What's new
Overview
This deep dive takes stock of recent developments in cyber and operational resilience, including current supervisory risk watch points, the direction of policy and guidance as well as evolving supervisory practices.
What's new
Spanish Securities Commission publishes 74-question FAQ on the Digital Operational Resilience Act
The Spanish Securities Commission (CNMV) released a FAQ document on Regulation (EU) 2022/2554, the Digital Operational Resilience Act (DORA), to guide financial entities on applying the framework and cybersecurity standards. The document addresses 74 questions on DORA’s pillars, emphasizing proportionality based on entity size, risk profile, and service complexity, and includes a CNMV channel for DORA-related inquiries.
International Association of Insurance Supervisors publishes final Application Paper on operational resilience objectives and toolkit
The International Association of Insurance Supervisors published its final Application Paper on operational resilience, setting out outcomes-based objectives and a practical toolkit to help supervisors and insurers embed resilience expectations within existing Insurance Core Principles governance and risk management frameworks, including oversight, operational risk integration, and third-party/technology dependencies.
Luxembourg Commission de Surveillance du Secteur Financier sets 2026 DORA register of information submission process and extends filing to third-country branches
The Luxembourg CSSF has issued instructions for the 2026 submission of the DORA register, covering ICT service arrangements for entities not under ECB supervision. Third-country branches must submit their register by 31 December 2025 via the CSSF’s eDesk Portal, with validation checks on additional data fields. Entities are advised to submit early for corrections.
Algeria Market Authority installs governance committee for Algerian FinTech Academy
The Algeria Market Authority has set up the governance committee for the Algerian Financial Technology Academy with the Banking Training Institute. The committee will direct the academy's strategy, oversee training in digital finance and cybersecurity, and link established market participants with FinTech innovators.
Luxembourg Commission de Surveillance du Secteur Financier warns supervised entities of active Ivanti EPMM remote code execution exploits and reminds incident notification duties
The Luxembourg Commission de Surveillance du Secteur Financier (CSSF) issued an alert about vulnerabilities CVE-2026-1281 and CVE-2026-1340 in Ivanti Endpoint Manager Mobile (EPMM), enabling unauthenticated remote code execution. The CSSF urged entities using EPMM to follow guidance and implement mitigating actions, emphasizing severe server compromise risks. Entities were reminded to report such incidents under relevant CSSF Circulars.
Japan Financial Services Agency launches consultation on draft policy to strengthen cybersecurity in crypto asset exchange businesses
Japan's Financial Services Agency has released a draft policy to enhance cybersecurity in the crypto asset exchange sector, addressing recent cyberattacks and asset outflows. The policy promotes operator-led security initiatives, industry mutual assistance, and public support measures, with public comments open until 11 March 2026.
International Organization of Securities Commissions publishes 2026 work program prioritising market resilience, investor protection and technological transformation
The International Organization of Securities Commissions (IOSCO) released its 2026 Work Program, highlighting five priorities: financial resilience, investor protection, market evolution, technological transformation, and regulatory cooperation. Key initiatives include reviewing IOSCO principles, over-the-counter derivatives, and operational resilience. IOSCO will focus on investor protection via a TechSprint with the UK Financial Conduct Authority and develop crypto and digital assets assessment methodologies.
Bank of Italy presents 2025 findings and operational guidance on DORA Registers of Information for ICT third party risk
The Bank of Italy hosted a workshop in Rome with financial sector associations on digital operational resilience, focusing on ICT third party risk and the Registers of Information under EU Regulation 2022/2554 on Digital Operational Resilience (DORA). The event aimed to enhance awareness of register data quality and completeness, emphasizing the need for strong governance and periodic supplier assessments.
France's Financial Markets Authority publishes lessons from SPOT inspections of asset managers’ operational risk management
France's Financial Markets Authority (AMF) released findings from a SPOT inspection of portfolio management companies, revealing established governance but recurring gaps in loss measurement, incident assessment, and reporting quality. The review noted good practices like setting maximum tolerable risk impacts and poor practices such as non-harmonised incident registers and inadequate consideration of operational risks in outsourcing decisions.
