirementiscalculatedastheliquiditythattheparticipantsneedforsettlementofalltheday’spaymentsaftermaximumnettingofincomingandoutgoingpayments.
Source: DanmarksNationalbank.
![Page 8: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/8.jpg)
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
8
Cyber resilience In2017,DanmarksNationalbankpreparedacybersecuritystrategytostrengthenthecyberresilienceofitscriticalbusinessactivities,includingKronosandtheforthcomingKronos2,cf.below.
Kronos2willstrengthencyberresilience,asthesys-temisimplementedonanewIToperatingplatformdesignedtomeethighsecurityrequirementsandcapableofcontinuousadjustmenttocomplywithrelevantrequirements.
Kronos’/Kronos2’scompliancewiththeCPMI-IOSCOcyberguidancehasbeenmapped,andthesecurityoftheforthcomingKronos2isbeingreviewedbyexternalexperts.DanmarksNationalbankiscontinu-ouslyworkingtoaddressanydeficienciesidentified.
System updates – New system underwayDanmarksNationalbankisreplacingKronoswithKronos2.ThenewsystemconsistsofanRTGSmod-uleforhandlingcriticalpaymentsandtransfersforsettlementofretailpayments,securitiestransactions,etc.,amoduleforhandlingmonetarypolicyoper-ationsandamoduleforcollateralmanagement.ThePeragosystemisusedforpaymentsandmon-etarypolicyoperationsandisalsousedbySverigesRiksbankandNorgesBank,amongothers,whiletheCalypsosystemisusedforcollateralmanagement.
InDecember2017,DanmarksNationalbankdecidedtopostponetheimplementationofKronos2.TheITplatformdidnotyethavethedesiredstabilitywhichisessentialduetothecentralroleofKronosinDan-ishpaymentservices.Moreover,DanmarksNational-bankfoundthesystemmanagementprocessestobeinsufficientlyresilient.ThedateforimplementationofKronos2is20Augustthisyear.
Interbankpaymentsineuro
DenmarkisconnectedtoTarget2,thetrans-EuropeanRTGSsystemforsettlementofinterbankpaymentsineuro.PaymentsbetweenfinancialinstitutionsandtransfersforsettlementinothereuropaymentandsettlementsystemsaresettledinTarget2.
UseThereare28DanishparticipantsinTarget2.In2017,Danishparticipants’dailyinterbankpaymentsaver-
Interbank payments in Target2 Chart2
0
5
10
15
20
25
30
Billioneuro,averagesperbankingday
2014 2015 2016 20172013
Intergroup
To foreign participants
Between Danish participants
Note: ThechartshowspaymentssubmittedbyDanishpartici-pantsviaTarget2.Dailyaverageshavebeencalculatedonamonthlybasis.
Source: DanmarksNationalbank.
aged16.7billioneuro.ExchangeofeuromostlytakesplacewithparticipantsinGermany,Finland,FranceandtheNetherlands.
DanishparticipantsuseTarget2mainlyforinter-grouppaymentsandpaymentstonon-residentparticipants.AccordingtoChart2,therehasbeenadeclineinintergrouppaymentsinthesecondhalfof2017.Thiscanbeattributedtoachangeinmarketparticipants’liquiditymanagementprac-tice.
Operational reliability TheoperationalreliabilityofthelocalTarget2componentsforwhichDanmarksNationalbankisresponsiblewassatisfactoryin2017.Therewereonlyafewminorincidentsin2017.
System updatesTheEuropeanCentralBank,ECB,hasbeenwork-ingtowardsmodernisingtheEuropeanpaymentsinfrastructureinrecentyears.TheECBisdevelop-inganinstantpaymentsysteminTarget2calledTargetInstantPaymentSettlementorTIPS.ThiswillallowDanishbankstoclearandsettleinstantpaymentsineuro.TIPSwillsupportmulti-currency,meaningthatatalaterstageitwillalsobepos-sibletoclearandsettleinstantpaymentsinothercurrenciesthaneurothroughthesystem.TIPSineuroisexpectedtobelaunchedinNovember2018.
![Page 9: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/9.jpg)
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
9
On6December2017,theECB’sGoverningCouncilapprovedthemigrationofTarget2totheupgradedT2Splatform7,whichwillincreasesecurityandre-duceoperationalcosts.TheconsolidatedplatformoffersnewRTGSservices,includingimprovedliquid-itymanagementproceduresandamulti-currencyservice.TheTarget2-T2SplatformisexpectedtobeoperationalfromNovember2021.
TheGoverningCouncilalsoapprovedtheestab-lishmentofajointsystemcalledtheEurosystemCollateralManagementSystem,ECMS,forcollat-eralmanagementineuro,whichwillreplacetheexistingsystemsof19nationalcentralbanks.ThenewsystemisexpectedtobelaunchedinNovem-ber2022.
