Beyond borders: Regulating the risks we share

I wasn’t fortunate enough to work as closely with Mike as many of you in this room. 

But I knew him well enough during my time with the IOSCO board to appreciate someone who was kind and unassuming, whilst being absolutely determined to make lives better through his work.  

He personified the very best attributes of dedicated public service.  

In his 2024 lecture Andrew Bailey described Mike as a passionate internationalist, and reflected on what this meant for the UK after the Brexit referendum.  

Two years on, the values that Mike championed are even more on point. 

Mike understood implicitly that relationships between regulators are about so much more than institutional goodwill – they depend on trust, candour and constructive practical action.  

That’s an aspect of his legacy that is just as relevant – perhaps even more so – today.  

In an increasingly interconnected global financial system, no institution can see the whole picture on its own.  

Success depends not only on what each regulator does individually, but on what we can see, understand, test, and address together.

Post-settlement

Many of us here today worked together in the years after the Global Financial Crisis. We remember the scale, the urgency, and the difficulty of rebuilding.  

The work to strengthen capital requirements, improve market transparency, reform derivatives markets, and improve clearing.  

By and large, we have made the system stronger and more resilient. The FSB found[1] that the improved resilience of banks was key to absorbing the economic shock of the pandemic.

So we shouldn’t forget that settlement, and the example of what can be achieved when we pool our efforts.  

But we also have to remember that it was designed to tackle the causes of the last crisis. Nearly 20 years later, it doesn’t guarantee us protection from the next.  

And this is where the debate becomes more difficult.  

Regulators on both sides of the Atlantic are being pushed to simplify regulation, in order to support competitiveness and growth.  

It’s not hard to see why: IMF forecasts for 2027 suggest China’s GDP growth will be roughly twice that of the US, and India’s around three times.  

Meanwhile the UK could be pushed down to 7th place in the global rankings[2], as India leapfrogs both us and Japan to take 4th spot.

So there can be no disputing that we should support innovation, competitiveness and growth wherever we can.  

But we must not confuse supporting growth with weakening resilience.  

Growth built on unseen or misunderstood dependencies is just deferred instability.

The new problem: horizontal risk

And today’s risks are quite different to 20 years ago.

They travel further and faster, cutting across traditional regulatory boundaries: firms, sectors, supply chains, jurisdictions. 

Take climate risk. 

Politics aside, we’re all noticing our natural environment changing around us. 

The UK just recorded its hottest summer on record[3]. And 9 of the top 10 biggest California wildfires occurred in the last decade[4].

As climate-driven perils become more frequent and systemic, insurers are choosing to restrict coverage or exit sectors entirely.

Just as huge swathes of Malibu and the Palisades burned last January, the US Treasury published data showing that homeowners in the top 20% highest-risk areas paid 82% more for insurance than those in the bottom 20%.

They were also far more likely to be dropped by their insurer altogether. 

It’s clear why reduced access to cover hits property values and mortgages.  

But it can also feed through to credit portfolios in turn and, ultimately, the stability of the wider financial system. 

It remains to be seen how the current super El Niño unfolds over the winter and into next year.  

But its scale raises concerns far beyond insurance: the possibility of a synchronised shock to food systems, energy markets and global supply chains, with obvious implications for us all on inflation, growth and financial stability.

Technology transmits risk even faster.

The 2024 CrowdStrike incident left more than 10,000 flights grounded, with health and payment services severely disrupted.

Estimates suggest[5] the outage cost US Fortune 500 companies $5.4 billion.

And that was just one company, issuing one faulty software update, affecting fewer than one per cent of Windows devices. 

It illustrates a serious risk around shared digital infrastructure.  

With so many firms relying on the same small group of cloud providers, data sources and AI models, a failure in one part is a global tripwire.

The next economic crisis may not even originate in financial services; it may begin in a dependency.  

And that is the fundamental mismatch in regulation today.

Risk increasingly travels horizontally across firms, sectors and borders. But our approach is still organised largely vertically, by sector, regulator, jurisdiction.

That isn’t a criticism of any one institution; it’s the reality of a system that was designed in, and for, a different kind of world.

Clinging to that siloed system in today’s world creates gaps which, at best, allow accidental errors to cause widespread damage – like CrowdStrike.

At worst, they can create serious security and defence vulnerabilities for cyber attackers, financial criminals and hostile actors to exploit. 

We are now contending with new threats posed by rogue AI models, whether designed in China or by Western companies intending to achieve multi-trillion dollar IPOs. 

So a binary debate on ‘more regulation’ or ‘less regulation’ misses the point.  

The real question is how regulation can – and must – adapt to the way risk is now moving.

Domestic cooperation

On a domestic level, the FCA is rethinking who we engage with, how, and how deeply: 

• Whether our legal perimeter covers the right activities.
• Whether we can use existing powers more creatively to tackle risks which originate outside the financial system.
• Whether we need to reimagine how we cooperate with others.

So we’re stepping up our coordination with fellow UK policymakers and agencies on cross-cutting areas like digital markets.  

But just as important is connecting with new partners and in new ways. 

We hosted a financial crime conference earlier this year, which convened a broad set of key players.  

More than 400 attendees not just from government and regulators, but industry, professional bodies, as well as third parties like tech firms, who increasingly find themselves on the front line in the fight against financial crime. 

