What's new
Overview
This deep dive takes stock of recent developments in cyber and operational resilience, including current supervisory risk watch points, the direction of policy and guidance as well as evolving supervisory practices.
What's new
Financial Stability Board finalizes 12 sound practices for responsible AI adoption by financial institutions
The Financial Stability Board has finalized 12 nonbinding sound practices covering organization-wide AI governance and risk management throughout the AI lifecycle. The proportionate toolkit addresses areas including documentation, data, explainability, performance, human oversight, cyber risk and third-party dependencies, with expanded consideration of agentic AI following consultation. Boards and senior management are strongly encouraged to incorporate the practices into existing governance and control frameworks.
Bank of Italy calls for frontier AI risk plans by end-2026 and extends nonperforming loan coverage approach to smaller banks
The Bank of Italy has asked directly supervised intermediaries to assess frontier AI risks and submit remediation plans by the end of 2026. Preliminary supervisory work points to gaps in board oversight, AI risk frameworks, data governance and operational resilience. The Bank is also gradually extending its pre-2019 nonperforming loan coverage approach to smaller banks.
Reserve Bank of New Zealand and New Zealand's Financial Markets Authority outline supervisory expectations for frontier AI cyber risks
The Reserve Bank of New Zealand and the Financial Markets Authority outlined supervisory expectations for cyber risks associated with frontier AI. Regulated entities should strengthen core cyber controls, governance and oversight, manage third party concentration risks and test response and recovery plans against AI enabled attacks and disruptions. Accountability for operational risk remains with regulated entities.
Australian Prudential Regulation Authority and Reserve Bank of New Zealand find banks resilient in first joint stress test since 2017
The Australian Prudential Regulation Authority and Reserve Bank of New Zealand found that both banking systems would remain resilient under a severe cross-border stress scenario, with banks continuing to extend credit despite substantial losses and capital and liquidity pressure. The first joint exercise since 2017 examined economic, funding, market and cyber shocks and will inform future supervision, crisis management and stress testing.
Cayman Islands Monetary Authority finds financial system resilient, flags medium interconnectedness, climate and cyber risks
The Cayman Islands Monetary Authority found the financial system broadly resilient, with no broad domestic imbalances, but rated interconnectedness, climate related risk, and cyber and operational risk as medium. Its first mutual fund stress test showed that more than 90% of funds could withstand hypothetical redemption shocks of 5% to 20% when liquid assets were considered.
South Korea Financial Services Commission sets out cybersecurity overhaul after breaches at 16 firms and deficiencies at 130 of 555 firms
The South Korea Financial Services Commission confirmed cyber breaches at 16 financial firms and about 100,000 exposed personal-information records, while finding deficiencies at 130 of 555 firms reviewed. It plans a systemwide security review, expanded threat sharing, AI-based monitoring and testing, more frequent vulnerability assessments and stronger support for smaller firms. Chief executive accountability and sanctions will also be strengthened to improve implementation.
Australian Securities and Investments Commission secures AUD 1.35 million penalty against Fortnum for cybersecurity risk failures
ASIC has secured an AUD 1.35 million penalty against Fortnum Private Wealth for inadequate cybersecurity controls across a network serving about 55,000 retail clients. Fortnum admitted deficiencies in its policies, oversight, specialist resources and risk management systems, and must also pay AUD 250,000 toward ASIC’s costs. The case is ASIC’s third enforcement outcome against a licensee over cybersecurity failures.
Joint Committee of the European Supervisory Authorities sets 2027 priorities for digital resilience, innovation and cross-sector supervision
The Joint Committee of the European Supervisory Authorities has set its 2027 priorities for coordinated supervision, including digital resilience, technological innovation, sustainable finance, securitisation and cross-sectoral risk monitoring. Work will include oversight of critical technology providers under the Digital Operational Resilience Act, assessment of artificial intelligence and continued joint action on consumer protection.
European Supervisory Authorities set 2027 priorities for DORA oversight, AI, sustainable finance and securitisation
The European Supervisory Authorities have set their 2027 joint priorities, led by DORA oversight, cyber preparedness, AI and tokenisation, sustainable finance and securitisation. Planned work includes examinations of critical ICT providers, major incident reporting, cross-sectoral risk updates and technical measures linked to EU regulatory reforms. The programme will also seek to simplify requirements and reduce unnecessary regulatory burdens.
International Monetary Fund flags elevated financial stability risks from AI repricing, sovereign yields and cyber threats
The International Monetary Fund warned that an AI-related market correction, a disorderly rise in sovereign yields and cyberattacks could sharply tighten global financial conditions. Banks remain broadly resilient, but stress tests classify institutions representing 22 percent of global banking assets as weak. The IMF called for tighter control of leverage, stronger bank and bond market safeguards, enhanced nonbank and cyber oversight, and robust legal and settlement frameworks for tokenized markets.
Financial Stability Board flags sovereign bond, private credit and AI risks in G20 policy package
The Financial Stability Board has flagged sovereign bond volatility, private credit vulnerabilities and AI-related risks in a policy package for the G20. It calls for stronger cross-border stablecoin oversight and presents final AI sound practices, proposed regulatory modernization principles and reviews of policy implementation and bank resolution funding. Further work on AI and implementation monitoring is planned for 2027.
