What's new
Overview
This deep dive takes stock of recent developments in cyber and operational resilience, including current supervisory risk watch points, the direction of policy and guidance as well as evolving supervisory practices.
What's new
Portugal's Insurance and Pension Funds Supervisory Authority sets DORA reporting rules for insurers pension managers and certain insurance intermediaries
Portugal’s Insurance and Pension Funds Supervisory Authority has amended its reporting framework to implement the EU Digital Operational Resilience Act for insurers, reinsurers, pension fund managers and larger insurance intermediaries. Covered entities must report registers of third-party ICT service contracts, planned ICT arrangements supporting critical or important functions, severe ICT-related incidents and, voluntarily, significant cyber threats, and maintain ICT risk management review reports and cost and loss estimates for ASF review. The amendments repeal prior ASF rules on ICT security, cloud outsourcing and ICT incident reporting to eliminate overlaps.
Japan Financial Services Agency establishes finance sector cybersecurity working group to address AI driven threats
The Japan Financial Services Agency has established a public-private working group on financial sector cybersecurity, described as a Japanese version of “Project Glasswing”, to coordinate responses to AI-driven cyber risks. The initiative aims to accelerate information sharing on vulnerabilities, shorten the time from identification to patch application, and strengthen preparedness for incidents in the highly interconnected, real-time financial system, with potential expansion to include IT firms, online finance participants, and engagement with international counterparts through G7 and G20 forums.
Central Bank of the Philippines introduces a Cybersecurity Maturity Framework and mandates Cybersecurity Control Self-Assessment reporting
The Central Bank of the Philippines has amended IT risk management rules for banks and non-bank financial institutions, replacing the IT Rating System with the Supervisory Assessment Framework and introducing a Cybersecurity Maturity Framework supported by a mandatory Cybersecurity Control Self-Assessment. The framework defines four maturity tiers aligned to institutions’ IT profile classifications and requires annual IT Profile and Cybersecurity Control Self-Assessment submissions via the Advanced SupTech Engine for Risk-based Compliance platform.
Bank of France and ACPR urge financial institutions to start preparing for post-quantum cryptography migration
The Bank of France and the French Prudential Supervision and Resolution Authority warned that advances in cryptographically relevant quantum computers could, over the medium term, break current cryptographic protections used across the financial sector and urged institutions to plan migration to post-quantum cryptography. The note emphasises “harvest now, decrypt later” risks, identifies governance, asset inventory, data sensitivity and crypto-agility as core elements of a long-term migration programme, and aligns with G7 and European post-quantum roadmaps targeting dominant adoption by 2030. The ACPR has launched a 2026 interview cycle with financial sector participants and encourages proactive internal roadmaps, resilience testing and participation in standard-setting.
Central Bank of the Dominican Republic publishes comprehensive amendments to the operational risk regulation extending scope to exchange and remittance agents
The Central Bank of the Dominican Republic announced that the Monetary Board has approved a comprehensive revision of the Regulation on Operational Risk, updating governance, risk management, control and capitalisation standards for financial and foreign exchange intermediation entities. The reform expands the regulatory perimeter to include exchange agents and remittance and exchange agents, which must maintain proportionate frameworks to prevent, detect and mitigate incidents affecting operational continuity and information integrity.
India International Financial Services Centres Authority issues cyber security and resilience guidelines for GIFT IFSC market infrastructure institutions with 6-hour incident reporting and ISO 27001 certification
The India International Financial Services Centres Authority has issued Guidelines on Cyber Security and Cyber Resilience for Market Infrastructure Institutions in IFSC, establishing a prescriptive framework for stock exchanges, clearing corporations, depositories and the bullion exchange in GIFT IFSC. The rules require Board-approved cyber policies, a Chief Information Security Officer reporting to the MD/CEO, 24x7 Security Operations Centres, rapid incident reporting to the authority and CERT-In, post-quantum cryptography roadmaps, third-party risk controls and ISO 27001 certification. The Guidelines took effect on 1 April 2026, with Market Infrastructure Institutions required to achieve full compliance within specified timelines.
Japan Financial Services Agency updates supervisory guidance to promote phishing-resistant multi-factor authentication and issues joint anti-phishing awareness materials
The Japan Financial Services Agency has outlined a public-private, cross-industry initiative on phishing-resistant multi-factor authentication and phishing awareness, and is revising its supervisory and administrative guidelines to incorporate phishing-resistant MFA in response to rising phishing-related illegal remittances and transactions. The initiative includes jointly developed awareness materials by financial institutions, the Japan Financial Services Agency and the National Police Agency, comprising promotional flyers and videos explaining phishing-resistant MFA and warning about phishing emails.