We are so mindful of the systemic importance of some of these firms that the FCA, Bank of England and Prudential Regulation Authority have worked together on a Critical Third Parties Regime.  

So far, it covers major cloud computing providers.  

That does not mean we will be regulating these firms as if they were financial services firms, or assuming that every supplier is systemically significant.  

But this will be the first time that UK financial regulators are able to extend their reach outside the financial sector, with powers to test the resilience of crucial services on which so much of the financial system depends.  

Because we must be clear-eyed on whether other providers outside the regulatory perimeter have become critical to the functioning of the financial system. 

And whether we, as regulators, have the right visibility and tools to manage that risk. 

I think it’s a question that will come up more and more often – not only cloud services, but with AI models, data providers, social media platforms. 

And we’ll increasingly have to ask ourselves: what should be regulated, who should be regulated, and by whom?

International cooperation

But for the kind of horizontal risks I’ve mentioned today, domestic coordination alone will not cut it. 

We have to look beyond our own backyard, using domestic coordination and international collaboration to reinforce one another. 

I believe that it would be irresponsible to shy away from a challenge which honours Mike Gill’s internationalist values.  

Because if the risks are horizontal and global, our response must be too.

This is not about trade wars, spheres of influence or the other markers of geopolitics which capture the headlines.  

In my view, there are three main varieties of global cooperation among regulators, only one of which can transcend political considerations.  

First, multilateral standard setting. That’s hard at this juncture. Even the post-crisis reforms were vulnerable to inconsistent local implementation – or none at all.  

Second, bilateral mutual market access agreements. These face strong headwinds compared to a few years back, when Chris and Mike were such strong advocates of regulatory recognition to underpin cross-border investment.  

That leaves supervisory cooperation. How we manage risks arising in global wholesale money flows, global retail payments systems and globally active financial services. 

The issue we now face is how this type of cooperation can address the severe risks to financial firms, markets and infrastructure which increasingly originate outside the domain of financial regulation.  

I would suggest three things. 

First, continuing to build a shared picture of risk. 

IOSCO’s I-SCAN network is a good example. 

At the FCA we have received reports from consumers about certain entities appearing in our markets.  

Thanks to warning alerts by overseas regulators on I-SCAN, we’ve been able to confirm that those entities are not authorised and warn consumers accordingly. 

Intelligence gathered in one market, directly helping protect others. 

By building on this kind of genuine, practical activity, we can do more to identify cross-border scams faster, and protect consumers, firms and our markets more effectively. 

The same principle can apply to emerging opportunities. 

The FCA is working with the Monetary Authority of Singapore to develop tools to support safe, responsible AI adoption.  

And through the Global Financial Innovation Network, we’re leading work on a quantum toolkit due to be launched next month. 

The toolkit draws together insights from 25 members, including US regulators, into something greater than the sum of its parts. 

By learning together in this kind of way, we can make progress more quickly and with greater confidence than any of us could on our own. 

Of course, the extraordinarily rapid emergence of agentic AI risks takes the importance of this to a whole new level.  

Second, we need to test together. 

Firm-level stress tests are important, but system-wide risks cannot be understood through isolated firm exercises. 

Military allies run joint exercises to test their readiness in the face of threats.  

Just last month, the UK and US successfully launched a torpedo from an uncrewed underwater drone for the first time[6]. A breakthrough in our efforts to protect critical subsea infrastructure, like the cables on which the global economy depends.

So if financial stability is part of national security and resilience – which I think we all agree it is – it’s right that we apply the same principles. 

Earlier this year, the UK participated in a cyber crisis simulation exercise with fellow G7 countries to test how we would coordinate during a major cross-border incident.  

We should step up that effort, regularly testing scenarios that cross borders, sectors and supply chains: a major cyber attack, a cloud outage, a disruption in digital money. 

And those exercises shouldn’t be limited to just policymakers; they should include financial firms, market infrastructure and critical third parties where relevant too. 

Finally, third: we need to be ready to act together. 

The midst of a crisis is the worst time to discover that our data sets cannot speak to one another, or to be hastily trying to resolve legal barriers.  

Shared intelligence and joint exercises only take us so far; we also need the mechanisms in place that will allow authorities to move quickly if and when a threat materialises. 

Legal gateways. Data-sharing standards. Crisis protocols. 

Project Aperta, a BIS Innovation Hub Hong Kong project, is one example of the kind of thinking needed: building a prototype showing how different countries could connect their Open Finance systems, allowing data to be shared safely across borders. 

This is the sort of practical infrastructure an interconnected system like ours needs.  

Not cooperation for its own sake – real collaboration to ensure that, when it really matters, we’re ready.

Conclusion

Now I’m not saying any of this is easy. 

And at a time when agencies both sides of the Atlantic are being asked to simplify regulation, greater international cooperation may sound counterintuitive. 

But the sheer speed, scale and spread of today’s risks leaves us no choice. 

We have to make cooperation work better. 

That doesn’t mean identical rules across jurisdictions, or diluting regulatory sovereignty. 

But regulation matched to the realities of the world we live in…

…simpler where possible, sharper where it needs to be, and system-wide by necessity. 

When the risks are so horizontal, our response must be too.  

As the two largest global financial centres, the US and the UK have an important role to play in setting the tone and pace. 

I think Mike would have recognised the spirit of this effort: practical, cooperative, rooted in trust.  

And I hope you will join me in carrying it forward.