DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and...

18
DANMARKS NATIONALBANK 30 APRIL 2018 — NO. 4 REPORT Denmark has an up-to-date and efficient payments infra- structure. The core systems and solutions extensively comply with international security and efficiency standards. The infrastructure requirements are regularly tightened. Danmarks Nationalbank monitors the efforts of key actors to comply with international cyber security guidelines. Not all have made the same headway in these efforts. Part of the work regarding cyber resilience takes place at sector level. At the recommendation of Danmarks Nationalbank, col- laboration was established to identify and address risks related to interdependencies between Kronos, the VP settlement system and the retail payment systems. A final model is expected to be in place by mid-2018. Oversight of the financial infrastructure Room for improvement Important infrastructure Cyber risks have been a focus area of Danmarks Nationalbank’s oversight in 2017 Payments averaging kr. 502 billion are settled each banking day Cyber risks Kr. 502 billion Read more Read more CONTENT 2 SECURE AND EFFI- CIENT INFRASTRUC - TURE IN DENMARK 5 INTERBANK PAY- MENTS IN KRONER 8 INTERBANK PAY- MENTS IN EURO 9 RETAIL PAYMENTS 12 CLEARING AND SETTLEMENT OF RETAIL PAYMENTS 13 SECURITIES SETTLEMENT 17 SETTLEMENT OF FOREIGN EXCHANGE TRANSACTIONS

Transcript of DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and...

Page 1: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

DANMARKSNATIONALBANK 3 0 A P R I L 2 0 1 8 — N O. 4

REPORT

Denmarkhasanup-to-dateandefficientpaymentsinfra-structure.Thecoresystemsandsolutionsextensively complywithinternationalsecurityandefficiencystandards.Theinfrastructurerequirementsareregularlytightened.

DanmarksNationalbankmonitorstheeffortsofkeyactorstocomplywithinternationalcybersecurityguidelines.Notallhavemadethesameheadwayintheseefforts.Partoftheworkregardingcyberresiliencetakesplaceatsectorlevel.

AttherecommendationofDanmarksNationalbank,col-laborationwasestablishedtoidentifyandaddressrisksrelatedtointerdependenciesbetweenKronos,theVPsettlementsystemandtheretailpaymentsystems.Afinalmodelisexpectedtobeinplacebymid-2018.

Oversight of the financial infrastructure

Room for improvement

Important infrastructure

Cyber risks have been a focus area of Danmarks Nationalbank’s oversight in 2017

Payments averaging kr. 502 billionare settled each banking day

Cyber risks Kr. 502 billion

Read more Read more

CONTENT

2 SECUREANDEFFI- CIENTINFRASTRUC-TUREINDENMARK

5 INTERBANKPAY- MENTSINKRONER

8 INTERBANKPAY- MENTSINEURO

9 RETAILPAYMENTS

12 CLEARINGANDSETTLEMENTOF RETAILPAYMENTS

13 SECURITIESSETTLEMENT

17 SETTLEMENTOFFOREIGNEXCHANGETRANSACTIONS

Page 2: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

2

Secureandefficient infrastructureinDenmark

Denmarkisoneofthemostdigitisedcountriesintheworld,andpaymentsandfinancialtransactionsarewidelysettledbyelectronicmeans.Itisimport-anttosocietyandtoindividualconsumersandfirmsthatthisexchangeiseffectedinasecureandefficientmanner.TheDanishpaymentsinfrastruc-tureisdescribedinBox1.

Byinternationalcomparison,Denmarkhasanup-to-dateandefficientpaymentsinfrastructure.AsdemonstratedbyDanmarksNationalbank’soversight,thecoreinfrastructuresystemsandsolutionsextensivelycomplywithinternationalstandardsforsecureandefficientsystemsandsolutions1.

Instantpaymentscanbemadewithinseconds,andsecuritiesaresettledinaccordancewithbestpractice.Theperformanceofinfrastructuresystemsandsolutionsisstable,andsignificantbreakdownsordelaysarerare.Liquiditycanbedistributedsmoothlyamongthevariouspaymentandsettlementsystems,andgenerallythereisampleliquiditytosettlepaymentsbetweenbanks.Allthesame,thereisroomforimprovement.

Room for improvementDanmarksNationalbankhaspreviouslymaderecommendationsthathavenotyetbeenfullycompliedwith.Atthesametime,theworldandthepotentialinfrastructurethreatsareconstantlychanging,sowhatwassufficientyesterdaymaynotnecessarilybeadequatetomorrow.Bestprac-ticeisevolving,therebyenhancingrequirementsforinfrastructuresystemsandsolutions.

DanmarksNationalbankkeepsupanongoingdialoguewiththoseresponsibleforthecoresys-temsandsolutionssubjecttooversightabouttheworkregardingopenrecommendationsandotherareaswithpotentialforimprovement.Effortsaremadeonacurrentbasistoimprovethesecurityandefficiencyofthecoreinfrastructuresystemsandsolutions.

1 ForadescriptionofDanmarksNationalbank’soversight, seeDanmarksNationalbank,Oversight Policy,2015(link).

Danmarks Nationalbank’s oversight

DanmarksNationalbankoverseesthatpaymentsand

financialtransactionsinDenmarkcanbeeffectedina

safeandefficientmanner.Oversightcomprisesthecore

systemsandsolutionsintheDanishpaymentsinfrastruc-

ture:

• Kronos(interbankpayments)

• theSumclearing,IntradagclearingandStraksclearing

(retailpayments)

• theVPsettlementsystem(securitiestransactions)

• Dankort,Betalingsserviceandcredittransfers(the

mostimportantpaymentsolutions)

• InternationalsystemsofrelevancetoDenmark.

ThisreportpresentstheconclusionsofDanmarksNation-

albank’soversightoftheDanishpaymentsinfrastructure

in2017.

Againin2017,DanmarksNationalbank’soversighthadparticularfocusonthemanagementofcyberrisksandrisksarisingfrominterdependenciesbetweentheinfrastructuresystems.Animportantpartofthisworktakesplaceatsectorlevel,i.e.incollaborationbetweenfinancialsectorpartici-pants.

Focus on cyber resilienceRecentyearshaveseenseveralseriouscyberat-tacks.TwoclearexamplesaretheattacksontheBangladeshicentralbanktwoyearsagoandonMaersklastyear.Accordingly,bothpublicauthor-itiesandprivateactorsacrossthefinancialsectorhavehadstrongfocusonestablishingthebestpossibledefenceagainstcyberattacks.

Page 3: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

3

The Danish payments infrastructure Box1

Eachbankingday1,paymentsaveragingkr.502billion,cor-

respondingtoalmostonefourthofGDP,aresettledviathe

Danishpaymentsinfrastructure.

Thepaymentsinfrastructureisthenetworkofsystemsthat

enablesconsumers,firmsandpublicauthoritiestoex-

changepaymentsandfinancialtransactions.

DanmarksNationalbank’spaymentsystem,Kronos,playsa

centralroleinthisinfrastructure,bothinrelationtosettle-

mentoflarge,time-criticalpaymentsbetweenbanks(inter-

bankpayments)andbyvirtueofDanmarksNationalbank’s

roleassettlementbankforotherpaymentandsettlement

systems.Interbankpaymentsamountingtokr.74billionare

settledinKronosonadailybasis.

Retailpaymentsarepaymentsbetweenconsumers,firms

andpublicauthorities,e.g.byDankortorascredittrans-

fers.Dependingontheirtype,retailpaymentsaresettled

throughtheSumclearing,theIntradagclearingorthe

Straksclearing.

ForeignexchangetransactionsinCLScomprisee.g.FXspot,

FXforwardandFXswaptransactions.

