What's new
Overview
This deep dive takes stock of recent developments in cyber and operational resilience, including current supervisory risk watch points, the direction of policy and guidance as well as evolving supervisory practices.
What's new
Bank of Ghana launches revised Cyber and Information Security Directive 2026 tightening AI governance cloud security and board accountability
The Bank of Ghana has launched the revised Cyber and Information Security Directive 2026, updating standards for banks and digital financial participants. Key elements include AI and machine learning governance, cloud computing security with data sovereignty, and a proportionality framework for scaling requirements. The directive mandates board-level cyber risk expertise and expands the Financial Industry Command Security Operations Centre's coverage to include more financial institutions.
Financial Conduct Authority publishes post-transition findings from operational resilience self-assessments and highlights areas for firms to improve
The Financial Conduct Authority has published supervisory observations from firms’ annual operational resilience self-assessments to reinforce compliance with its framework, highlighting stronger practices and areas needing improvement in impact tolerances, mapping, scenario testing, vulnerability management, communications and governance. In related joint material with the Bank of England and the Prudential Regulation Authority, the authorities set out effective practices for responding to and recovering from high-severity cyber disruption and signal they will continue requesting periodic self-assessments as firms reassess their ability to remain within impact tolerances.
European Central Bank Banking Supervision sets Digital Operational Resilience Act priorities on ICT change risk, third-party dependencies and threat-led penetration testing
The European Central Bank Banking Supervision is using the EU Digital Operational Resilience Act to intensify oversight of banks’ digital and operational resilience, focusing on ICT change management, third-party risk and cyber testing. Expanded incident reporting shows 38% of major incidents in 2025 stemmed from IT change, while rising cloud reliance and delays in contract renegotiations and business continuity planning have heightened scrutiny of third-party risk management. An EU-level framework now oversees 19 critical ICT providers. The ECB will conduct an on-site campaign on ICT third-party risk management and launch a three-year threat-led penetration testing cycle, with over 80 banking groups already notified.
Central Bank of Brazil strengthens Conta PI security with minimum balance thresholds automatic blocking and an alternative statement channel
The Central Bank of Brazil has introduced measures to enhance operational security and management of the Instant Payments Account (Conta PI) within the Instant Payments System (SPI). These measures include setting a minimum operational balance, automatic blocking options, and an alternative channel for accessing Conta PI statements during network outages. These enhancements are part of the central bank's Agenda BC and the second phase of a toolset to strengthen the payments ecosystem.
Council of Financial Regulators flags elevated geopolitical and cyber risks and agrees 2026 crisis preparedness workplan
The Council of Financial Regulators said global financial stability risks have increased, while direct Australian exposures to the Middle East remain limited. It urged banks to maintain strong capital and liquidity, called for prudent lending standards, and agreed a workplan to strengthen crisis preparedness for capital and liquidity stress scenarios. The Council also advanced joint work on cyber resilience and said it will publish actions to streamline regulatory data collection and sharing in the first half of 2026.
Polish Financial Supervision Commission publishes CSIRT KNF Annual Cybersecurity Report 2025 highlighting supply chain threats and DORA incident reporting volumes
The Polish Financial Supervision Commission's CSIRT published its Annual Report on Cybersecurity 2025, highlighting a complex cyberthreat landscape with increased attacks on technology and IT service providers, raising supply chain risks. The report details 41,751 dangerous domains, 9,751 blocked fraudulent ads, and 787 DDoS attacks, alongside 274 ICT incident reports under DORA. CSIRT KNF issued 625 threat warnings and 70 recommendations, noting heightened ransomware activity and proactive monitoring of data-leak publications.
Taiwan Financial Supervisory Commission publishes 2025 H2 examination findings and corrective actions across 12 sectors
The Taiwan Financial Supervisory Commission published financial examination findings for the second half of 2025 across 12 sectors, highlighting systemic deficiencies in AML/CFT/CPF, customer protection, cyber security, and real estate lending. Issues include weak onboarding and monitoring of high-risk customers, incomplete insurance and ETF disclosures, inadequate controls over personal data and privileged accounts, and insufficient scrutiny of lending to speculators and vacant-land projects. The authority will continue publishing findings and corrective actions to signal priorities and support stronger controls.
