Cyber risk in payment systems and financial market infrastructures: challenges and lessons

What it is about

Eduardo Tejeda, from Banco de México, presented at the Third Annual Risk Conference (September 2025) the challenges of cyber risk in payment systems and financial market infrastructures (FMIs), and three lessons for facing it. The opinions are the author's and do not necessarily reflect the official position of Banco de México.

The 20 slides explain what FMIs are and why central banks care about their proper functioning, show the FMI landscape in Mexico, set out the paradox of modernization (more speed and interconnection, more exposure), review cases such as the hack of Bangladesh's central bank and close with three lessons: governance, the weakest link and testing beyond paper.

Objectives

• Explain the role of financial market infrastructures and why they are critical.
• Show how modernization and interconnection increase exposure to cyber risk.
• Share three lessons learned to strengthen cyber resilience.

Key takeaways

1. Most central banks have among their purposes to promote the proper functioning of FMIs, because the stability and acceptance of the currency and of payments depend on them.
2. According to a Banco de México survey cited, 88% of financial institutions consider cyber and technology risks among the main sources of non-financial risk.
3. The hack of Bangladesh's central bank (US$81 million, through social engineering to access the Swift network) illustrates how an attack can compromise an infrastructure.
4. Lesson 1, governance: involvement from senior management, a cybersecurity strategy, three lines of defense and independent cybersecurity areas.
5. Lesson 2: you are only as strong as the weakest link, so requirements are set for suppliers. Lesson 3: paper is not enough; penetration tests, red team exercises and operation from an alternate site are needed.