SecuritiestransactionsinVPcomprisetradinginbonds,

equitiesandinvestmentfundshares.Somesecurities

transactions,suchasequitiestransactions,areclearedvia

acentralcounterparty,CCP.However,thisappliestoonlya

limitedshareofthetotalturnover.

Thepaymentandsettlementsystemsintheinfrastructure,

i.e.CLS,VPandthethreeretailpaymentsystems(theSum-

clearing,theIntradagclearingandtheStraksclearing),settle

theirparticipants’netpositionsinKronos.Netpositionsare

calculatedbyoffsettingparticipants’claimsandobligations

intherespectivesystems.Nettingreducestheparticipants’

liquidityrequirementforsettlementconsiderablycompared

withasituationinwhichallpaymentsaresettledindividual-

ly.Forinstance,nettingreducesthedailyliquidityrequire-

mentforthesettlementofretailpaymentsfromkr.38billion

tokr.8billion,equivalenttoareductionof79percent.In

CLSandVP,nettingreducestheliquidityrequirementby97

percentand94percent,respectively.

Payment flows, billion kroner, averages per banking day in 2017

KronosInterbank payments

Retrailpayments

Sumclearing,Intradagclearingand

Straksclearing8

74

FXtransactions

CLS

Securities transactions

VP CCPs

10

155 10

7

225

8

38

1. Sometypesofpaymentcanbemade24/7/365,othersonlyduringbankopeninghours.However,forallpayments,finalsettlement

andexchangeofamountsbetweenbankstakeplaceonbankingdays,i.e.whenbanksareopenforbusiness.

Page 4: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

4

In2016,CPMI-IOSCOissuedguidanceoncybersecurityinpaymentandsettlementsystems.2TheguidancespecifiesthemoregeneralCPMI-IOSCOprinciples3of2012inviewofincreasingcyberrisk.DanmarksNationalbankregularlymonitorstheef-fortstocomplywiththeguidance.Notallhavemadethesameheadwayintheseeffortsasdescribedinmoredetailinthesectionbelowonoversightofindi-vidualpaymentandsettlementsystems.

Sectoral collaborationCyberriskisalsoaddressedatsectorlevel,includ-ingthecyberresilienceworkoftheFinancialSectorforumforOperationalResilience,FSOR,cf.Box2.

Comprehensivemappingofthemostcriticalbusi-nessactivities,processes,systemsandfinancialsectorparticipantshasbeencarriedoutundertheauspicesoftheFSOR.Onthisbasis,adetailedan-alysisofpotentialrisksacrossinfrastructuresystemsandsolutionshasbeeninitiated,cf.belowontheworkconcerningrisksrelatedtointerdependencies.

TheFSORhasestablishedfinancialsectorcrisisresponseplanstoensurecoordinationacrossthesectorintheeventofe.g.anextensivecyberattack.DanmarksNationalbankchairsFSORandprovidessecretariatservices.Thecrisisresponseplansweretestedinboth2016and2017.Participationinthisworkservestoensure,forthesystemssubjecttooversight,compliancewiththeCPMI-IOSCOprin-cipleswhichrecommendparticipationinsectortests.

Furthermore,ithasbeendecidedatsectorleveltoestablishaDanishintelligence-ledredteamtestprogrammesettingoutcommonrequirementsforthetestingprocessthatparticipantsmustcomplete(link).Thepurposeoftheframeworkistoensurethatallparticipantswillbesubjecttoauniform

2 CPMI-IOSCOGuidanceoncyberresilienceforfinancialmarketinfra-structures(link)waspublishedbytheBankforInternationalSettle-ment,BIS,andInternationalOrganizationofSecuritiesCommissions,IOSCO.TheCommitteeonPaymentandMarketInfrastructures,CPMI,istheBIScommitteethatcontributedtoformulatingtheguidance.MembersoftheCPMIincluderepresentativesofalargenumberofcentralbankssuchastheECB,theFederalReserveBankandtheBankofEngland.

3 ThePrinciplesforfinancialmarketinfrastructures(link)werepublishedbyBIS/IOSCO.TheBIScommittee,CPMI,wascalledtheCommitteeonPaymentandSettlementSystems,CPSS,whentheprincipleswereformulated.Accordingly,theyarealsoreferredtoastheCPSS-IOSCOprinciples.

minimumlevelofcybertestingrequirements.AteamtosupporttheparticipantsduringthetestingprocesswillbeestablishedinDanmarksNational-bank.Redteamtestsareconductedasasimulatedcyberattackonsystemsinproduction,i.e.livetesting.

Assystemowners,DanmarksNationalbank,VPandFinanceDenmarkhaveallcommittedthemselvestoparticipatingintheupcomingDanishredteamtestprogramme.RedteamtestingisanimporttooltoverifyandstrengthencybersecurityandispartoftheCPMI-IOSCOcybersecurityguidance.

Financial Sector forum for Operational Resilience

Box2

TheFinancialSectorforumforOperationalResilience

(FSOR)wassetupin2016withthepurposeofincreas-

ingoperationalresilienceintheDanishfinancialsector,

includingcyberresilience.ParticipantsintheFSORin-

cludepaymentandsettlementsystems,dataprocessing

centres,thelargestDanishbanksandmortgagebanks,

financialindustryassociationsandauthorities.

ThetasksoftheFSORareto:

• ensureasharedoverviewofoperationalrisksthat

mayhaveanimpactacrossthesectorandcouldpo-

tentiallyposeathreattofinancialstabilityinDenmark

• decideonandensureimplementationofjointmeas-

urestoensurefinancialsectorresiliencetomajor

operationalincidents,includingcyberattacks

• createaframeworkforcollaborationandknowledge

sharing–withinthesector,betweendifferentsectors

andinternationally.

DanmarksNationalbankchairstheFSORandprovides

secretariatservices.

Page 5: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

5

Finally,ajointCERT4,NordicFinancialCERT,NFCERT,hasbeenestablishedatsectorlevel.Theobjectiveistocollect,shareanduseinformationoncyberthreatsandcyberattacksacrosstheNordiccountries. NFCERTalsoprovidesexpertassistancetoaddressanycyberattacks.TheCPMI-IOSCOcybersecurityguidanceemphasisesknowledgesharingasan importantaspectofbeingcyberresilient.

Risks arising from interdependenciesDanmarksNationalbankhaspreviouslyrecom-mendedastrengtheningofthecollaborationtoidentifyandaddressrisksrelatedtointerdepend-enciesbetweenKronos,theVPsettlementsystemandtheretailpaymentsystems.

ThiscollaborationhasnowbeenformalisedasaworkinggroupwiththeparticipationofDanmarksNationalbank,VPandFinanceDenmarkandwiththeobjectiveofidentifyingandassessingrisksrelatedtointerdependenciesandensuringthatrobustmeas-uresareinplaceforaddressingandcounteringtherisksidentified.

Risksmayarisee.g.asaresultof:

• theinteractionbetweeninfrastructuresystemswhichentailsthatoperationalproblemsinonesystemmayaffectsettlementinothersystems,orthatexternalrisks,forinstanceacyberattack,mayspreadbycontagionbetweenthesystems

• thedependenceonjointcriticalcommunicationsnetworksandjointuseofkeyITserviceproviders.

Theworkinggrouponinterdependenciesisdevel-opingajointmethodformanagingrisksarisingfrominterdependencies5.Thejointmethodistobeanchoredintheriskmanagementpoliciesoftheindividualparticipants.