Retailpayments
Paymentsbetweenconsumersandfirmscanbemadeusingbanknotesandcoinsorvariouselec-tronicpaymentsolutions,forinstanceDankortforpaymentsinsupermarkets,Betalingsservice(directdebit)forpayingrentorcredittransfersviaonlinebankingorMobilePay.Onaverage,dailyretailpay-mentstotalledkr.26.4billionin2017.
DanmarksNationalbankoverseesthemostim-portantpaymentsolutionsinDenmark,cf.Box3.
Operational reliabilityTheoperationalreliabilityofNets’systemscon-cerningDankortandBetalingsservicewasoverallsatisfactoryin2017.However,twomajorincidentsoccurredinthe3rdquarter,affectingtheavail-abilityofthecardsystemwhereby250,000and1.2millionDankorttransactions,respectively,wererejected.InDanmarksNationalbank’sassessment,Netsfolloweduptheincidentsinasatisfactorymanner.
Incaseofextendeddowntime,retailersmayrunthepaymentterminalsinofflinemodeandthuscon-
7 TheITplatformthatsupportsthetrans-Europeansecuritiessettle-mentsystem,Target2-Securities,T2S.
Danmarks Nationalbank’s oversight of payment solutions
Box3
DanmarksNationalbankoverseesDankort,Betalingsser-
viceandcredittransfers.
OversightofDankortandBetalingsserviceisaimedat
Nets,theownerofthesesolutions.
Oversightofcredittransfersispartoftheoversightof
theretailpaymentsystems(theSumclearing,Intradag-
clearingandStraksclearing),cf.thesection“Clearingand
settlementofretailpayments”.
DanmarksNationalbankregularlymonitorsdevelopments
inthevariousotherpaymentsolutionstoassesswhether
targetedoversightofthemisrequired.
MobilePayisincreasinglyusedforshoppinginstores,
onlineshopping,paymentofrecurringinvoicesandtrans-
fersbetweenusers.However,theaveragedailyturnover
forMobilePayofkr.0.2billion1isstilllimitedcomparedto
thepaymentsolutionssubjecttooversight,e.g.Dankort,
accountingforkr.1.2billionperday.
Moreover,themostsystem-criticalpartsofMobilePay
arecoveredbyDanmarksNationalbank’soversightof
theretailpaymentsystemsandDankort,asMobilePay
usescredittransfersandforinstanceDankorttoexecute
payments.
1. www.mobilepay.dk(link).
tinuetoreceiveDankortpayments.Netsiscurrentlyreviewinghowutilisationofthissolutioncanbeimproved–possiblybyautomaticallyswitchingtoofflinemodeine.g.supermarkets. NoincidentsaffectedtheoperationofBetalings-servicein2017.
The incidence of Dankort fraud is lowOverall,theincidenceofDankortfraudislow.Inabsolutefigures,Dankortfraudamountedtokr.104million8in2017,or0.23perthousandoftotalturn-over.9
8 DanmarksNationalbank’sStatBank,Payments:(link)(DNBSMIS, Type 1.1, Cat. 1, Denmark, Value, 2017 Q1-4).
9 DanmarksNationalbank’sStatBank(Payments):(link)(DNBSMIS, Type 1.1, Cat. 1, Denmark, Share of total value of transactions, 2017 Q1-4).
![Page 10: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/10.jpg)
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
1 0
TheincidenceofDankortfraudisalsolowrelativetofraudinconnectionwithDanishcardsabroad.10Visa/Dankortfraudabroadamountedto1.9perthousandin201711,cf.Chart3.
Fraudulent use of Dankort cards to withdraw cash and shop in stores FraudulentuseofstolenorlostDankortcardstowithdrawcashandshopinstoresamountedto0.15perthousandin2017,12cf.Chart4.
DanmarksNationalbankhasaskedNetstoreviewthepossibilityofstrengtheningtheoversightofillegalcashwithdrawals.Againstthatbackground,Netsdevelopedatechnicalsolutionthatiscapableofincludingallcashwithdrawalsintheoversight.Netshasenteredintoadialoguewiththeissuersaboutthispossibility,andthematterwillalsobediscussedatthemeetingoftheDanishPaymentsCouncilon9May2018.
10 SeeDanmarksNationalbank,FraudusingDanes’paymentcardsoccurabovealline-commerce,Danmarks Nationalbank Statistics (Payments, 2nd quarter of 2017),12December2017(link).
11 DanmarksNationalbank’sStatBank–(Payments)(link)(DNBSMIS, Type 1.1, Cat. 1, Foreign countries, Share of total value of transactions, 2017 Q1-4).
12 Nets’statistikformisbrugafDankort(Nets’statisticsonDankortfraud–inDanishonly)(link).
Total Dankort fraud, 2017 Chart3
0.0
0.5
1.0
1.5
2.0
InDenmark Abroad(Visa/Dankort)
Perthousand
Source: DanmarksNationalbank.
