FRM Part II · FRM Exam Part II · Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector

A central bank runs a system-wide cyber stress test in which a critical payment service is unavailable. Participating banks report they can each tolerate a 4-hour outage individually, but the test shows the common provider outage would last 10 hours and that banks' liquidity buffers cover only 6 hours of blocked payments. What is the most appropriate macroprudential conclusion?

There is a 4-hour shortfall, since a 10-hour common outage exceeds the 6 hours of liquidity coverage. Firm-level tolerances ignore the correlated shared-provider failure, so the authority should set system-level tolerances and require alternative arrangements or stronger recovery capacity rather than conclude the system is resilient.

1. AThe system is resilient because each bank passed its individual 4-hour tolerance
2. BImpact tolerance should be set only at firm level, so no action is needed
3. CBuffers should be cut because the outage probability is low
4. DThere is a 4-hour gap between expected disruption and buffer coverage, indicating the need for system-level tolerances, alternative payment arrangements or stronger recovery capacityCorrect