Throughout2017,theworkinggroupalsomappedexistinginfrastructureandbusinessprocessesandidentifiedanumberofrisksrelatedtointerdepend-

4 CERTstandsforComputerEmergencyResponseTeam.

5 Theworkinggrouphasdefinedinterdependenciesas:businessprocessesand/ordataflowsacrossinfrastructuresandunderlyingsystems,ornetworkssharedbyseveralparties,whereoperationalfailuresmayinteractinsuchawaythatoneormorepartiesareun-abletocarryontheirbusinesseswithoutcollaboratingonrecovery.

encies.Thoseriskswillbeassessed,andifariskisdeemedtoexceedthejointlyagreedriskappetite,initiativestocounterthiswillbelaunched.

RiskmanagementandmonitoringofrisksrelatedtointerdependenciesisanongoingprocesstobejointlyundertakenbyVP,FinanceDenmarkandDan-marksNationalbank.Thefinalcollaborationmodelisexpectedtobeinplacebymid-2018.

Interbankpaymentsinkroner

Interbankpaymentsarepaymentsbetweenfinancialinstitutions.Suchpaymentsaretypicallycharacterisedbybeingtime-criticalandofhighvalue,andhencetheyaresettledinreal-timegrosssettlement,RTGS,systemsthatsettlepaymentsindividuallyandimmediately.

KronosisDanmarksNationalbank’sRTGSsystemforinterbankpaymentsinDanishkroner.Itisalsousedforthesettlementofmonetarypolicyoperationsandnetpositionsfromconnectedpaymentandsettle-mentsystems.

UseThereare88directKronosparticipants,mainlyDanishbanks,mortgagebanksandbranchesofforeignbanks.

In2017,approximately5,000interbankpaymentsweresettledviaKronoseveryday,correspond-ingtoadailyvalueofkr.74billion,cf.Table1,comparedwithkr.83billionin2016.Thevalueofmonetarypolicyoperationsintheformofsaleofcertificatesofdepositincreased,butthatispri-marilyattributabletotheparticipants’depositswithDanmarksNationalbankoftenexceedingtheirindividualcurrentaccountlimits.DanmarksNa-tionalbankconvertsthatpartoftheparticipants’depositswhichexceedstheircurrentaccountlimitsintocertificatesofdeposit.

Page 6: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

6

Operational reliabilityKronosuptime6exceeded99.9percentin2017,whichissatisfactory.However,oneincidentcausedthesystemuptimeinonemonthtobelowerthantheagreedservicelevel.Asaresultofnetworkprob-lems,Kronosparticipantswereunabletosendandreceivepaymentsforashortperiodon30March2017.ManualprocedureswereinitiatedtoensurethatCLSsettlementcouldbecompletedwithinthetimelimitsset.

In2017,Kronoswasalsoaffectedbyanumberofminorincidentsthatdidnothaveanyimpactonitsuptime,however.Itisassessedthatallincidentsweresatisfactorilyfollowedup.

6 TheuptimeisthetechnicaluptimesuppliedbyKronos’sITserviceprovider.Operationaldisruptionscausedbyothercircumstancesarenotincluded.

Payments in Kronos Table1

Kr.billion,averagesperbankingday

2013 2014 2015 2016 2017

Interbank payments 96.1 92.0 99.3 83.0 76.3

-Ofwhichcustomerpayments 10.3 11.0 12.8 11.5 11.8

Monetary policy operations 33.5 25.5 37.5 28.7 38.6

-Ofwhichsaleofcertificatesofdeposit 33.4 24.9 37.3 28.6 38.6

-Ofwhichmonetarypolicylending 0.2 0.6 0.2 0.1 0.0

Transfers to settlement systems 196.5 329.5 389.6 292.7 335.4

-OfwhichfortheSumclearing,IntradagclearingandStraksclearing 130.1 272.2 332.3 240.0 284.7

-OfwhichforVPsettlement 44.7 40.9 40.8 37.0 35.9

-OfwhichforCLS 21.8 16.5 16.5 15.7 14.8

Net positions settled 21.7 25.8 27.6 25.1 24.7

-OfwhichtheSumclearing,IntradagclearingandStraksclearing 3.1 7.0 7.6 7.6 7.8

-OfwhichVPsettlement 11.5 12.2 12.7 10.6 10.5

-OfwhichCLS 7.1 6.5 7.2 6.9 6.4

LiquidityOverall,Kronosparticipantshadampleliquidityforsettlementofpaymentsin2017.Chart1showstheparticipants’excessliquiditycover.

Traditionally,theliquidityrequirementisparticu-larlyhighondayswhenauctionsoffixedratebulletbondsforfinancingadjustableratemort-gageloansaresettled,i.e.typicallyatthestartoftheyearandattheendofthequarterlysettle-mentperiods.TheampleliquidityamongKronosparticipantscontributedtosmoothsettlementofpayments.

Page 7: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

7

International standardsKronosobservesthevastmajorityoftherequire-mentsintheCPMI-IOSCOprinciples.In2017,Dan-marksNationalbankcontinueditsworkonthefourareaswithpotentialforimprovementthatwereidentifiedinitsassessmentofKronosin2016.Thisincludestheworktomanagerisksarisingfrominter-dependencies,cf.above,andtoanalyserisksarisingfromindirectparticipation,cf.below.TheotherareaswithpotentialforimprovementareexpectedtobeaddressedwhenKronos2goeslive.

InNovember2017,DanmarksNationalbankpublishedananalysisofindirectparticipationinKronos.ThemajorityofindirectparticipantsareforeignbankssettlingpaymentsinDanishkronerviadirectparti-cipants.Indirectparticipationisagoodsolutionforbankswithoutin-depthknowledgeoftheDanishmar-ketorthenecessaryoperationalcapacityfordirectparticipation.Inthisway,settlementofkronerislefttoparticipantswhohaveDanishkronerasamajormarketandwhothereforehaveastronginterestinensuringthatsettlementisassmoothaspossible.

Byperformingthisanalysis,KronoscomplieswiththeCPMI-IOSCOrequirementforidentifyingandman-agingrisksassociatedwithindirectparticipation.

Stress tests DanmarksNationalbankperformsannualstresstestsofliquidityinKronos.Thepurposeofthestresstestsistomeasuretheeffectonthesettlementofpaymentsandtheliquidityoftheparticipantsundervariousformsofstress.Astressscenariomayincluderemov-ingamajorparticipantfromthesettlementofpay-ments,orlimitingtheparticipants’intradaycredit.Inpractice,apaymentssimulatorisusedtocomparetherespectivestressscenariostoabenchmarkscenariocorrespondingtotheactualsettlementofpaymentsinKronos.In2017,thetestshowedthatKronosisresilienttotheliquidityshocksinflictedonthesystembythestressscenarios.TheeffectofthesettlementofpaymentsislimitedandcanbemitigatedbymeansofKronos’contingencyprocedurestosettlecriticalpay-ments.Byperformingannualstresstests,DanmarksNationalbankcomplieswiththeCPMI-IOSCOrequire-mentforstresstestingliquidityinthesystem.

Participants’ liquidity requirements in Kronos Chart1

0

100

200

300

400

500

600

Kr.billion,dailyobservations

2013 2014 2015 2017 20182016

Available liquidity

Maximum liquidity requirement

Minimum liquidityrequirement

Note: Availableliquidityistheparticipants’totallineplustheircurrentaccountbalanceswhenKronosopensat7:00am,from24June2013includingamountsreceivedinVPsettlementcycle30at7:05am.Themaximumliquidityrequirementcorrespondstotheliquiditythattheparticipantsneedforsettlementofallthatday’spaymentswithoutdelay.Theamountdependsonthesequenceofthepaymentswithintheday.Theminimumliquidityrequirementiscalculatedastheliquiditythattheparticipantsneedforsettlementofalltheday’spaymentsaftermaximumnettingofincomingandoutgoingpayments.