Bank of England finalises IOREP operational incident and third-party reporting rules for FMIs effective 18 March 2027 and consults on revoking duplicate CCP incident reporting rule
The Bank of England has finalized its IOREP rules for financial market infrastructures, standardizing the reporting of significant operational incidents and third-party arrangements to boost resilience. Applicable to UK central counterparties, securities depositories, payment operators, and service providers, reporting via Financial Conduct Authority platforms starts 18 March 2027. The Bank is consulting on revoking duplicative reporting for central counterparties, aligning with IOREP.
United Kingdom's Prudential Regulation Authority finalises operational incident and material third-party reporting rules effective 18 March 2027 and exempts credit unions under GBP 50 million
The Prudential Regulation Authority (PRA), with the Financial Conduct Authority and the Bank of England, has finalized its policy on standardized reporting for operational incidents and material third-party arrangements. Effective March 2027, UK financial institutions must report incidents via FCA Connect and submit annual MTP registers, excluding certain credit unions and third-country branches. The rules aim to streamline data collection, reduce firm burden, and enhance supervisory consistency.
European Payments Council updates its guidelines on cryptographic algorithms usage and key management
The European Payments Council has released its annual update to the Guidelines on cryptographic algorithms usage and key management, offering updated guidance on security protocols and key management practices for the European payments industry. The guidelines target payment service providers, including security officers and system designers, ensuring alignment with current cryptology research and development.
Philippines Insurance Commission and five public institutions agree shared cyber defense solution for the insurance cluster
The Philippines Insurance Commission and five public institutions have agreed to establish a shared cyber defense solution for the insurance cluster. Land Bank will lead procurement, while joint technical and oversight bodies will set requirements, oversee implementation and monitor cyber threats.
Germany's Federal Financial Supervisory Authority clarifies fluctuation reserve treatment for standalone cyber insurance and allows early build-up with seven-year data
Germany's Federal Financial Supervisory Authority (BaFin) issued guidance on the fluctuation reserve for standalone cyber insurance, to be separately reported from 2025. BaFin states there is no obligation to build a cyber fluctuation reserve for 2025 due to the lack of a ten-year observation period for loss-ratio calculations. Insurers may apply for case-by-case approval to establish a reserve earlier, subject to specific criteria, while BaFin published net loss ratios and gross expense ratios for 2020-2024.
National Bank of Ukraine signs memorandum with Mastercard to strengthen financial sector cyber resilience
The National Bank of Ukraine (NBU) and Mastercard signed a Memorandum of Understanding to enhance cybersecurity cooperation, aiming to bolster Ukraine's financial sector's cyber resilience. The partnership will focus on promoting cybersecurity best practices, data exchange on cyber threats, and building competencies in threat prevention and response. This initiative aligns with Mastercard's Digital Country Partnership program in Ukraine.
European Securities and Markets Authority warns of elevated systemic stress risks in its first 2026 risk monitoring report
The European Securities and Markets Authority (ESMA) released its first 2026 risk monitoring report, indicating high market and systemic stress risks in EU financial markets despite resilient late 2025 performance. The report highlights potential significant price swings due to geopolitical tensions, stretched equity valuations, and an uncertain EU economic outlook, with increased contagion risk from higher cross-asset correlations and cyber threats. It also notes record-high global equity valuations, mixed credit-quality signals, persistent weakness in EU equity issuance, a crypto flash crash, and settlement-fail spikes at central securities depositories.
Netherlands' De Nederlandsche Bank publishes Payments Strategy 2026-2028 urging 72-hour cash buffers and more European payment options
De Nederlandsche Bank (DNB) released its Payments Strategy 2026-2028, focusing on secure, reliable, and accessible payments amid geopolitical and technological changes. Priorities include enhancing operational resilience, reducing reliance on non-European providers, and promoting European digital payment instruments like Wero and the digital euro. The strategy emphasizes collaboration with banks, businesses, and civil society to ensure offline payment capabilities, maintain ATM availability, and bolster cybersecurity.
Gibraltar Financial Services Commission publishes thematic review findings and minimum expectations for TCSP cybersecurity data protection and resilience
The Gibraltar Financial Services Commission released findings from its thematic review on cybersecurity, data protection, and resilience in the Trust and Corporate Service Providers sector, establishing minimum standards. The review highlights areas for improvement in governance, risk management, and resilience planning to help firms align with international standards and maintain robust controls.
