Banks need clear regulatory targets for improving IT systems, says Tyrie

In letters to Andrew Bailey, chief executive of the Prudential Regulation Authority (PRA), and Tracey McDermott, acting chief executive of the Financial Conduct Authority (FCA), Andrew Tyrie said banks need "greater IT expertise" in the board room and that "much greater resources should be put towards modernising, managing and securing banks' IT infrastructure".

Tyrie, chair of the Treasury Select Committee, said a group should be set up to assess cyber security risks to banks and have responsibility for ensuring bank systems become "more robust".

"Currently, no one group seems to be directly responsible for developing a full understanding of the [cyber security] risks carried, both on the conduct and prudential side, by individual banks," Tyrie said in his letter. "A group of this type should now be formed with the primary task of ensuring that the banks develop more robust resilience to protect banking and payment systems."

Tyrie said that a failure to act to improve bank IT systems would "expose" the public unnecessarily to "the risks of banking failures", such as delays in payments being processed, the inability to access their own funds and the unauthorised accessing of their accounts.

"The banks now need clear objectives and targets for improving IT performance, and the regulators need to know that parliament will expect them to ensure that the objectives and targets are in place," Tyrie said. "These IT risks and problems are causing a considerable amount of distress and disruption to millions of people and thousands of businesses. The current situation cannot be allowed to continue."

"IT risks need to be accorded the same status as credit, financial and conduct risk. They are every bit as serious a threat to customers and to overall financial stability. More, and higher quality, investment is probably required," he said.