Source: DanmarksNationalbank.

Page 8: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

8

Cyber resilience In2017,DanmarksNationalbankpreparedacybersecuritystrategytostrengthenthecyberresilienceofitscriticalbusinessactivities,includingKronosandtheforthcomingKronos2,cf.below.

Kronos2willstrengthencyberresilience,asthesys-temisimplementedonanewIToperatingplatformdesignedtomeethighsecurityrequirementsandcapableofcontinuousadjustmenttocomplywithrelevantrequirements.

Kronos’/Kronos2’scompliancewiththeCPMI-IOSCOcyberguidancehasbeenmapped,andthesecurityoftheforthcomingKronos2isbeingreviewedbyexternalexperts.DanmarksNationalbankiscontinu-ouslyworkingtoaddressanydeficienciesidentified.

System updates – New system underwayDanmarksNationalbankisreplacingKronoswithKronos2.ThenewsystemconsistsofanRTGSmod-uleforhandlingcriticalpaymentsandtransfersforsettlementofretailpayments,securitiestransactions,etc.,amoduleforhandlingmonetarypolicyoper-ationsandamoduleforcollateralmanagement.ThePeragosystemisusedforpaymentsandmon-etarypolicyoperationsandisalsousedbySverigesRiksbankandNorgesBank,amongothers,whiletheCalypsosystemisusedforcollateralmanagement.

InDecember2017,DanmarksNationalbankdecidedtopostponetheimplementationofKronos2.TheITplatformdidnotyethavethedesiredstabilitywhichisessentialduetothecentralroleofKronosinDan-ishpaymentservices.Moreover,DanmarksNational-bankfoundthesystemmanagementprocessestobeinsufficientlyresilient.ThedateforimplementationofKronos2is20Augustthisyear.

Interbankpaymentsineuro

DenmarkisconnectedtoTarget2,thetrans-EuropeanRTGSsystemforsettlementofinterbankpaymentsineuro.PaymentsbetweenfinancialinstitutionsandtransfersforsettlementinothereuropaymentandsettlementsystemsaresettledinTarget2.

UseThereare28DanishparticipantsinTarget2.In2017,Danishparticipants’dailyinterbankpaymentsaver-

Interbank payments in Target2 Chart2

0

5

10

15

20

25

30

Billioneuro,averagesperbankingday

2014 2015 2016 20172013

Intergroup

To foreign participants

Between Danish participants

Note: ThechartshowspaymentssubmittedbyDanishpartici-pantsviaTarget2.Dailyaverageshavebeencalculatedonamonthlybasis.

Source: DanmarksNationalbank.

aged16.7billioneuro.ExchangeofeuromostlytakesplacewithparticipantsinGermany,Finland,FranceandtheNetherlands.

DanishparticipantsuseTarget2mainlyforinter-grouppaymentsandpaymentstonon-residentparticipants.AccordingtoChart2,therehasbeenadeclineinintergrouppaymentsinthesecondhalfof2017.Thiscanbeattributedtoachangeinmarketparticipants’liquiditymanagementprac-tice.

Operational reliability TheoperationalreliabilityofthelocalTarget2componentsforwhichDanmarksNationalbankisresponsiblewassatisfactoryin2017.Therewereonlyafewminorincidentsin2017.

System updatesTheEuropeanCentralBank,ECB,hasbeenwork-ingtowardsmodernisingtheEuropeanpaymentsinfrastructureinrecentyears.TheECBisdevelop-inganinstantpaymentsysteminTarget2calledTargetInstantPaymentSettlementorTIPS.ThiswillallowDanishbankstoclearandsettleinstantpaymentsineuro.TIPSwillsupportmulti-currency,meaningthatatalaterstageitwillalsobepos-sibletoclearandsettleinstantpaymentsinothercurrenciesthaneurothroughthesystem.TIPSineuroisexpectedtobelaunchedinNovember2018.

Page 9: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

9

On6December2017,theECB’sGoverningCouncilapprovedthemigrationofTarget2totheupgradedT2Splatform7,whichwillincreasesecurityandre-duceoperationalcosts.TheconsolidatedplatformoffersnewRTGSservices,includingimprovedliquid-itymanagementproceduresandamulti-currencyservice.TheTarget2-T2SplatformisexpectedtobeoperationalfromNovember2021.

TheGoverningCouncilalsoapprovedtheestab-lishmentofajointsystemcalledtheEurosystemCollateralManagementSystem,ECMS,forcollat-eralmanagementineuro,whichwillreplacetheexistingsystemsof19nationalcentralbanks.ThenewsystemisexpectedtobelaunchedinNovem-ber2022.

Retailpayments

Paymentsbetweenconsumersandfirmscanbemadeusingbanknotesandcoinsorvariouselec-tronicpaymentsolutions,forinstanceDankortforpaymentsinsupermarkets,Betalingsservice(directdebit)forpayingrentorcredittransfersviaonlinebankingorMobilePay.Onaverage,dailyretailpay-mentstotalledkr.26.4billionin2017.

DanmarksNationalbankoverseesthemostim-portantpaymentsolutionsinDenmark,cf.Box3.

Operational reliabilityTheoperationalreliabilityofNets’systemscon-cerningDankortandBetalingsservicewasoverallsatisfactoryin2017.However,twomajorincidentsoccurredinthe3rdquarter,affectingtheavail-abilityofthecardsystemwhereby250,000and1.2millionDankorttransactions,respectively,wererejected.InDanmarksNationalbank’sassessment,Netsfolloweduptheincidentsinasatisfactorymanner.

Incaseofextendeddowntime,retailersmayrunthepaymentterminalsinofflinemodeandthuscon-

7 TheITplatformthatsupportsthetrans-Europeansecuritiessettle-mentsystem,Target2-Securities,T2S.

Danmarks Nationalbank’s oversight of payment solutions

Box3

DanmarksNationalbankoverseesDankort,Betalingsser-

viceandcredittransfers.

OversightofDankortandBetalingsserviceisaimedat

Nets,theownerofthesesolutions.

Oversightofcredittransfersispartoftheoversightof

theretailpaymentsystems(theSumclearing,Intradag-

clearingandStraksclearing),cf.thesection“Clearingand

settlementofretailpayments”.

DanmarksNationalbankregularlymonitorsdevelopments

inthevariousotherpaymentsolutionstoassesswhether

targetedoversightofthemisrequired.

MobilePayisincreasinglyusedforshoppinginstores,

onlineshopping,paymentofrecurringinvoicesandtrans-

fersbetweenusers.However,theaveragedailyturnover

forMobilePayofkr.0.2billion1isstilllimitedcomparedto

thepaymentsolutionssubjecttooversight,e.g.Dankort,

accountingforkr.1.2billionperday.

Moreover,themostsystem-criticalpartsofMobilePay

arecoveredbyDanmarksNationalbank’soversightof

theretailpaymentsystemsandDankort,asMobilePay

usescredittransfersandforinstanceDankorttoexecute

payments.

1. www.mobilepay.dk(link).

tinuetoreceiveDankortpayments.Netsiscurrentlyreviewinghowutilisationofthissolutioncanbeimproved–possiblybyautomaticallyswitchingtoofflinemodeine.g.supermarkets. NoincidentsaffectedtheoperationofBetalings-servicein2017.