Action Group against Money Laundering in Central Africa validates draft regional regulation on information systems security for financial intelligence units
The Action Group against Money Laundering in Central Africa held a workshop in Brazzaville to draft a regional text on network and information system security for financial intelligence units. Participants validated a draft regulation and agreed on a roadmap for its integration into the Economic and Monetary Community of Central Africa process. The workshop addressed legal, technical, and operational aspects to enhance cybersecurity and network resilience.
Japan Financial Services Agency applies revised supervisory guidelines to strengthen cyber risk response
The Japan Financial Services Agency finalized revisions to its Comprehensive Supervisory Guidelines to enhance firms' cyber risk responses, effective 27 February 2026. The revisions, following a public consultation, cover major banks, small and medium-sized financial institutions, affiliated institutions, and the fishermen’s cooperative system credit business, including guidance on electronic payment instruments. Feedback not directly related to the revisions will inform future financial administration.
Central Bank of Ireland publishes Regulatory and Supervisory Outlook 2026 prioritising operational resilience as market and AI risks rise
The Central Bank of Ireland's Regulatory & Supervisory Outlook 2026 highlights high operational, asset valuation, and market risks, with reduced inflation and interest rate risks. It emphasizes supervisory priorities like operational and cyber resilience, consumer protection, and technological adaptation, aiming to enhance regulatory efficiency through an integrated supervisory approach and improved gatekeeping processes.
Central Bank of the UAE partners with Core42 to build a sovereign financial cloud services infrastructure
The Central Bank of the UAE has partnered with Core42 to develop the Sovereign Financial Cloud Services Infrastructure, the first dedicated financial cloud ecosystem. Part of the Financial Infrastructure Transformation programme, it aims to enhance data sovereignty, cybersecurity, and operational agility for the UAE financial sector. The platform will incorporate AI and advanced analytics for intelligent automation and real-time data analysis, offering a unified framework for managing multi-cloud services.
European Central Bank sets supervisory expectations for banks’ AI governance and signals more targeted scrutiny of generative AI
In a keynote speech, ECB Banking Supervision emphasized its focus on banks' increasing use of artificial intelligence, particularly generative AI, due to dependencies on third-party providers and cloud infrastructure. The ECB highlighted uneven governance practices and stressed the need for senior management oversight and alignment with European Banking Authority principles. Looking ahead, the ECB plans to intensify monitoring of AI, focusing on generative AI applications, under its 2026-28 supervisory priorities on operational resilience and ICT capabilities.
New Zealand Financial Markets Authority publishes operational resilience thematic review findings for peer-to-peer lending and crowdfunding providers
The New Zealand Financial Markets Authority (FMA) released findings from its operational resilience thematic review, based on voluntary surveys of peer-to-peer lending platforms and crowdfunding service providers. The review assessed resilience maturity, identified risks, and provided recommendations for improvement, aligning with the FMA's 2025 Financial Conduct Report.
European Banking Authority follow-up peer review reports progress in ICT risk assessment under SREP and urges further supervisory convergence under DORA
The European Banking Authority's follow-up peer review highlights improvements in EU authorities' ICT risk assessment within the Supervisory Review and Evaluation Process, attributed to the Digital Operational Resilience Act. Despite progress, the report calls for further investment to ensure consistent ICT risk supervision across the EU. It urges authorities to fully integrate ICT risk methodologies and enhance supervisory convergence and operational resilience.
U.S. Department of the Treasury concludes AI cybersecurity initiative and will release six risk management resources for financial services
The U.S. Department of the Treasury concluded a public-private initiative to enhance cybersecurity and risk management for artificial intelligence in the financial sector. Led by the Artificial Intelligence Executive Oversight Group, the initiative will produce six resources focusing on governance, data practices, transparency, fraud, and digital identity, aimed at supporting secure AI use, particularly for small and mid-sized institutions.
State Bank of Pakistan launches Cyber Shield cyber resilience strategy for regulated entities
The State Bank of Pakistan has launched "Cyber Shield – the Cyber Resilience Strategy for Regulated Entities" to enhance cyber resilience in banks and financial institutions. The strategy focuses on prevention, rapid response, and recovery from cyber incidents, prioritizing governance, cooperation, talent development, and updated security practices. The State Bank will monitor cyber developments and update the strategy to address emerging threats.