Dankort fraud online versus cash with-drawals and shopping in stores, 2017
Chart4
0
0.1
0.2
0.3
0.4
0.5
0.6
Online Cashwithdrawalsandshoppinginstores
Perthousand
Source: Nets.
Fraudulent use of Dankort cards to shop onlineFraudulentuseofDankortcardstoshoponlinewasthreetimeshigherin2017thanfraudinconnectionwithcashwithdrawalsandshoppinginstores,cf.Chart4.
FraudulentuseofDankortcardstoshoponlinede-clinedin2017andisnowmoreorlessonthesamelevelasinthe1sthalfof2015,cf.Chart5.
InNets’assessment,thedeclineistheresultofthemeasuresimplementedbyNetsinearly2017tostrengthenDankortsecurity,i.e.FraudPreventionandDankortSecuredbyNets.13
International standardsInMay2017,DanmarksNationalbankpublishedaDankortassessmentinaccordancewiththeECB’sstandardsforcardpaymentschemes.14ThemainconclusionwasthatDankort’sperformanceisstable
13 Fraud Preventionisasystemthatusespatternrecognitiontorejecttransactionssounusualthattheymustbeassumedtobemadebysomeoneotherthanthecardowner.Dankort Secured by NetsisasolutionbasedonstrongauthenticationwherebytheusermustenternotonlyDankortdetailsbutalsoacodereceivedbytextfromNetsbeforefinalisingthepurchase.Thismethod,whichisalsousedforpurchasesinvolvinginternationalcards,isusediftheamountexceedskr.450.
14 Cf.DanmarksNationalbank,DankortAssessment,Danmarks National-bank Report, No.4,May2017(link).
![Page 11: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/11.jpg)
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
1 1
withahighdegreeofavailabilityandalowleveloffraud.TheassessmentalsocontainedanumberofrecommendationsforNets.
DanmarksNationalbank’srecommendationsincluded,interalia,anexpansionoftheDankortriskassess-mentbyNets,moresystematicknowledgemanage-mentinrelationtoDankortandastrengtheningoftheframeworkfordecisionsandcommunicationregardingDankort.
NetshassubsequentlybeenworkingtocomplywithDanmarksNationalbank’srecommendations.Inthe1stquarterof2018,Netsachieveditsaimintermsofmostoftherecommendations:
• Netshasconductedanin-depthriskassessmentofDankort,comprisingseveraltypesofriskasopposedtopreviously,whenthefocuswasontheITplatform.Ithasalsoestablishedaprocessforannualriskassessmentupdates.
• Nets’outsourcingmanagementhasbeenstrength-ened.Nets’securityrequirementsaretransferredtoexternalsuppliersandmoresystematicallyfollowedup,e.g.byregularmeetingsandannualriskassessmentsofoutsourcedactivities.AVendorManagementBoardhasbeenestablishedtoensureinformationsharingandcoordinatedfollow-uponNets’externalsuppliers.
• Ingeneral,Netshasestablishedabetterorganisa-tionalandoperationalDankort-relatedoverview.
NetsisstillworkingonDanmarksNationalbank’srecommendationtostrengthentheframeworkforDankort-relateddecision-makingprocessesandcommunication.
DanmarksNationalbankrecentlyinitiatedanas-sessmentofBetalingsserviceinaccordancewiththeECB’sstandardsfordirectdebitsystems.
RegulationAnewDanishPaymentsActcameintoforceon1January2018.TheActimplementsthenewEUPay-mentServicesDirective,PSD2.15ThislegislationhasconsiderablychangedtheframeworkconditionsforpaymentsinDenmarkandtherestoftheEU.
Amongotherthings,PSD2hasintroducedarightforuserswithapaymentaccounttousethataccountbymeansofathirdpartyserviceproviderwithoutanagreementhavingbeenmadebetweentheuser’sbankandthethirdpartyserviceprovider.16PSD2thusallowsnewserviceproviderstoofferuserstheoptionofpayingforinstanceinvoicesfromtheirac-countswithoutdirectcontactwiththeirbanks–i.e.withouthavingtouseDankortoronlinebanking.17
PSD2ensuresthatalmostallpaymentserviceprovid-erswillbesubjecttosupervision,andthatallonlinepayments–apartfromcertainlimitedcases–mustbeapprovedbytheuserviastrong(two-factor)au-
15 TheDanishPaymentsActalsoadjustsanumberofspecialDanishrules,includingthecashobligation.
16 Themoredetailedrequirementsregardingthirdparties’accesstoinitiatingapaymentfromtheusers’paymentaccountswillnotenterintoforceuntilSeptember2019,however.
17 Theemergenceofservicesfromnewserviceprovidersallowinguserstobypassthebankswhenusingtheirbankaccountsisoftenreferredtoasopenbanking.