The incidence of Dankort fraud is lowOverall,theincidenceofDankortfraudislow.Inabsolutefigures,Dankortfraudamountedtokr.104million8in2017,or0.23perthousandoftotalturn-over.9

8 DanmarksNationalbank’sStatBank,Payments:(link)(DNBSMIS, Type 1.1, Cat. 1, Denmark, Value, 2017 Q1-4).

9 DanmarksNationalbank’sStatBank(Payments):(link)(DNBSMIS, Type 1.1, Cat. 1, Denmark, Share of total value of transactions, 2017 Q1-4).

Page 10: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

1 0

TheincidenceofDankortfraudisalsolowrelativetofraudinconnectionwithDanishcardsabroad.10Visa/Dankortfraudabroadamountedto1.9perthousandin201711,cf.Chart3.

Fraudulent use of Dankort cards to withdraw cash and shop in stores FraudulentuseofstolenorlostDankortcardstowithdrawcashandshopinstoresamountedto0.15perthousandin2017,12cf.Chart4.

DanmarksNationalbankhasaskedNetstoreviewthepossibilityofstrengtheningtheoversightofillegalcashwithdrawals.Againstthatbackground,Netsdevelopedatechnicalsolutionthatiscapableofincludingallcashwithdrawalsintheoversight.Netshasenteredintoadialoguewiththeissuersaboutthispossibility,andthematterwillalsobediscussedatthemeetingoftheDanishPaymentsCouncilon9May2018.

10 SeeDanmarksNationalbank,FraudusingDanes’paymentcardsoccurabovealline-commerce,Danmarks Nationalbank Statistics (Payments, 2nd quarter of 2017),12December2017(link).

11 DanmarksNationalbank’sStatBank–(Payments)(link)(DNBSMIS, Type 1.1, Cat. 1, Foreign countries, Share of total value of transactions, 2017 Q1-4).

12 Nets’statistikformisbrugafDankort(Nets’statisticsonDankortfraud–inDanishonly)(link).

Total Dankort fraud, 2017 Chart3

0.0

0.5

1.0

1.5

2.0

InDenmark Abroad(Visa/Dankort)

Perthousand

Source: DanmarksNationalbank.

Dankort fraud online versus cash with-drawals and shopping in stores, 2017

Chart4

0

0.1

0.2

0.3

0.4

0.5

0.6

Online Cashwithdrawalsandshoppinginstores

Perthousand

Source: Nets.

Fraudulent use of Dankort cards to shop onlineFraudulentuseofDankortcardstoshoponlinewasthreetimeshigherin2017thanfraudinconnectionwithcashwithdrawalsandshoppinginstores,cf.Chart4.

FraudulentuseofDankortcardstoshoponlinede-clinedin2017andisnowmoreorlessonthesamelevelasinthe1sthalfof2015,cf.Chart5.

InNets’assessment,thedeclineistheresultofthemeasuresimplementedbyNetsinearly2017tostrengthenDankortsecurity,i.e.FraudPreventionandDankortSecuredbyNets.13

International standardsInMay2017,DanmarksNationalbankpublishedaDankortassessmentinaccordancewiththeECB’sstandardsforcardpaymentschemes.14ThemainconclusionwasthatDankort’sperformanceisstable

13 Fraud Preventionisasystemthatusespatternrecognitiontorejecttransactionssounusualthattheymustbeassumedtobemadebysomeoneotherthanthecardowner.Dankort Secured by NetsisasolutionbasedonstrongauthenticationwherebytheusermustenternotonlyDankortdetailsbutalsoacodereceivedbytextfromNetsbeforefinalisingthepurchase.Thismethod,whichisalsousedforpurchasesinvolvinginternationalcards,isusediftheamountexceedskr.450.

14 Cf.DanmarksNationalbank,DankortAssessment,Danmarks National-bank Report, No.4,May2017(link).

Page 11: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

1 1

withahighdegreeofavailabilityandalowleveloffraud.TheassessmentalsocontainedanumberofrecommendationsforNets.

DanmarksNationalbank’srecommendationsincluded,interalia,anexpansionoftheDankortriskassess-mentbyNets,moresystematicknowledgemanage-mentinrelationtoDankortandastrengtheningoftheframeworkfordecisionsandcommunicationregardingDankort.

NetshassubsequentlybeenworkingtocomplywithDanmarksNationalbank’srecommendations.Inthe1stquarterof2018,Netsachieveditsaimintermsofmostoftherecommendations:

• Netshasconductedanin-depthriskassessmentofDankort,comprisingseveraltypesofriskasopposedtopreviously,whenthefocuswasontheITplatform.Ithasalsoestablishedaprocessforannualriskassessmentupdates.

• Nets’outsourcingmanagementhasbeenstrength-ened.Nets’securityrequirementsaretransferredtoexternalsuppliersandmoresystematicallyfollowedup,e.g.byregularmeetingsandannualriskassessmentsofoutsourcedactivities.AVendorManagementBoardhasbeenestablishedtoensureinformationsharingandcoordinatedfollow-uponNets’externalsuppliers.

• Ingeneral,Netshasestablishedabetterorganisa-tionalandoperationalDankort-relatedoverview.

NetsisstillworkingonDanmarksNationalbank’srecommendationtostrengthentheframeworkforDankort-relateddecision-makingprocessesandcommunication.

DanmarksNationalbankrecentlyinitiatedanas-sessmentofBetalingsserviceinaccordancewiththeECB’sstandardsfordirectdebitsystems.

RegulationAnewDanishPaymentsActcameintoforceon1January2018.TheActimplementsthenewEUPay-mentServicesDirective,PSD2.15ThislegislationhasconsiderablychangedtheframeworkconditionsforpaymentsinDenmarkandtherestoftheEU.

Amongotherthings,PSD2hasintroducedarightforuserswithapaymentaccounttousethataccountbymeansofathirdpartyserviceproviderwithoutanagreementhavingbeenmadebetweentheuser’sbankandthethirdpartyserviceprovider.16PSD2thusallowsnewserviceproviderstoofferuserstheoptionofpayingforinstanceinvoicesfromtheirac-countswithoutdirectcontactwiththeirbanks–i.e.withouthavingtouseDankortoronlinebanking.17

PSD2ensuresthatalmostallpaymentserviceprovid-erswillbesubjecttosupervision,andthatallonlinepayments–apartfromcertainlimitedcases–mustbeapprovedbytheuserviastrong(two-factor)au-

15 TheDanishPaymentsActalsoadjustsanumberofspecialDanishrules,includingthecashobligation.

16 Themoredetailedrequirementsregardingthirdparties’accesstoinitiatingapaymentfromtheusers’paymentaccountswillnotenterintoforceuntilSeptember2019,however.

17 Theemergenceofservicesfromnewserviceprovidersallowinguserstobypassthebankswhenusingtheirbankaccountsisoftenreferredtoasopenbanking.

Dankort fraud in connection with online shopping

Chart5

0.00

0.10

0.20

0.30

0.40

0.50

0.60

0.70

0.80

0.90

H1 H2 H1 H2 H1 H2

2015 2016 2017

Perthousand

Source: Nets.

Page 12: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

1 2

thenticationrequiringtheusertoproveitsidentityintwodifferentwaystoreducetheriskoffraud.18

Thepurposeofthenewrulesistoincreasemarketcompetitionandimprovesecurityinconnectionwithpayments.

Clearingandsettlement ofretailpayments

TheSumclearing,IntradagclearingandStraksclear-ingarethefinancialsector’ssystemsforclearingandsettlementofDanishretailpayments.Thesys-temsareownedbyFinanceDenmark,managedbye-nettet,whichisthefinancialsector’sprojectandmanagementcompany,andprovidedbyNets.

