Rapid technological advancements and digitalization continue to shape the Canadian banking sector. Technology is changing the way financial products and services are accessed and used by people and businesses, thereby influencing customer preferences and catalyzing change in the way banks connect to their clients. Banking is likewise transforming at a record pace, bringing innovation and new potential to empower Canadians in a primarily digital world.
To be sure, the COVID‑19 pandemic accelerated digital transformation in banking and led to an increase in customer preferences for tech‑driven solutions. This global event proved to be a major driver of change as Canadians moved more of their daily activities online, including a large‑scale uptake of digital banking and contactless transaction methods. The Canadian Bankers Association’s recent How Canadians Bank survey shows that more than three‑quarters of Canadians (78 per cent) rely on digital channels to conduct most of their banking transactions, and three out of four customers intend to keep the digital banking habits developed during the past two years.
Canadians today have unprecedented access to reliable technology platforms to serve all aspects of banking. Correspondingly, banks continue to embrace digital modernization and transformation efforts at pace and scale, but they are also working to address and mitigate associated risks. Non‑financial risks have evolved as financial institutions modernize their operations and client experience, including cyber security, third‑party ecosystem exposure and those related to the use of advanced tools such as artificial intelligence and machine learning.
In response, enterprise risk management functions have also evolved to factor in emerging threats and are increasingly involved at the start of the development of new products and services. This is based on a bedrock commitment to ensure the continued resilience of financial institutions and the stability of the Canadian financial system.
Stability as a source of strength
The Canadian banking system is widely recognized for its prudent lending practices, diligent government oversight and sensible regulation based on the core tenets of safety and soundness. Banks are diligent managers of risk and have over the years made significant progress in enhancing their risk management practices and strategies. Guided by strong leadership, our country’s banks have a proven track record of addressing a wide range of risks, including credit, liquidity, market, operational and technological.
The Canadian financial system has demonstrated resilience to significant external shocks in recent years, including the Great Recession of 2008‑09 and the coronavirus pandemic, thanks in large part to a well‑capitalized banking sector with a strong focus on risk management. Like all forward‑looking organizations, banks are always evolving their frameworks to factor in new types of hazards, and increasingly so, those associated with technology.
As they have in the past, banks will continue to focus on the resilience of their own operations and contribute to a well‑functioning financial system that is positioned to respond to present and future threats. From a macroprudential standpoint, the banking sector is committed to working with federal authorities to continually strengthen and enhance the resilience of our country’s financial system, one of the best in the world.
Technology risk as one part of a greater whole
From a purely risk‑based perspective, technology should be considered holistically through an operational resilience lens as part of a financial institution’s Operational Risk Management (ORM) framework. Indeed, operational resilience is not a new concept for banks — it draws upon capabilities across ORM, including implications related to technology. ORM, as a component of broader Enterprise Risk Management, ultimately provides context that enables banks to understand the operational impacts on a bank when safety could be compromised.
Given the extent to which technology is utilized in banking today – at this point it underpins a broad array of functions and processes – technology risk is a key component of overall operational resilience, but not separate from other uncertainties faced by banks. Treating potential technology exposures as one aspect of a broader approach to operational resilience enables financial institutions of all sizes to compete effectively, take full advantage of digital innovation and continue to prioritize the security and stability of their systems on an iterative basis.
Banks are best positioned to determine the potential impacts of technology risk to their operations and to determine appropriate measures to safeguard their systems. Technology enables nearly every activity in financial services and, as a result, a huge portion of capital investments and operational expenses are dedicated to it. A bank’s business model, the relevant business line and the technology used are some of the primary factors that influence how a bank protects the ongoing soundness of its technology.
As the pace of technological change is accelerating and consumer behaviours are continuing to evolve, being adaptive to changing market conditions is crucial – this includes the ability to assess and adopt new technology to stay ahead of the curve and quickly respond to special situations.
For example, the pandemic presented an unparalleled velocity of change in the financial sector and the broader economy. The banking sector supported Canadians through the pandemic by working in lockstep with regulators and policy makers, and banks’ abilities to respond to this unprecedented event with unwavering stability was a direct result of prior significant investments in technology and resources leveraging sound operational risk programs in preparation for challenging events. Canada’s six largest banks alone spent more than C$100 billion on technology between 2009 and 2019, much of that going to attracting highly skilled IT security professionals and investing in cutting‑edge technologies. The crisis was a significant event that tested how these investments strengthened the resiliency of bank operations and the quality of customer service. The necessary technologies were already in place as the pandemic hit, when it mattered most, and further innovations were developed in record time to support customers as their lives changed dramatically, all while ensuring the safety and soundness of the financial system.
The pandemic therefore reinforced the notion that operational resilience is really the combination of people resilience, organisational capabilities, and financial resilience – all of which promote stability within a bank.
Intersections, coordination and harmonization
As business strategies and customer services evolve in a connected world, the way in which financial institutions manage cyber, technology and third‑party risks is of course also evolving. While these risks are distinct from one another, they are all very much interconnected. Banks have therefore expanded their threat assessment mindset and frameworks to factor them in and expand the scope of their plans and approaches in a changing world.
By the same token, the CBA and its members encourage our country’s financial regulators to take a flexible, principles‑based and technology‑neutral approach to guidance on technology‑related risk areas.
As technology continues to advance, this regulatory approach will be particularly important in providing financial institutions with the flexibility needed to quickly address new dangers that materialize and develop enhanced operational resilience, while also providing innovative, in‑demand services to their customers.
Beyond technology‑related implications, these concepts are important to keep in mind as a multitude of initiatives move forward in Canada, including those relating to consumer‑directed finance (often referring to as “open banking”), payments modernization, privacy reform and the digitalization of money, all of which are interconnected and have a considerable impact on the way in which Canadians participate in a digital and data‑driven economy.
Indeed, the CBA and its members encourage ongoing collaboration and coordination among policy makers and regulators to promote alignment and consistency on approaches to areas of overlapping interest.
As the financial services landscape transforms, Canada’s banks will continue to collaborate and engage with OSFI and other federal authorities to keep our country’s financial sector safe and sound, while at the same time working collaboratively with them to help foster an environment that promotes innovation and competition to better serve Canadians. Finding the right balance between stability and innovation will help ensure the Canadian financial system remains world class.