Central Bank of Brunei Darussalam collaborates with Brunei Association of Banks to strengthen ATM controls after card-skimming incidents
The Central Bank of Brunei Darussalam is collaborating with the Brunei Association of Banks to enhance security controls following ATM card-skimming incidents, emphasizing robust fraud prevention and response mechanisms. Expected actions include regular ATM inspections and enhanced monitoring, with banks implementing preventive measures and advising consumers on vigilance against unauthorized transactions.
Portuguese Securities Commission publishes 2026 action priorities targeting crypto-asset supervision, digital resilience and investor fraud prevention
The Portuguese Securities Commission (CMVM) outlined its 2026 priorities, focusing on supervisory, regulatory, and internal workstreams aligned with its 2025–2028 Strategic Plan. Key areas include enhanced supervision of high-risk sectors like crypto-assets and Digital Operational Resilience Act (DORA) compliance, corporate governance reviews, and AML/CFT risk management. The CMVM also aims to bolster investor protection against digital fraud, expand financial tools, and propose a regulatory sandbox for capital market development.
Australian Securities and Investments Commission sets 2026 superannuation enforcement priorities and flags weak trustee complaints and scams controls
The Australian Securities and Investments Commission (ASIC) outlined its 2026 priorities for the superannuation sector, focusing on governance, skills, and operations. Key areas include member service failures, scams, cyber risk, and retirement delivery. ASIC will address trustees' complaints analysis, scam communication, death benefits review recommendations, harmful switching behavior, market transparency, financial reporting, and enforce against poor private credit practices and fund collapses.
Australian Prudential Regulation Authority signals heightened 2026 scrutiny of superannuation trustees and continued use of licence conditions
The Australian Prudential Regulation Authority's Deputy Chair, Margaret Cole, emphasized an intensified supervisory focus on enhancing superannuation trustee standards in operational risk management, cyber controls, and investment governance to bolster fund resilience and safeguard retirement savings. APRA will maintain scrutiny on governance shortcomings and employ stricter licence conditions to address deficiencies promptly.
European Central Bank outlines supervisory approach to AI, tokenisation and operational resilience in banks’ digital transformation
In a keynote speech, European Central Bank Supervisory Board member Patrick Montagner emphasized the need for banks to balance digital innovation with governance and risk controls, particularly in AI, tokenisation, and cybersecurity. The ECB highlighted AI's widespread use among banks, systemic concentration risks, and the importance of frameworks like the Digital Operational Resilience Act for managing digital risks, with plans to continue monitoring AI and third-party dependencies in 2026.
Hong Kong Monetary Authority publishes Fintech Promotion Blueprint under Fintech 2030 with four flagship projects on AI DLT and quantum readiness
The Hong Kong Monetary Authority has released a Fintech Promotion Blueprint to advance AI and distributed ledger technologies, emphasizing data excellence and cyber resilience. The plan includes four flagship projects: a Quantum Preparedness Index, a New Risk Data Strategy, a Fintech Cybersecurity Baseline, and competency development for AI and DLT-enabled financial services.
De Nederlandsche Bank warns Europe’s digital dependence is a systemic risk and urges vault lines to strengthen financial-sector resilience
De Nederlandsche Bank's Steven Maijoor highlighted Europe's growing reliance on a few IT service providers, particularly cloud hyperscalers, as a systemic risk to the financial system. He advocated for stronger structures and partnerships to reduce digital dependence, urging financial institutions to prepare for potential disruptions and suggesting long-term strategies to decrease reliance on non-European providers.
European Insurance and Occupational Pensions Authority finds European insurance risks stable at a medium level in January 2026 Insurance Risk Dashboard
The European Insurance and Occupational Pensions Authority's January 2026 Insurance Risk Dashboard indicates that risks in the European insurance sector remain stable at a medium level, despite geopolitical tensions affecting the macroeconomic and market risk outlook. The sector is supported by solid capital positions, stable profitability, and strong premium growth, with vigilance required for geopolitical, trade disruption, and cyber risks.