TheSumclearingisusedforsettlementofallcardpayments,BetalingsserviceandNets’otherpaymentproducts.SettlementintheSumclearingiscarriedoutonceadayonbankingdays.TheIntradagclearingisusedforsettlementofcredittransferssuchasonlinebankingtransfers,payrolltransactionsandpublic- sectorpayments.Settlementiscarriedoutatfivefixedtimesadayonbankingdays.TheSumclearingandIntradagclearingarebothnetsettlementsystems.

TheStraksclearingisareal-timesettlementsystemwherecredittransfersofuptokr.500,000aremadewithinsecondsona24/7basis.Thisispossiblebecausethebankshaveprefundedthetransfers.TheStraksclearingisprimarilyusedforonlinebankingtransfersandpaymentsviaMobilePay.

UseThereare52directparticipantsintheretailpaymentsystemsand31indirectparticipants,whosettleviadirectparticipants.Thetotaltransactionvolumeintheretailpaymentsystemsaveragedkr.38.4billionperbankingdayin2017,representinganincreaseby5.5percenton2016,cf.Table2.

ThenumberoftransactionsintheStraksclearinghascontinuedtorise,cf.Chart6.Theincreaseismainly

18 Themoredetailedrequirementsregardingstrongcustomerauthen-ticationandtherelatedexceptionswillnotenterintoforceuntilSeptember2019,however.

Payments in the Sumclearing, Intradagclearing and Straksclearing

Table2

Kr.billion,averages perbankingday 2013 2014 2015 2016 2017

Sumclearing 29.1 17.9 16.7 17.2 17.8

Intradagclearing 13.8 17.0 17.8 18.4 19.7

Straksclearing - 0.5 0.6 0.8 0.9

Total 42.9 35.4 35.0 36.4 38.4

Source: Nets.

Payments in the Intradagclearing and Straksclearing, 2015-17

Chart6

0

200

400

600

800

1,000

0

5

10

15

20

25

Straks Intradag Straks Intradag

Thousands,averageperbanking day

Kr.billion,averageperbankingday

Number (right-hand axis)

2015

2016

2017

2015

2016

2017

2015

2016

2017

Value

Source: Nets.

attributabletoMobilePaypaymentsbeingsettledintheStraksclearing.Statisticsshowthatmorethan3.7millionDanesuseMobilePay.19

Althoughtherehasbeenanincreaseinthenumberofinstantpayments,theStraksclearingonlyaccountsforasmallshareoftotalretailpaymentsintermsofvalue,cf.Table2.

19 www.mobilepay.dk(link).

Page 13: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

1 3

Operational reliabilityRetailpaymentsystemoperationswereingeneralsatisfactoryin2017.Amajorincidentoccurredon26Aprilwhenanundergroundmaincablewascutintwo.Thecabledamageaffectedthecentralnetworkofthesectorandmeantthat,formorethaneighthours,notransactionscouldbesubmitt-edforclearing,andthatthenormalsettlementactivitiesbetweenNetsandDanmarksNational-bankwerenotcarriedoutasplanned.Thereasonforthemorethaneighthourdelayinrestoringnetworktrafficwasanunclearnetworkgovernancestructure.Inviewoftheincident,itwasdecidedtoimplementanewnetwork,cf.belowonsystemupdates.

LiquidityParticipantsreserveliquidityinaccountsatDan-marksNationalbankforsettlementoftheirnetpositions.Ifaparticipantdoesnotreservesufficientliquidity,itssettlementispostponed,andnewnetpositionsarecalculatedfortheotherparticipantswhorisknotreceivingtheexpectedliquidityforsettlement.Therewerenoincidentsofparticipantshavingtheirsettlementpostponedin2017.Onereasonisthatallparticipantsuseatleastoneoftheautomatedliquiditymanagementtools.

International standardsDanmarksNationalbankisfinalisinganassessmentoftheretailpaymentsystems’observanceoftheCPMI-IOSCOprinciples.Theassessmentwillbepub-lishedinmid-2018.

DanmarksNationalbankpreviouslyrecommendedthatFinanceDenmarkperformananalysisoftheretailpaymentsystems’observanceoftheCPMI- IOSCOcyberguidance.FinanceDenmarkwillinitiatethisanalysiswhentheaboveassessmenthasbeencompleted.

System updatesThefinancialsectorisestablishingawholenewnetworkforclearingandsettlementofretailpay-mentstoreplacetheoldnetwork.Thenetworkiscallede-connect,andTDChasbeenchosenassupplier.Theprojectishandledbye-nettettoen-suresuppliermanagementonbehalfofthesector.

e-nettetisalsoinchargeofoverallgovernancefortheparticipantsinthenewnetwork.Thenetworkisexpectedtobeimplementedinthecourseof2018.

TheopeninghoursofKronoswillbeextendedwhentheDanishkronejoinsT2S,whichwillenablelatersettlementintheretailpaymentsystems.Inthatconnection,itwaspreviouslydecidedtomovethelastsettlementsintheIntradagclearingandStraks-clearingtotakeplacelaterintheday.Thismeansthatalargershareoftransactionswillbesettledwithinthesameday.

AgroupoflargerSwedish,Danish,NorwegianandFinnishbanksarecurrentlyexploringthepossibil-itiestoestablishapan-Nordicpaymentinfrastruc-tureforalltheNordicbanks.Thevisionistocreatethefirstareaintheworld,wheredomesticandcross-borderpaymentsinmultiplecurrencies(SEK,DKK,NOKandEUR)canbemadefastandeasy.

Securitiessettlement

VPsettlementistheDanishsecuritiessettlementsystem.VPSecuritiesA/S,VP,alsoundertakesregis-trationofownershipofsecuritiesandhandlingofperiodicpayments,issues,redemptions,etc.

UseTheVPsettlementsystemhas145participants,ofwhich60arenon-residentmarketparticipants.Securitiestransactionstotallinganaverageofkr.162.7billionperbankingdayweresettledin2017,cf.Table3,afallof7.5percentrelativeto2016.Thedeclinewasstrongestforbonds,whilethevalueofinvestmentfundsharessettledcontinueditsupwardtrendfromthepreviousyears.

Operational reliabilityVPsystemuptime20was100percentin2017.Inafewcases,delaysinTarget2-Securities,thetrans-Europeansecuritiessettlementsystem,delayednight-timesettlementinVP’ssystems,butdidnotaffecttheavailabilityofVP.

20 TheuptimeisthetechnicaluptimesuppliedbyVP’sITserviceprovider.

Page 14: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

1 4

VPandDanmarksNationalbankregularlymonitorincidentsinVPtobeabletoassessoperationalrisks.Overall,theoperationalreliabilityoftheVPsettlementsystemisassessedtohavebeensatisfac-toryin2017.VPhasfollowedupanyincidentsinatimelymanner,andtheirconsequenceshavebeenlimited.

Settlement ratioAccordingtobestpractice,securitiestransactionsmustbesettledtwodaysafterthetransactiondate.Thesettlementratioindicatesthepercentage,invalueterms,ofthetransactionssettledinatimelymanner.In2017,theoverallsettlementratioinVPwas99.0percent,whichwasalittlehigherthaninthepreviousyear,cf.Chart7.Sanctions,includingfinesofuptokr.100,000,willbeimposedonVPsettlementparticipantsiftheirsettlementratiosremaintoolowforaprolongedperiodoftime.In2017,twofineswereissuedtoparticipantswithtoolowsettlementratio.

LiquidityVPparticipantsreserveliquidityinaccountsatDan-marksNationalbankforVP’snetsettlementcycles.IfVP’schecksforadequatecovershowthatabuyerdoesnothavesufficientliquidity,thereportedpurchaseswill,asamainrule,bepostponeduntilthesubsequentsettlementcycle.Participantswhohaveoverdrawntheirliquiditylinesmaybefined.