Dankort fraud in connection with online shopping
Chart5
0.00
0.10
0.20
0.30
0.40
0.50
0.60
0.70
0.80
0.90
H1 H2 H1 H2 H1 H2
2015 2016 2017
Perthousand
Source: Nets.
![Page 12: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/12.jpg)
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
1 2
thenticationrequiringtheusertoproveitsidentityintwodifferentwaystoreducetheriskoffraud.18
Thepurposeofthenewrulesistoincreasemarketcompetitionandimprovesecurityinconnectionwithpayments.
Clearingandsettlement ofretailpayments
TheSumclearing,IntradagclearingandStraksclear-ingarethefinancialsector’ssystemsforclearingandsettlementofDanishretailpayments.Thesys-temsareownedbyFinanceDenmark,managedbye-nettet,whichisthefinancialsector’sprojectandmanagementcompany,andprovidedbyNets.
TheSumclearingisusedforsettlementofallcardpayments,BetalingsserviceandNets’otherpaymentproducts.SettlementintheSumclearingiscarriedoutonceadayonbankingdays.TheIntradagclearingisusedforsettlementofcredittransferssuchasonlinebankingtransfers,payrolltransactionsandpublic- sectorpayments.Settlementiscarriedoutatfivefixedtimesadayonbankingdays.TheSumclearingandIntradagclearingarebothnetsettlementsystems.
TheStraksclearingisareal-timesettlementsystemwherecredittransfersofuptokr.500,000aremadewithinsecondsona24/7basis.Thisispossiblebecausethebankshaveprefundedthetransfers.TheStraksclearingisprimarilyusedforonlinebankingtransfersandpaymentsviaMobilePay.
UseThereare52directparticipantsintheretailpaymentsystemsand31indirectparticipants,whosettleviadirectparticipants.Thetotaltransactionvolumeintheretailpaymentsystemsaveragedkr.38.4billionperbankingdayin2017,representinganincreaseby5.5percenton2016,cf.Table2.
ThenumberoftransactionsintheStraksclearinghascontinuedtorise,cf.Chart6.Theincreaseismainly
18 Themoredetailedrequirementsregardingstrongcustomerauthen-ticationandtherelatedexceptionswillnotenterintoforceuntilSeptember2019,however.
Payments in the Sumclearing, Intradagclearing and Straksclearing
Table2
Kr.billion,averages perbankingday 2013 2014 2015 2016 2017
Sumclearing 29.1 17.9 16.7 17.2 17.8
Intradagclearing 13.8 17.0 17.8 18.4 19.7
Straksclearing - 0.5 0.6 0.8 0.9
Total 42.9 35.4 35.0 36.4 38.4
Source: Nets.
Payments in the Intradagclearing and Straksclearing, 2015-17
Chart6
0
200
400
600
800
1,000
0
5
10
15
20
25
Straks Intradag Straks Intradag
Thousands,averageperbanking day
Kr.billion,averageperbankingday
Number (right-hand axis)
2015
2016
2017
2015
2016
2017
2015
2016
2017
Value
Source: Nets.
attributabletoMobilePaypaymentsbeingsettledintheStraksclearing.Statisticsshowthatmorethan3.7millionDanesuseMobilePay.19
Althoughtherehasbeenanincreaseinthenumberofinstantpayments,theStraksclearingonlyaccountsforasmallshareoftotalretailpaymentsintermsofvalue,cf.Table2.
19 www.mobilepay.dk(link).
![Page 13: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/13.jpg)
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
1 3
Operational reliabilityRetailpaymentsystemoperationswereingeneralsatisfactoryin2017.Amajorincidentoccurredon26Aprilwhenanundergroundmaincablewascutintwo.Thecabledamageaffectedthecentralnetworkofthesectorandmeantthat,formorethaneighthours,notransactionscouldbesubmitt-edforclearing,andthatthenormalsettlementactivitiesbetweenNetsandDanmarksNational-bankwerenotcarriedoutasplanned.Thereasonforthemorethaneighthourdelayinrestoringnetworktrafficwasanunclearnetworkgovernancestructure.Inviewoftheincident,itwasdecidedtoimplementanewnetwork,cf.belowonsystemupdates.
LiquidityParticipantsreserveliquidityinaccountsatDan-marksNationalbankforsettlementoftheirnetpositions.Ifaparticipantdoesnotreservesufficientliquidity,itssettlementispostponed,andnewnetpositionsarecalculatedfortheotherparticipantswhorisknotreceivingtheexpectedliquidityforsettlement.Therewerenoincidentsofparticipantshavingtheirsettlementpostponedin2017.Onereasonisthatallparticipantsuseatleastoneoftheautomatedliquiditymanagementtools.