Central Bank of Russia issues new information security requirements for socially important card payment systems
The Central Bank of Russia has issued updated requirements for hardware and software in socially important card payment systems, focusing on information security for infrastructure components like hardware security modules, payment devices, ATMs, and payment cards. These new parameters replace the 2020 approaches and aim to enhance data protection and support import substitution.
International Association of Insurance Supervisors publishes Roadmap 2026-2027 and targets November 2026 adoption of new ICS reporting and disclosure standards
The International Association of Insurance Supervisors (IAIS) released its Roadmap 2026-2027, focusing on standard setting, implementation support, and supervisory cooperation. Priorities include monitoring life insurance sector changes and finalizing Insurance Capital Standard (ICS) standards for Internationally Active Insurance Groups by November 2026. The roadmap addresses climate metrics, digital innovation, and cyber risk, with a new committee structure effective January 2026 and deadlines for comments on draft standards set for February 2026.
Bank for International Settlements Innovation Hub publishes Project FuSSE findings on modular settlement engine scalability and quantum readiness
The Bank for International Settlements Innovation Hub released a report on Project FuSSE, a proof-of-concept for a modular, microservices-based settlement engine architecture aimed at enhancing scalability, adaptability, and cyber resilience in financial market infrastructures. The report discusses the potential benefits and operational trade-offs, including processing up to 10,000 transactions per second and integrating post-quantum cryptography, while noting the project's experimental nature and lack of production-ready components.
Germany's Federal Financial Supervisory Authority publishes Risks in Focus 2026 warning of high potential for sudden market corrections
Germany's Federal Financial Supervisory Authority (BaFin) released its Risks in Focus 2026 assessment, highlighting elevated market valuations and a fragile backdrop as threats to financial stability, including abrupt market corrections and consumer over-indebtedness. BaFin's supervisory priorities for 2026 include intensified monitoring of credit risk, scrutiny of banks' linkages with non-bank intermediaries, and stricter oversight of consumer lending compliance.
National Bank of Moldova sets 2026-2027 insurance supervision priorities focused on governance, underwriting, solvency and ICT risk
The National Bank of Moldova outlined its supervisory priorities for the insurance sector for 2026-2027, focusing on governance, underwriting risk, solvency and asset sufficiency, and information and communications technology risk. This agenda is driven by an annual risk assessment and considers the partial liberalisation of mandatory motor third-party liability pricing.
Chile Financial Market Commission opens second consultation on service externalization requirements for insurance and reinsurance companies
The Chile Financial Market Commission has released a revised draft regulation for a second consultation, detailing principles and requirements for insurance and reinsurance companies on service externalization. The proposal clarifies requirements, applies proportionality based on entity size, complexity, and risk profile, enhances the supervisory framework, and aligns with General Rule No. 454 on operational risk management and cybersecurity.
State Bank of Vietnam issues 2026 directive to accelerate banking digital transformation and mandate stronger information security controls
The State Bank of Vietnam issued Directive No. 02/CT-NHNN outlining 2026 priorities for digital transformation and enhanced information security in the banking sector, mandating at least 15% of budgets for cybersecurity. It emphasizes senior accountability, periodic training, proactive risk management, and strengthened cybersecurity networks, applying to SBV units, credit institutions, foreign bank branches, and related service providers.
Dutch Authority for the Financial Markets sets 2026 supervision priorities on DORA cyber resilience responsible AI and financial crime
The Dutch Authority for the Financial Markets has released its Agenda 2026, emphasizing enhanced supervision of digital operational resilience, responsible artificial intelligence use, and financial crime prevention. Key initiatives include intensified oversight of AI risks, strengthened digital resilience under the Digital Operational Resilience Act, and coordinated actions against investment fraud and money laundering.