Settlement ratios in VP Chart7

92

94

96

98

100

Percent,monthlyaverages

Total

Equities and investment fund shares

Bonds

2013 2014 2015 2016 2017

Note: Inthechart,thesettlementratiosarestatedonthebasisofsettlementvalues.Forequitiesandinvestmentfundshares,thesettlementratiohasbeencalculatedasaweightedaverageofthetwotypesofsecurities,whilethetotalisaweightedaverageforalltypesofsecurities.

Source: VPSecuritiesA/S.

Equities, investment fund shares and bonds settled in VP Table3

Total Bonds EquitiesInvestment fund shares

Year,daily averages

Number oftrades,thousands

Value,kr.billion

Number oftrades,thousands

Value,kr.billion

Number oftrades,thousands

Value,kr.billion

Number oftrades,thousands

Value,kr.billion

2013 51.5 172.0 3.3 146.1 25.7 21.3 22.5 4.6

2014 61.1 178.2 3.1 144.4 32.3 28.2 25.6 5.6

2015 67.1 206.2 3.4 158.5 33.4 41.4 30.2 6.3

2016 63.6 175.9 2.8 131.8 30.9 37.6 29.9 6.6

2017 66.9 162.7 2.7 118.4 32.4 36.6 31.8 7.7

Note: Valueshavebeencalculatedonthebasisofthesecuritieslegofatrade,i.e.themarketvalueofthesecuritiestransferredfromthesellertothebuyer.

Source: VPSecuritiesA/S.

Page 15: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

1 5

Thesizeofthefinedependsonhowmanytimestheparticipanthasoverdrawnitsliquiditylinewithinthelastsixmonths.

In2017,therewereatotalof71overdraftsinVP,and29fineswereissued,cf.Chart8.Thiswasalowernumberofoverdraftsthanin2016andthenumberoffineswasreducedbyhalf.Thedevelopmentinthenumberofoverdraftsisbeingmonitoredtoassesstheefficiencyofthesanctioningsystem.

New regulations and legislationTheCentralSecuritiesDepositoriesRegulation,CSDR,wasimplementedinDanishlawwitheffectfrom2015.ThepurposeoftheCSDRistoensureconsistentregulationofcentralsecuritiesdeposito-riesintheEUwithaviewtoincreasinginternationalcompetition.Infuture,firmsmustapplyforalicencetoactascentralsecuritiesdepositories.

VPappliedforalicenceundertheCSDRinMay2017.DanmarksNationalbankandtheECBpar-ticipatedintheassessmentofVP’sapplicationasrelevantauthorities,i.e.authoritieswithrightofconsultation.TheECBisarelevantauthorityforVP,becausemorethan1percentofVP’stotalsettle-mentisineuro.

VPwasgivenitsCSDRlicencewitheffectfrom3January2018asoneofthefirstcentralsecuritiesde-positoriesintheEU.Infuture,VPmustreporttotheDanishFinancialSupervisoryAuthority,DanmarksNationalbankandtheECBaccordingtotheCSDR.Attheturnoftheyear2017/18,theexistingDanishSecuritiesTradingActwasrepealedandreplacedbytheCapitalMarketsAct.OneofthereasonsforthischangewastoensuregreatercoherencewiththeCSDRasVPistofunctioninaccordancewiththenewlegalbasis.

International standardsTherulesoftheCSDRarealignedwiththeCPMI- IOSCOprinciples,whichformthebasisforDanmarksNationalbank’soversightofthefinancialinfrastruc-ture.

VPcomplieswiththevastmajorityoftherequire-mentsintheCPMI-IOSCOprinciples.Thatwasthe

conclusionintheassessmentpublishedbyDanmarksNationalbankandtheDanishFinancialSupervisoryAuthorityin2016.21

Intheassessment,fourrecommendationsweregiventoVP–includingtoensuretheindependenceoftheBoard.InconnectionwithitsreviewofVP’sCSDRapplication,theDanishFinancialSupervisoryAuthority’sassessedthattheindependenceofVP’sBoardwassufficientlyensured.

VPcollaborateswithFinanceDenmarkandDan-marksNationalbankonmanagementoftherisksre-latedtointerdependencies.Oncethiscollaborationhasbeenformalised,VPwillbeassessedtocomplywiththeCPMI-IOSCOprincipleformanagingrisksrelatedtointerdependencies.

VPhasalsopresenteditsplantoobservetheCPMI-IOSCOprincipleforthehandlingofapar-ticipant’soperationalfailure,resolutionordefault.Basedonthedocumentationavailable,DanmarksNationalbankassessesthatVPisobservingtheprinciple.

21 Cf.DanmarksNationalbankandtheDanishFinancialSupervisoryAuthority,AssessmentofVPSecurities,February2016(link).

Overdrafts and sanctions in VP settlement

Chart8

0

10

20

30

40

50

Overdrafts Sanctions

Number,quarterlybasis

2012 2013 2014 2015 2016

Anm.: Aparticipantisfinedonlyiftheoverdraftisthepartici-pant’sownfault.Inotherwords,nofineisimposediftheoverdraftisduetonon-paymentbyanotherparticipantwhohasreservedinsufficientliquidityforsettlement.

Source: VPSecuritiesA/S.

Page 16: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

1 6

Finally,DanmarksNationalbankmadearecommen-dationregardingmanagementofbusinessrisks.Accordingtotherecommendation,VPmustensurecloserlinksbetweenitsriskmanagement,recoveryplanandresolutionplan.ThisrecommendationwasalsoissuedinconnectionwiththereviewoftheCSDRapplication.

DanmarksNationalbankregularlyassessesthemeas-uresimplementedbyVPinordertocomplywiththerequirementsoftheCPMI-IOSCOprinciples.

Cyber resilienceIntheautumnof2017,VPparticipatedintheECB’squestionnairesurveyconcerningVP’scybersecurityresponseplans.ItsresponsesshowthatVPstrength-eneditscyberattackresponseplansin2016and2017.

In2018,VPwillconductaredteamtestasasimu-latedcyberattackonsystemsinproduction,butwithoutdamagingthosesystemsortheoperationofVP.InitialtestresultsconfirmthatVPhasastrongcyberdefence.

System updatesInanefforttostrengthenitsNordicposition,VPconcludedanagreementwithSverigesRiksbankforsettlementofsecuritiestransactions,etc.inSwed-ishkronorinVP.ThesolutionwasimplementedinMarch2017.VPwillalsoestablishalinktoEuroclearSweden,thecentralSwedishsecuritiesdepository,inthecourseof2018toallowsecuritiestransactionsinSwedishkronorviaVP.

Target2-SecuritiesT2Sisatrans-Europeansecuritiessettlementsys-temownedbytheECB.ThepurposeofT2Sisforcross-bordersecuritiestransactionstobehandledassafely,inexpensivelyandefficientlyasdomestictransactions.

Atotalof20centralsecuritiesdepositoriesfrom18countriesnowsettleviaT2S,includingVP.Settlementineuro,accountingforjustover1percentoftotalsettlement,mainlytakesplaceonT2S.22Sofar,theeuroistheonlyT2Ssettlementcurrency,butfrom

22 ItwillstillbepossibletosettleineuroinVP’sownsystemsincycle50at2:15pm.

October2018,settlementinDanishkronerviathesystemispossible.

13DanishbanksaredirectparticipantsinT2SandthuscurrentlyholdT2SsettlementaccountsatDanmarksNationalbank.Threeofthosebankshaveestablishedaccountsineurowithcentralbanksintheeuroareainordertohavedirectaccesstoeuro.Theotherbankshaveconcludedagreementswithcorrespondentbanks.