International standardsDanmarksNationalbankisfinalisinganassessmentoftheretailpaymentsystems’observanceoftheCPMI-IOSCOprinciples.Theassessmentwillbepub-lishedinmid-2018.
DanmarksNationalbankpreviouslyrecommendedthatFinanceDenmarkperformananalysisoftheretailpaymentsystems’observanceoftheCPMI- IOSCOcyberguidance.FinanceDenmarkwillinitiatethisanalysiswhentheaboveassessmenthasbeencompleted.
System updatesThefinancialsectorisestablishingawholenewnetworkforclearingandsettlementofretailpay-mentstoreplacetheoldnetwork.Thenetworkiscallede-connect,andTDChasbeenchosenassupplier.Theprojectishandledbye-nettettoen-suresuppliermanagementonbehalfofthesector.
e-nettetisalsoinchargeofoverallgovernancefortheparticipantsinthenewnetwork.Thenetworkisexpectedtobeimplementedinthecourseof2018.
TheopeninghoursofKronoswillbeextendedwhentheDanishkronejoinsT2S,whichwillenablelatersettlementintheretailpaymentsystems.Inthatconnection,itwaspreviouslydecidedtomovethelastsettlementsintheIntradagclearingandStraks-clearingtotakeplacelaterintheday.Thismeansthatalargershareoftransactionswillbesettledwithinthesameday.
AgroupoflargerSwedish,Danish,NorwegianandFinnishbanksarecurrentlyexploringthepossibil-itiestoestablishapan-Nordicpaymentinfrastruc-tureforalltheNordicbanks.Thevisionistocreatethefirstareaintheworld,wheredomesticandcross-borderpaymentsinmultiplecurrencies(SEK,DKK,NOKandEUR)canbemadefastandeasy.
Securitiessettlement
VPsettlementistheDanishsecuritiessettlementsystem.VPSecuritiesA/S,VP,alsoundertakesregis-trationofownershipofsecuritiesandhandlingofperiodicpayments,issues,redemptions,etc.
UseTheVPsettlementsystemhas145participants,ofwhich60arenon-residentmarketparticipants.Securitiestransactionstotallinganaverageofkr.162.7billionperbankingdayweresettledin2017,cf.Table3,afallof7.5percentrelativeto2016.Thedeclinewasstrongestforbonds,whilethevalueofinvestmentfundsharessettledcontinueditsupwardtrendfromthepreviousyears.
Operational reliabilityVPsystemuptime20was100percentin2017.Inafewcases,delaysinTarget2-Securities,thetrans-Europeansecuritiessettlementsystem,delayednight-timesettlementinVP’ssystems,butdidnotaffecttheavailabilityofVP.
20 TheuptimeisthetechnicaluptimesuppliedbyVP’sITserviceprovider.
![Page 14: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/14.jpg)
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
1 4
VPandDanmarksNationalbankregularlymonitorincidentsinVPtobeabletoassessoperationalrisks.Overall,theoperationalreliabilityoftheVPsettlementsystemisassessedtohavebeensatisfac-toryin2017.VPhasfollowedupanyincidentsinatimelymanner,andtheirconsequenceshavebeenlimited.
Settlement ratioAccordingtobestpractice,securitiestransactionsmustbesettledtwodaysafterthetransactiondate.Thesettlementratioindicatesthepercentage,invalueterms,ofthetransactionssettledinatimelymanner.In2017,theoverallsettlementratioinVPwas99.0percent,whichwasalittlehigherthaninthepreviousyear,cf.Chart7.Sanctions,includingfinesofuptokr.100,000,willbeimposedonVPsettlementparticipantsiftheirsettlementratiosremaintoolowforaprolongedperiodoftime.In2017,twofineswereissuedtoparticipantswithtoolowsettlementratio.
LiquidityVPparticipantsreserveliquidityinaccountsatDan-marksNationalbankforVP’snetsettlementcycles.IfVP’schecksforadequatecovershowthatabuyerdoesnothavesufficientliquidity,thereportedpurchaseswill,asamainrule,bepostponeduntilthesubsequentsettlementcycle.Participantswhohaveoverdrawntheirliquiditylinesmaybefined.
Settlement ratios in VP Chart7
92
94
96
98
100
Percent,monthlyaverages
Total
Equities and investment fund shares
Bonds
2013 2014 2015 2016 2017
Note: Inthechart,thesettlementratiosarestatedonthebasisofsettlementvalues.Forequitiesandinvestmentfundshares,thesettlementratiohasbeencalculatedasaweightedaverageofthetwotypesofsecurities,whilethetotalisaweightedaverageforalltypesofsecurities.
Source: VPSecuritiesA/S.
