What's new
Overview
This deep dive takes stock of recent developments in cyber and operational resilience, including current supervisory risk watch points, the direction of policy and guidance as well as evolving supervisory practices.
What's new
Bank of Italy publishes research building a cyber risk vulnerability indicator for Italian non-financial firms
The Bank of Italy's study, “The Cyber Risk of Non-Financial Firms,” introduces an indicator for assessing cyber risk in Italian non-financial companies, advocating its inclusion in credit risk assessments. Using natural language processing and a large language model to analyze financial statements, news, and cyber reports, it reveals increased cyberattacks in Italy since 2019, with post-incident vulnerability often surpassing defensive benefits.
Prudential Regulation Authority sets 2026 supervisory priorities for UK deposit takers and plans wider shift to two-year periodic summary meeting cycles
The Prudential Regulation Authority has written to CEOs of PRA-regulated UK banks and building societies setting out its 2026 supervisory priorities, emphasising strategic risk management, operational and financial resilience, data risk, and support for innovation aligned with its secondary objectives on competition, international competitiveness and growth. Key expectations include enhanced oversight of changing risk profiles, implementation of updated significant risk transfer and model risk management standards, strengthened operational resilience and cyber preparedness, and preparation for Basel 3.1 and the Strong and Simple Framework. The PRA will also rebase variable Pillar 2 requirements in 2026 and continue modernising reporting and authorisation processes.
United Kingdom's Prudential Regulation Authority sets 2026 insurance supervision priorities and plans move to two-year Periodic Summary Meetings
The UK Prudential Regulation Authority has set 2026 supervisory priorities for insurers, focusing on resilience and risk management amid competitive pressures in the bulk purchase annuity market, a softening general insurance underwriting cycle, and the need to strengthen operational resilience. Life insurance supervision will centre on pricing discipline, funded reinsurance and liquidity and credit risks in evolving investment strategies, while general insurers face closer scrutiny of underwriting, reserving, internal model assumptions, exposure data and delegated authority oversight. Cross-sector work will intensify on operational resilience testing, third-party risk, legacy technology, cyber risk and AI governance.
United Kingdom's Prudential Regulation Authority sets 2026 supervisory priorities for UK-active international banks and plans move to two-year PSM cycle
The Prudential Regulation Authority has written to chief executives of PRA-regulated international banks and designated investment firms in the UK setting out its 2026 supervisory priorities, emphasising risk management and governance, operational and financial resilience, and data risk, while adjusting supervision to support innovation and reduce regulatory burden. Key expectations include stronger counterparty credit and model risk management, prudent adoption of technologies such as artificial intelligence and distributed ledger technology, enhanced operational resilience and cyber capabilities, and preparations for Basel 3.1 and the Strong and Simple Framework. The PRA will also move remaining firms from annual to two-year Periodic Summary Meeting cycles in 2026 and is encouraging engagement on streamlined reporting and regulatory permissions ahead of capital regime changes.
Bank of Mozambique mandates standard templates and channels for technology and cyber incident reporting effective 9 March 2026
The Bank of Mozambique issued a circular mandating the use of specific reporting templates for technological and cyber incidents by credit institutions and financial companies. Reports must be submitted primarily via the Banking Supervision Application portal, detailing incident type, severity, impacts, and remediation actions. Email reporting is permitted only when other channels are unavailable.
Canadian Investment Regulatory Organization confirms phishing breach impacted around 750,000 investors and begins notifications with credit monitoring
The Canadian Investment Regulatory Organization (CIRO) confirmed a phishing attack affecting data of approximately 750,000 Canadian investors, with no evidence of misuse. CIRO is offering credit monitoring and identity theft protection, has secured systems, and will notify affected individuals starting January 14, 2026.
Bank of England and UK regulators sign MoU with European Supervisory Authorities on oversight of critical third parties
The Bank of England, Financial Conduct Authority, and Prudential Regulation Authority signed a Memorandum of Understanding with European Supervisory Authorities to enhance cross-border cooperation on overseeing critical third parties under the UK's regime and the EU's Digital Operational Resilience Act. This framework aims to manage risks to financial stability and market confidence while minimizing regulatory burdens for third-party providers operating across jurisdictions.
World Federation of Exchanges calls on regulators to balance post-quantum cryptography expectations with immediate AI and cyber resilience risks
The World Federation of Exchanges (WFE) highlighted a gap between regulatory and industry expectations on quantum computing risk preparedness, urging regulators to align post-quantum cryptography migration with immediate threats. A WFE survey revealed members prioritize generative AI risks over quantum preparedness, estimating a 5–10+ year window before quantum computers become a threat, while taking preparatory steps like monitoring developments and conducting risk assessments.
Securities and Exchange Board of India revises stock broker technical glitch rules and limits scope to brokers with over 10,000 clients
The Securities and Exchange Board of India (SEBI) has revised its framework for managing technical glitches in stock brokers' electronic trading systems, narrowing applicability, expanding exemptions, and simplifying reporting. The framework, which supersedes the November 2022 circular, applies to brokers with over 10,000 clients and includes detailed guidelines on incident reporting, capacity planning, and financial disincentives.
Financial Services Authority issues new IT governance and cybersecurity rules for Indonesia’s rural banks and Sharia rural banks
Indonesia’s Financial Services Authority (OJK) has introduced new IT operation requirements for rural banks and Sharia rural banks to enhance digital security, focusing on IT governance, risk management, and data protection. The framework, effective one year post-promulgation, will replace existing regulations and mandates local data center and disaster recovery facilities.
Central Bank of Latvia sets 2026–2028 supervision priorities and approves 2026 inspection plan focused on resilience and accessible services
The Central Bank of Latvia outlined its 2026–2028 financial market supervision priorities, emphasizing resilience, accessibility, and transparency, while reducing firms' administrative burdens. The 2026 plan includes 12 on-site inspections across sectors, focusing on risks like credit underwriting standards, bank profitability, insurers' claims practices, and fintech compliance with the Digital Operational Resilience Act (DORA).
Central Bank of Oman issues new business continuity management framework and sets 30 June 2026 deadline for banks and finance and leasing companies
The Central Bank of Oman has introduced a Business Continuity Management (BCM) Framework for licensed banks and finance and leasing companies, emphasizing operational resilience through a service-centric approach. It mandates governance by boards and senior management, recovery objectives, and integration into risk management, with requirements for business impact analysis, IT disaster recovery, and cyber resilience. It also outlines incident reporting timelines and testing protocols, replacing the previous BCM guidelines from August 2010.
International Monetary Fund publishes good practices for cyber risk regulation and supervision in the financial sector
The IMF's Monetary and Capital Markets Department released a paper on "good practices" for cyber risk regulation in financial institutions, emphasizing integrating ICT and cyber-risk management. It recommends balancing principles-based and prescriptive elements, applying proportionality by firm size and systemic importance, and highlights tools like governance requirements, cybersecurity testing, and third-party risk management.