CCP clearingInDenmark,equitiesandrepotransactionsare settledviaacentralcounterparty,CCP,cf.Box4.

ThethreeCCPs,EuroCCP,LCHClearnetandSixX-clear,clearequitiestransactions,whileNasdaqClearingclearsrepotransactions.AfterCCPclearing,transactionsaresettledinVP.

OngoingsupervisiontoensurethatCCPscomplywiththeregulatoryrequirementsisconductedbythenationalsupervisoryauthoritiesincollaborationwithsupervisorycolleges,comprisingsupervisoryauthoritiesandcentralbanksfromthemostim-portantcountriesinwhichtheCCPisoperating.DanmarksNationalbankmonitorsdevelopments,viaitsparticipationine.g.theEuroCCPsupervisorycollege.

What is a CCP? Box4

ACCPintermediatesbetweenthepartiestoatransac-

tion,assumingtheriskforboththebuyerandtheseller

fromthetransactiondateuntilthetransactionhasbeen

finallysettled.Soifeitherofthepartiestothetransaction

defaultswithinthisperiod,theCCPstillhasanobligation

totheotherparty.However,thisalsomeansthatrisksare

concentratedintheCCP,andthereforetheCCPissubject

toanumberofregulatoryrequirements1 to ensure the

completionofthetransaction.

1. Cf.Regulation(EU)No648/2012oftheEuropeanParliament

andoftheCouncilof4July2012onOTCderivatives,central

counterpartiesandtraderepositories(link).

Page 17: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

1 7

Settlementofforeignexchangetransactions

Aforeignexchangetransactionconsistsoftwoop-positepaymentsintwodifferentcurrencies.23Trad-itionally,foreignexchangetransactionsaresettledastwoindependentpayments,oftenexecutedviacorrespondentbanksinthecurrenciesinquestion.Ifthetwopaymentsarenotsettledsimultaneously,thepartiesincursettlementrisk.Theinternationalforeignexchangesettlementsystem,CLS,mitigatessettlementriskbysimultaneoussettlementofthetwopayments(payment-versus-payment,PvP).

CLSisownedbylarge,internationalbanksandsettlestransactionsin18participatingcurrencies,includingDanishkroner.

DanmarksNationalbankparticipatesinthecoopera-tiveoversightofCLS,cf.Box5.

UseMorethan80percentofallforeignexchangetrans-actionsinDanishkroneraresettledviaCLS.24BothfinancialinstitutionsandfirmsparticipateintheCLSsettlementofDanishkroner.IfacompanydoesnotsettledirectlyinCLSitself,FXtradescanbesettledviaoneofthefoursettlementmemberswithdirectaccesstotheCLSsettlementinDanishkrone.

In2017,thevalueofCLStransactionsremainedstable,cf.Chart9.TheaveragedailyvalueofCLStransactionswaskr.225billionin2017.Thevalueoftradesisparticularlylargearoundquarterchangeandondaysaroundforeignholidays.CLSsettle-mentsetanewrecordinDanishkroneronthefirstbankingdayof2ndquarter2017,3April,reachingkr.612billion.

Operational reliability and liquidityPay-instoCLStakeplaceviathenationalRTGSsys-tems;inthecaseofDanishkronerviaKronos.

HencetheoperationalreliabilityofCLSdependsonthestabilityoftheRTGSsystems.In2017oneKronos

23 Forexample,tradingkroneragainsteuroentailsapaymentinkronerbyonepartytotheotherandanoppositepaymentineuro.

24 BIS,Triennial Central Bank Survey, Foreign exchange turnover in April 2016(link)andCLSBank.

Trade instructions in CLS Chart9

0

1,000

2,000

3,000

4,000

5,000

0

100

200

300

400

500

Kr.billion,averagesperbanking day

Number,averagesperbankingday

Value oftrade instructions

Number oftrade instructions(right-hand axis)

2013 2014 2015 2016 2017 2018

Note: Dailyaveragescalculatedonamonthlybasis.On23January2017,CLSchangedthethresholdamountforwhichatradeissplitintoseveralinstructions.Thishasledtoahighernumberofinstructionsperday.

Source: CLSBank.

Oversight of CLS Box5

OversightofCLSisbasedontheCPMI-IOSCOprinciples

forfinancialmarketinfrastructures(PFMI).Everysecond

yearCLSpublishesanupdateddisclosureofthesystem’s

observanceofthePFMI.1OversightofCLSiscarriedout

byajointCLSOversightCommittee,whichisaforumfor

cooperationbetweenthecentralbanksoftheparticipat-

ingcurrencies2,wherebytheycancarryouttheirnational

oversightresponsibilities.DanmarksNationalbankpar-

ticipatesinthiswork,whichisorganisedbytheFederal

Reserve,Fed.TheFedisalsothesupervisoryauthority

forCLS. DanmarksNationalbank’soversightisfocusedon

mattersofimportancetothesettlementoftransactionsin

Danishkroner.

1. CLS,PrinciplesforFinancialMarketInfrastructuresDisclosure,

2016(link).

2. FederalReserveSystem,ProtocolfortheCooperativeOversight

ArrangementofCLS(link).

Page 18: DSNATIONALBANK · 2018-04-30 · Maersk last year. Accordingly, both public author-ities and private actors across the financial sector ... 4 CERT stands for Computer Emergency Response

DANMARKS NATIONALBANK

HAVNEGADE 5

DK-1093 COPENHAGEN K

WWW.NATIONALBANKEN.DK

This edition closed for contributions on 16 April 2018

ABOUT REPORT Reports are periodical reports and accounts describing the activities and tasks of Danmarks Nationalbank.

Reports include e.g. Danmarks Nationalbank’s annual report and the semi-annual report on monetary and financial trends.

R E P O RT — DA N M A R K S N AT I O N A L BA N KOV E R S I G H T O F T H E F I N A N C I A L I N F R A S T RU C T U R E

incidentaffectedCLSsettlement.On30March2017settlementinKronoswasaffectedbynetworkissuesresultinginCLSnotreceivingpayments.ManualprocedureswerelaunchedtoensureCLSsettlementwithinkeybusinessdeadlines.

TheDanishparticipantsreservesufficientliquidityforCLSsettlement.

System updatesCLScontinuestoworktowardsthelaunchof CLSNet25,astandardised,automatedbilateralpaymentnettingserviceintendedforFXtransac-tionssettledoutsidetheCLSsettlementservice.ParticipantswillbeabletosubmitFXinstructionsfortradesinmorethan125currencies.Theservicewillbelaunchedonadistributedledgertechnology(DLT)basedplatform.CLSNetcanbeaccessedeitherdirectlyviaDLTorindirectlyviaSWIFTchannels.

FurthermoreCLSplanstolaunchaseparatesettle-mentserviceforclearedFXproducts.ThefirstCCPstojointhenewserviceareexpectedtobeEurexClearingandLCHClearnet.

25 CLS,CLSNet(link).

AnothernewinitiativeunderwayisCLSNow26whichwillallowparticipantstomitigatesettlementriskassociatedwithsamedayFXtransactions,includingtheoutlegsofCLSin-outswaptransactions27. CLSNowwillprovidesimultaneoussettlementofbothlegs(PvP)onagrossbasis.TheservicewillbeopenforallCLSeligiblecurrenciesinthefuture28.

26 CLS,CLSNow(link).

27 InCLSin/outswapsreducelargepositionstominimiseliquidityriskinsettlement.

28 Atgo-live,onlyCAD,CHF,EUR,GBP,andUSDwillbeincluded.