Bank for International Settlements' Financial Stability Institute reviews emerging practices for cyber risk stress testing of banks
The Bank for International Settlements’ Financial Stability Institute published a brief on how authorities use cyber stress tests to assess banks’ resilience to severe cyber disruptions and potential financial stability impacts. Drawing on exercises by the Bank of England, the Danish Financial Supervisory Authority and ECB Banking Supervision, it distinguishes firm- and system-focused models, notes that tests are typically qualitative tabletop exercises with limited disclosure, and calls for repeated exercises, greater methodological transparency, broader participation and better planning for authorities’ crisis coordination.
Securities and Exchange Board of India signs MoU with India's Department of Telecommunications to share intelligence to combat securities market fraud
The Securities and Exchange Board of India signed a Memorandum of Understanding with the Department of Telecommunications to enable regular data and information sharing to combat fraud in the securities market. The arrangement leverages the Department of Telecommunications’ Digital Intelligence Platform for secure, real-time intelligence sharing and coordination against misuse of telecom resources linked to cybercrime and financial fraud.
Securities and Exchange Board of India launches three IT platforms to centralise regulatory communications, digitise adjudication and automate cyber audit supervision
The Securities and Exchange Board of India launched three IT solutions to streamline external engagement, enable paperless quasi-judicial proceedings, and enhance cybersecurity supervision. The Single Universal Platform for Communications centralises official communications, the e-adjudication portal digitises adjudication processes and integrates with SEBI’s Case Management System, and the AI-enabled Cyber-Sec Audit Compliance platform analyses cyber audit reports to identify compliance gaps, generate risk scores, and support risk-based supervision.
Peru's Superintendency of Banking, Insurance and Private Pension Funds updates its sanctions regime with new very serious cyber and market conduct breaches
Peru's Superintendency of Banking, Insurance and Private Pension Funds has revised its Regulation of Infractions and Sanctions across the financial system, insurance, pensions, market conduct and risk management, emphasizing cybersecurity and information security failures. Issued through SBS Resolution No. 01029-2026, the update introduces new very serious infractions for inadequate information protection causing data loss, theft, alteration or customer fraud, and adjusts rules on insurance intermediation, nullity of Private Pension System affiliation and early loan repayments.
U.S. Department of the Treasury launches OCCIP initiative to share actionable cybersecurity intelligence with eligible digital asset firms
The U.S. Department of the Treasury’s Office of Cybersecurity and Critical Infrastructure Protection launched a new initiative to provide eligible U.S. digital asset firms and industry organizations with the same timely, actionable cybersecurity information it shares with traditional financial institutions. The programme is intended to help firms identify, prevent, and respond to cyber threats and advances recommendations from the President’s Working Group on Digital Asset Markets and the GENIUS Act principles on cybersecurity and operational resilience.
Canadian Investment Regulatory Organization releases fiscal 2027 annual priorities focusing on final rulebook harmonization, cyber resilience and complaint handling timelines
The Canadian Investment Regulatory Organization published its Annual Priorities for fiscal 2027, the final year of its 2025–2027 Strategic Plan, focusing on investor protection, market integrity and completing integration. Key workstreams include issuing a harmonized rulebook, advancing registration and continuing education reforms, enhancing complaint handling and investor protection, modernizing regulation through technology and the InnovateSafe sandbox, strengthening cyber resilience, and reviewing Universal Market Integrity Rules to better support smaller dealers and junior issuers.
Chile Financial Market Commission launches six-week consultation on updated service outsourcing rules and a new provider reporting file
The Chile Financial Market Commission is consulting on amendments to Chapter 20-7 of the Updated Compilation of Banking Regulations to update requirements for the externalization of services and introduce an ongoing information requirement via a new regulatory file. The proposal would align the outsourcing framework for banks and other supervised entities with recent international guidance, strengthen third-party and outsourcing risk management, and establish periodic reporting on provider registries, activities, and incidents to support supervision.
South Korea Financial Services Commission requires real-time ledger-to-wallet reconciliation and tighter controls at virtual asset exchanges after Bithumb payout error
The South Korea Financial Services Commission met with five major virtual asset exchanges and the Digital Asset Exchange Alliance to present inspection findings after Bithumb’s erroneous payout and to agree on stronger self-regulation and internal controls. Measures include near real-time ledger-to-wallet reconciliation, tighter controls and segregation for high-risk manual transactions, more frequent external verification, expanded disclosures, standardized internal control programs, semi-annual inspections and common risk governance standards. Separately, the Financial Supervisory Service found internal control deficiencies at Bithumb and plans sanctions procedures after legal review.
Central Bank of Kuwait launches first Advanced Cybersecurity Leaders Program under Kafa’a initiative
The Central Bank of Kuwait has launched the first Advanced Cybersecurity Leaders Program under the Kafa’a initiative, with Kuwaiti banks and the Kuwait Institute of Banking Studies, to build national cybersecurity capability for the banking sector, focusing on cloud security and technology risk resilience. Aimed at experienced Kuwaiti professionals, it offers advanced practical training, starting with an eight-week Cloud Environment Security track delivered with the SANS Institute, supports regulatory compliance, and prepares participants for GIAC certifications and senior leadership roles.