Equities, investment fund shares and bonds settled in VP Table3
Total Bonds EquitiesInvestment fund shares
Year,daily averages
Number oftrades,thousands
Value,kr.billion
Number oftrades,thousands
Value,kr.billion
Number oftrades,thousands
Value,kr.billion
Number oftrades,thousands
Value,kr.billion
2013 51.5 172.0 3.3 146.1 25.7 21.3 22.5 4.6
2014 61.1 178.2 3.1 144.4 32.3 28.2 25.6 5.6
2015 67.1 206.2 3.4 158.5 33.4 41.4 30.2 6.3
2016 63.6 175.9 2.8 131.8 30.9 37.6 29.9 6.6
2017 66.9 162.7 2.7 118.4 32.4 36.6 31.8 7.7
Note: Valueshavebeencalculatedonthebasisofthesecuritieslegofatrade,i.e.themarketvalueofthesecuritiestransferredfromthesellertothebuyer.
Source: VPSecuritiesA/S.
![Page 15: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/15.jpg)
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
1 5
Thesizeofthefinedependsonhowmanytimestheparticipanthasoverdrawnitsliquiditylinewithinthelastsixmonths.
In2017,therewereatotalof71overdraftsinVP,and29fineswereissued,cf.Chart8.Thiswasalowernumberofoverdraftsthanin2016andthenumberoffineswasreducedbyhalf.Thedevelopmentinthenumberofoverdraftsisbeingmonitoredtoassesstheefficiencyofthesanctioningsystem.
New regulations and legislationTheCentralSecuritiesDepositoriesRegulation,CSDR,wasimplementedinDanishlawwitheffectfrom2015.ThepurposeoftheCSDRistoensureconsistentregulationofcentralsecuritiesdeposito-riesintheEUwithaviewtoincreasinginternationalcompetition.Infuture,firmsmustapplyforalicencetoactascentralsecuritiesdepositories.
VPappliedforalicenceundertheCSDRinMay2017.DanmarksNationalbankandtheECBpar-ticipatedintheassessmentofVP’sapplicationasrelevantauthorities,i.e.authoritieswithrightofconsultation.TheECBisarelevantauthorityforVP,becausemorethan1percentofVP’stotalsettle-mentisineuro.
VPwasgivenitsCSDRlicencewitheffectfrom3January2018asoneofthefirstcentralsecuritiesde-positoriesintheEU.Infuture,VPmustreporttotheDanishFinancialSupervisoryAuthority,DanmarksNationalbankandtheECBaccordingtotheCSDR.Attheturnoftheyear2017/18,theexistingDanishSecuritiesTradingActwasrepealedandreplacedbytheCapitalMarketsAct.OneofthereasonsforthischangewastoensuregreatercoherencewiththeCSDRasVPistofunctioninaccordancewiththenewlegalbasis.
International standardsTherulesoftheCSDRarealignedwiththeCPMI- IOSCOprinciples,whichformthebasisforDanmarksNationalbank’soversightofthefinancialinfrastruc-ture.
VPcomplieswiththevastmajorityoftherequire-mentsintheCPMI-IOSCOprinciples.Thatwasthe
conclusionintheassessmentpublishedbyDanmarksNationalbankandtheDanishFinancialSupervisoryAuthorityin2016.21
Intheassessment,fourrecommendationsweregiventoVP–includingtoensuretheindependenceoftheBoard.InconnectionwithitsreviewofVP’sCSDRapplication,theDanishFinancialSupervisoryAuthority’sassessedthattheindependenceofVP’sBoardwassufficientlyensured.
VPcollaborateswithFinanceDenmarkandDan-marksNationalbankonmanagementoftherisksre-latedtointerdependencies.Oncethiscollaborationhasbeenformalised,VPwillbeassessedtocomplywiththeCPMI-IOSCOprincipleformanagingrisksrelatedtointerdependencies.
VPhasalsopresenteditsplantoobservetheCPMI-IOSCOprincipleforthehandlingofapar-ticipant’soperationalfailure,resolutionordefault.Basedonthedocumentationavailable,DanmarksNationalbankassessesthatVPisobservingtheprinciple.
21 Cf.DanmarksNationalbankandtheDanishFinancialSupervisoryAuthority,AssessmentofVPSecurities,February2016(link).
Overdrafts and sanctions in VP settlement
Chart8
0
10
20
30
40
50
Overdrafts Sanctions
Number,quarterlybasis
2012 2013 2014 2015 2016
Anm.: Aparticipantisfinedonlyiftheoverdraftisthepartici-pant’sownfault.Inotherwords,nofineisimposediftheoverdraftisduetonon-paymentbyanotherparticipantwhohasreservedinsufficientliquidityforsettlement.
Source: VPSecuritiesA/S.
![Page 16: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/16.jpg)
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
1 6
Finally,DanmarksNationalbankmadearecommen-dationregardingmanagementofbusinessrisks.Accordingtotherecommendation,VPmustensurecloserlinksbetweenitsriskmanagement,recoveryplanandresolutionplan.ThisrecommendationwasalsoissuedinconnectionwiththereviewoftheCSDRapplication.
