How Resilient is the U.S. Repo Market to Cyber-Induced Outages?

Views and opinions expressed are those of the authors and do not necessarily represent official positions or policies of the OFR or Treasury.

Risks to the financial system from cyber-induced operational disruptions have become increasingly salient. The U.S. repurchase agreement (repo) market serves as a critical medium for liquidity provision and monetary policy. Yet, while no known operational disruptions have previously impacted this market, sudden spikes in rates due to perceived liquidity shortfalls have underscored the market’s vulnerability, as seen on September 17, 2019, when repo rates surged from approximately 2% to nearly 10%. This rate spike disrupted short-term funding markets and prompted immediate intervention by the Federal Reserve to prevent stress from spreading throughout the broader financial system.

The repo market enables financing by using U.S. Treasuries and other high-quality securities as collateral to facilitate over $13.5 trillion in outstanding agreements daily. These transactions connect a wide array of institutions like dealers, banks, hedge funds, and money market funds through time-sensitive cash and collateral exchanges. Because of these interconnections, proper repo market functioning is an essential part of the broader financial infrastructure.

In their working paper, Short-Circuiting Short-Term Funding, authors R. Jay Kahn, Senior Economist at the Board of Governors of the Federal Reserve System; Neth Karunamuni, former OFR analyst; and Mark Paddrik, Acting Deputy Director of OFR’s Research and Analysis Center; construct an empirical approach to assess systemic vulnerabilities within the repo market related to firm-level cybersecurity posturing. Their findings quantify how these vulnerabilities can generate funding shortfalls, alter trading patterns, and affect pricing of secured funding.

The authors combine tri-party repo market transaction data with cybersecurity ratings from BitSight Technologies, a provider of externally observed cybersecurity performance data. Through a series of simulations, they evaluate the consequences of cyber-induced operational outages across markets. Their results indicate that disruptions at certain institutions can affect over $100 billion in funding (see Figure 1) and raise repo rates by over 50 basis points. Among those with a potential direct impact, they find that disruptions among asset managers pose the most significant impact to market liquidity.

Notably, the consequences of an event are influenced not only by those impacted but also when the disruption begins and the speed at which firms recover. The authors find that outages occurring during peak settlement hours have the most immediate and widespread consequences while those starting earlier in the day can be more damaging for institutions with low resiliency and slow recovery times. These findings suggest that regulatory focus should extend beyond baseline cybersecurity to include the timeliness of operational recoveries with special attention given to timing vulnerabilities and concentration risks in the repo ecosystem.