Italian Institute for Insurance Supervision and partners launch cybersecurity campaign targeting online fraud involving artificial intelligence
The Italian Institute for Insurance Supervision and financial sector partners have launched a new edition of the “I Navigati” cybersecurity awareness campaign, with a focus on online fraud involving artificial intelligence. Digital guidance and information events at participating bank branches will help citizens, families and businesses prevent scams and use digital tools more safely.
Bank of Ghana reports all 23 banks meet capital requirements and shifts focus to resilience reforms
Bank of Ghana Governor Dr Johnson Pandit Asiama reported that all 23 banks now meet regulatory capital requirements, shifting the supervisory focus from capital restoration to longer-term resilience. Banks must reduce nonperforming loan ratios to 10% by the end of December 2026. The central bank is also preparing credit risk, liquidity and artificial intelligence directives and plans further business model and cybersecurity reviews.
Bank of England-led group tests response of 38 systemic banks and market infrastructure operators to global cloud disruption
The Bank of England-led Cross-Market Operational Resilience Group tested how authorities and 38 systemic banks and market infrastructure operators would respond to a global cloud services disruption. The Bank expects firms to use the findings to strengthen their resilience and response to severe operational and cyber incidents.
Thailand Office of Insurance Commission advances insurer stability law reforms and preventive supervision for six mega risks
Thailand Office of Insurance Commission Secretary-General Chuchat Pramoolpol outlined legal and supervisory measures to protect insurers against six interconnected mega risks. Planned amendments cover governance, professional independence, risk-based capital, disclosure and early intervention, supported by ERM, ORSA, composite risk ratings and stress testing. The measures advance a preventive supervisory model designed to identify and address insurer vulnerabilities before they harm policyholders.
Canada's Office of the Superintendent of Financial Institutions focuses semiannual risk outlook on frontier AI threats
The Office of the Superintendent of Financial Institutions warned that frontier AI can amplify cyber, technology, third-party and reputational risks across Canada’s financial system. Institutions should strengthen governance, controls and testing, while boards and senior management remain accountable for managing these risks. OSFI is also enhancing its assessment of frontier AI, technology concentration and critical third-party dependencies.
Swiss Federal Department of Finance reports cyberattack on Publica software supplier and criminal investigation
The Swiss Federal Department of Finance reported a cyberattack on an external software supplier used by the Swiss Federal Pension Fund Publica. Authorities are assessing which Publica data were affected, and the Office of the Attorney General has opened an investigation.
Canada’s Office of the Superintendent of Financial Institutions urges disciplined risk-taking and stronger oversight of interconnected and AI risks
OSFI Superintendent Peter Routledge urged financial institutions to combine disciplined risk-taking with stronger governance of interconnected, operational and AI risks. Boards should establish crisis responsibilities and intervention triggers in advance and maintain oversight of material and third-party AI uses. OSFI also plans a dashboard showing concentrations and potential evolution of catastrophic risk across Canada.
Argentina Securities Commission launches consultation on comprehensive overhaul of material event disclosure rules
The Argentina Securities Commission is consulting on a comprehensive overhaul of material event disclosure rules for entities subject to the public offering regime. The proposal clarifies the treatment of market rumors and preliminary transaction discussions, adds significant cybersecurity incidents as potentially reportable events, and regulates the suspension of disclosure duties.
Andorran Financial Authority signs financial sector cyber coordination agreement with Andorra's National Cybersecurity Agency
The Andorran Financial Authority and Andorra's National Cybersecurity Agency have established a coordination framework for cybersecurity and operational resilience at supervised financial entities covered by Law 22/2022. It provides for secure information sharing, coordinated incident and crisis response, joint supervisory work and resilience exercises, supported by CSIRT-AD.
Ontario Securities Commission reports expanded examinations, targeted guidance and AI supported supervision
The Ontario Securities Commission’s 2026 supervisory report highlights guidance arising from reviews of Client Focused Reforms, digital engagement practices and cybersecurity controls. The regulator also began examinations of regulated entities, continued coordinated reviews of selected dealer members and adopted artificial intelligence to support risk based oversight.
Arab Monetary Fund convenes financial stability task force on AI, cybersecurity and sukuk market risks
The Arab Monetary Fund has convened its regional financial stability task force to examine AI and cybersecurity risks, external shocks and vulnerabilities in sukuk markets. The meeting also covers preparations for the 2027 Financial Stability Report and the task force’s future work plan.
Monetary Authority of Singapore confirms no public sector cyber insurance mandate, outlines market monitoring and dispute capacity
Singapore does not require public sector agencies or statutory boards to buy commercial cyber insurance, relying instead on prevention, detection, response and recovery capabilities. The Monetary Authority of Singapore monitors market developments through industry engagement, while the Financial Industry Disputes Resolution Centre has experience handling cyber insurance disputes.
Russian Government outlines domestic AI use rules and stronger cybersecurity safeguards
The Russian Government outlined plans to require domestic foundation models in designated critical infrastructure and sensitive sectors, with a transition period for companies. It also plans to define rules for AI agents and strengthen coordinated anti-fraud, account security and penetration testing measures across state and private digital systems.
Bank of Ghana outlines new credit risk and liquidity directives and tighter oversight of digital risks
Bank of Ghana Governor Dr Johnson Pandit Asiama outlined forthcoming credit risk and liquidity directives as rapid lending growth increases the need for stronger underwriting and liquidity safeguards. The central bank is also tightening expectations for fraud, foreign exchange, cyber and fintech risk management, while developing guidance on payment service providers and artificial intelligence. The policy rate remains at 14%.