DanmarksNationalbankregularlyassessesthemeas-uresimplementedbyVPinordertocomplywiththerequirementsoftheCPMI-IOSCOprinciples.
Cyber resilienceIntheautumnof2017,VPparticipatedintheECB’squestionnairesurveyconcerningVP’scybersecurityresponseplans.ItsresponsesshowthatVPstrength-eneditscyberattackresponseplansin2016and2017.
In2018,VPwillconductaredteamtestasasimu-latedcyberattackonsystemsinproduction,butwithoutdamagingthosesystemsortheoperationofVP.InitialtestresultsconfirmthatVPhasastrongcyberdefence.
System updatesInanefforttostrengthenitsNordicposition,VPconcludedanagreementwithSverigesRiksbankforsettlementofsecuritiestransactions,etc.inSwed-ishkronorinVP.ThesolutionwasimplementedinMarch2017.VPwillalsoestablishalinktoEuroclearSweden,thecentralSwedishsecuritiesdepository,inthecourseof2018toallowsecuritiestransactionsinSwedishkronorviaVP.
Target2-SecuritiesT2Sisatrans-Europeansecuritiessettlementsys-temownedbytheECB.ThepurposeofT2Sisforcross-bordersecuritiestransactionstobehandledassafely,inexpensivelyandefficientlyasdomestictransactions.
Atotalof20centralsecuritiesdepositoriesfrom18countriesnowsettleviaT2S,includingVP.Settlementineuro,accountingforjustover1percentoftotalsettlement,mainlytakesplaceonT2S.22Sofar,theeuroistheonlyT2Ssettlementcurrency,butfrom
22 ItwillstillbepossibletosettleineuroinVP’sownsystemsincycle50at2:15pm.
October2018,settlementinDanishkronerviathesystemispossible.
13DanishbanksaredirectparticipantsinT2SandthuscurrentlyholdT2SsettlementaccountsatDanmarksNationalbank.Threeofthosebankshaveestablishedaccountsineurowithcentralbanksintheeuroareainordertohavedirectaccesstoeuro.Theotherbankshaveconcludedagreementswithcorrespondentbanks.
CCP clearingInDenmark,equitiesandrepotransactionsare settledviaacentralcounterparty,CCP,cf.Box4.
ThethreeCCPs,EuroCCP,LCHClearnetandSixX-clear,clearequitiestransactions,whileNasdaqClearingclearsrepotransactions.AfterCCPclearing,transactionsaresettledinVP.
OngoingsupervisiontoensurethatCCPscomplywiththeregulatoryrequirementsisconductedbythenationalsupervisoryauthoritiesincollaborationwithsupervisorycolleges,comprisingsupervisoryauthoritiesandcentralbanksfromthemostim-portantcountriesinwhichtheCCPisoperating.DanmarksNationalbankmonitorsdevelopments,viaitsparticipationine.g.theEuroCCPsupervisorycollege.
What is a CCP? Box4
ACCPintermediatesbetweenthepartiestoatransac-
tion,assumingtheriskforboththebuyerandtheseller
fromthetransactiondateuntilthetransactionhasbeen
finallysettled.Soifeitherofthepartiestothetransaction
defaultswithinthisperiod,theCCPstillhasanobligation
totheotherparty.However,thisalsomeansthatrisksare
concentratedintheCCP,andthereforetheCCPissubject
toanumberofregulatoryrequirements1 to ensure the
completionofthetransaction.
1. Cf.Regulation(EU)No648/2012oftheEuropeanParliament
andoftheCouncilof4July2012onOTCderivatives,central
counterpartiesandtraderepositories(link).
![Page 17: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/17.jpg)
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
1 7
Settlementofforeignexchangetransactions
Aforeignexchangetransactionconsistsoftwoop-positepaymentsintwodifferentcurrencies.23Trad-itionally,foreignexchangetransactionsaresettledastwoindependentpayments,oftenexecutedviacorrespondentbanksinthecurrenciesinquestion.Ifthetwopaymentsarenotsettledsimultaneously,thepartiesincursettlementrisk.Theinternationalforeignexchangesettlementsystem,CLS,mitigatessettlementriskbysimultaneoussettlementofthetwopayments(payment-versus-payment,PvP).
CLSisownedbylarge,internationalbanksandsettlestransactionsin18participatingcurrencies,includingDanishkroner.
DanmarksNationalbankparticipatesinthecoopera-tiveoversightofCLS,cf.Box5.
UseMorethan80percentofallforeignexchangetrans-actionsinDanishkroneraresettledviaCLS.24BothfinancialinstitutionsandfirmsparticipateintheCLSsettlementofDanishkroner.IfacompanydoesnotsettledirectlyinCLSitself,FXtradescanbesettledviaoneofthefoursettlementmemberswithdirectaccesstotheCLSsettlementinDanishkrone.