Central Bank of the Philippines amends Peso RTGS incident management with one-hour participant reporting and two-hour fallback settlement triggers
The Central Bank of the Philippines’ Peso Real-Time Gross Settlement Management Committee amended Section 1401.15 of the Manual of Regulations for Payment Systems to update incident management requirements for connectivity and system-availability issues affecting Peso RTGS operations. The rules clarify coordination with the Bangko Sentral to identify incident origin, impose stricter timelines and reporting obligations on participants, and set conditions for using alternative settlement mechanisms. The memorandum details available alternatives, including bilateral and multilateral netting, paying-agent arrangements, and business continuity procedures, while allowing the Bangko Sentral to refuse or defer processing of suspicious or non-compliant files.
Chile Financial Market Commission consults on permitting limited continued use of coordinates cards for transaction authentication
The Chile Financial Market Commission has launched a public consultation on amendments to General Rule No. 538 on minimum security and authentication standards for electronic transactions, to facilitate the transition to Reinforced Client Authentication by allowing certain clients to continue using coordinates cards. Issuers would be permitted to define specific client groups, based on objective criteria and reported to the Commission, that may retain coordinates cards, though such transactions would not qualify as Reinforced Client Authentication.
Financial Industry Regulatory Authority launches Financial Intelligence Fusion Center portal for cybersecurity and fraud threat intelligence sharing
The Financial Industry Regulatory Authority has launched the Financial Intelligence Fusion Center, a secure portal for FINRA and member firms to share timely cybersecurity and fraud threat intelligence and coordinate responses. The platform collects, analyzes and disseminates threat information, incorporates input from government and private sector partners, and expands FINRA’s existing cybersecurity and fraud-related resources for member firms.
Dutch Authority for the Financial Markets urges audit firms to adopt robust information security frameworks and shares supervisory strengthening points
The Dutch Authority for the Financial Markets has issued guidance urging audit firms to strengthen information security and IT risk management in light of data leaks. Drawing on practices at public interest entity audit firms and De Nederlandsche Bank’s Good Practice on Information Security, the guidance highlights improvements in ICT risk processes, continuity and configuration management, supplier oversight, and incident learning. The authority says IT risk control will remain a supervisory priority and that it will continue engaging with the sector.
Office of the Superintendent of Financial Institutions sets out June 2026 streamlined approvals and proposed 75% risk weight for some SME loans
The Office of the Superintendent of Financial Institutions outlined supervisory priorities, emphasizing heightened geopolitical, cyber, integrity and security risks, increased focus on non-bank financial intermediaries, and measured capital recalibration, including proposed lower risk weights for some SME loans and continued use of the 0–4% Domestic Stability Buffer. Work on non-bank intermediaries covers exposures, risk rating and governance, supported by a Credit Risk Management Guideline consultation, while synthetic risk transfer will be assessed on a substance-over-form basis. OSFI will also launch a modernized, streamlined approvals framework in June 2026 to provide a clearer, faster and more predictable path to a federal licence for eligible applicants such as credit unions and fintechs.
Danish Financial Supervisory Authority survey finds geopolitics now matches cyber threats as the top stability risk for Danish financial firms
The Danish Financial Supervisory Authority's 2026 survey of Danish financial firms highlights cyber threats and geopolitical conditions as the most significant risks to financial stability, with both rated equally for the first time. Firms noted increased vulnerability due to reliance on foreign IT suppliers and linked rising cyber risk to geopolitical tensions. Despite these concerns, firms expressed high confidence in the stability of the Danish financial system over the next three years.
Dubai Financial Services Authority launches consultation on operational resilience
The Dubai Financial Services Authority issued Consultation Paper No. 170 on operational resilience for consultation. The paper sets out proposed requirements to enhance firms’ ability to withstand, adapt to and recover from operational disruptions.
Bank of Italy and Guardia di Finanza sign cybersecurity cooperation and information-sharing agreement
The Bank of Italy and the Guardia di Finanza have signed a cooperation and information-sharing agreement to enhance cybersecurity measures. The agreement aims to improve prevention and protection against cyberattacks by utilizing the expertise of both institutions.
France's Financial Markets Authority revises guidance for portfolio management companies including mandatory DORA resilience information and streamlined authorisation withdrawals
France's Financial Markets Authority (AMF) has updated its supervisory doctrine for portfolio management companies, aligning it with regulatory developments and clarifying compliance with the EU Digital Operational Resilience Act (DORA). The update includes guidance on staffing, authorisation withdrawals, life-insurance arbitration mandates, own funds calculations, and ancillary loan mandates. Firms must update their activity programmes within six months to comply with the new DORA documentation requirements.