In2017,thevalueofCLStransactionsremainedstable,cf.Chart9.TheaveragedailyvalueofCLStransactionswaskr.225billionin2017.Thevalueoftradesisparticularlylargearoundquarterchangeandondaysaroundforeignholidays.CLSsettle-mentsetanewrecordinDanishkroneronthefirstbankingdayof2ndquarter2017,3April,reachingkr.612billion.
Operational reliability and liquidityPay-instoCLStakeplaceviathenationalRTGSsys-tems;inthecaseofDanishkronerviaKronos.
HencetheoperationalreliabilityofCLSdependsonthestabilityoftheRTGSsystems.In2017oneKronos
23 Forexample,tradingkroneragainsteuroentailsapaymentinkronerbyonepartytotheotherandanoppositepaymentineuro.
24 BIS,Triennial Central Bank Survey, Foreign exchange turnover in April 2016(link)andCLSBank.
Trade instructions in CLS Chart9
0
1,000
2,000
3,000
4,000
5,000
0
100
200
300
400
500
Kr.billion,averagesperbanking day
Number,averagesperbankingday
Value oftrade instructions
Number oftrade instructions(right-hand axis)
2013 2014 2015 2016 2017 2018
Note: Dailyaveragescalculatedonamonthlybasis.On23January2017,CLSchangedthethresholdamountforwhichatradeissplitintoseveralinstructions.Thishasledtoahighernumberofinstructionsperday.
Source: CLSBank.
Oversight of CLS Box5
OversightofCLSisbasedontheCPMI-IOSCOprinciples
forfinancialmarketinfrastructures(PFMI).Everysecond
yearCLSpublishesanupdateddisclosureofthesystem’s
observanceofthePFMI.1OversightofCLSiscarriedout
byajointCLSOversightCommittee,whichisaforumfor
cooperationbetweenthecentralbanksoftheparticipat-
ingcurrencies2,wherebytheycancarryouttheirnational
oversightresponsibilities.DanmarksNationalbankpar-
ticipatesinthiswork,whichisorganisedbytheFederal
Reserve,Fed.TheFedisalsothesupervisoryauthority
forCLS. DanmarksNationalbank’soversightisfocusedon
mattersofimportancetothesettlementoftransactionsin
Danishkroner.
1. CLS,PrinciplesforFinancialMarketInfrastructuresDisclosure,
2016(link).
2. FederalReserveSystem,ProtocolfortheCooperativeOversight
ArrangementofCLS(link).
![Page 18: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response](https://reader034.fdocuments.us/reader034/viewer/2022050517/5fa1206da4990302a429f151/html5/thumbnails/18.jpg)
DANMARKS NATIONALBANK
HAVNEGADE 5
DK-1093 COPENHAGEN K
WWW.NATIONALBANKEN.DK
This edition closed for contributions on 16 April 2018
ABOUT REPORT Reports are periodical reports and accounts describing the activities and tasks of Danmarks Nationalbank.
Reports include e.g. Danmarks Nationalbank’s annual report and the semi-annual report on monetary and financial trends.
R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E
incidentaffectedCLSsettlement.On30March2017settlementinKronoswasaffectedbynetworkissuesresultinginCLSnotreceivingpayments.ManualprocedureswerelaunchedtoensureCLSsettlementwithinkeybusinessdeadlines.
TheDanishparticipantsreservesufficientliquidityforCLSsettlement.
System updatesCLScontinuestoworktowardsthelaunchof CLSNet25,astandardised,automatedbilateralpaymentnettingserviceintendedforFXtransac-tionssettledoutsidetheCLSsettlementservice.ParticipantswillbeabletosubmitFXinstructionsfortradesinmorethan125currencies.Theservicewillbelaunchedonadistributedledgertechnology(DLT)basedplatform.CLSNetcanbeaccessedeitherdirectlyviaDLTorindirectlyviaSWIFTchannels.
FurthermoreCLSplanstolaunchaseparatesettle-mentserviceforclearedFXproducts.ThefirstCCPstojointhenewserviceareexpectedtobeEurexClearingandLCHClearnet.
25 CLS,CLSNet(link).
AnothernewinitiativeunderwayisCLSNow26whichwillallowparticipantstomitigatesettlementriskassociatedwithsamedayFXtransactions,includingtheoutlegsofCLSin-outswaptransactions27. CLSNowwillprovidesimultaneoussettlementofbothlegs(PvP)onagrossbasis.TheservicewillbeopenforallCLSeligiblecurrenciesinthefuture28.
26 CLS,CLSNow(link).
27 InCLSin/outswapsreducelargepositionstominimiseliquidityriskinsettlement.
28 Atgo-live,onlyCAD,CHF,EUR,GBP,andUSDwillbeincluded.