What's new
Overview
This deep dive takes stock of recent developments in cyber and operational resilience, including current supervisory risk watch points, the direction of policy and guidance as well as evolving supervisory practices.
What's new
Central Bank of Latvia storm review finds critical payments remain dependent on power and communications
The Central Bank of Latvia found that simultaneous power and communications failures during the August storm limited critical cash and payment services, with 183 of 869 ATMs disrupted. It proposed essential services centers offering goods, offline card payments and cash access, while calling for stronger backup arrangements for communications and retail infrastructure. Households were advised to hold one week’s cash needs in small-denomination banknotes.
Thailand's Office of Insurance Commission tests cyber resilience of 67 insurers against AI related threats
Thailand’s Office of Insurance Commission completed two cyber exercises involving 67 life and nonlife insurers. The simulations tested incident response and regulatory coordination against increasingly complex threats involving AI, external providers and interconnected digital systems.
South Korea Financial Services Commission directs sectorwide cybersecurity reviews following reported intrusions
The South Korea Financial Services Commission directed all financial firms to complete and report comprehensive cybersecurity reviews following reported intrusions. Firms must tighten external access, authentication and threat detection, apply shared attack intelligence, and protect and compensate affected consumers. The authorities will strengthen sectorwide monitoring and may take strict action where known risks are not addressed.
Qatar Financial Markets Authority outlines National Information Assurance controls for financial market participants
The Qatar Financial Markets Authority outlined National Information Assurance controls for financial market participants developed with the National Cyber Security Agency. The framework addresses governance, operational resilience, third-party risk, incident management, audit, software security and access control.
Agency for Regulation and Development of the Financial Market of the Republic of Kazakhstan outlines end-to-end oversight priorities for autonomous AI agents
Kazakhstan’s financial regulator outlined an end-to-end approach to supervising AI agents, centered on transparency, human control and customer protection. It called for safeguards against autonomous-agent risks, including hidden jailbreak attacks. The agency is also expanding supervisory AI use and operates AI agents within the Qainar cyber defense system, which connects 100 financial institutions.
Monetary Authority of Macao holds cybersecurity incident seminar for more than 100 financial sector representatives
The Monetary Authority of Macao held a seminar for more than 100 financial sector representatives on lessons from local and overseas cybersecurity incidents, focusing on stronger systems, internal controls and response capabilities.
Qatar Financial Markets Authority and National Cyber Security Agency issue cybersecurity controls and launch compliance certification program
The Qatar Financial Markets Authority and National Cyber Security Agency introduced sector specific cybersecurity controls and a compliance certification program for regulated entities. Certification will cover both the National Information Assurance Standard and the supplementary controls.
South Korea's Financial Services Commission orders immediate security reviews after financial sector cyberattacks
South Korea's Financial Services Commission has ordered financial companies to review all externally accessible systems, strengthen authentication and access controls, and rapidly share cyberthreat information. The action follows a Shinhan Bank data breach and attacks affecting KB Kookmin Bank and other major financial companies, with affected firms also subject to supervision over consumer protection and compensation.
Canadian Securities Administrators launches consultation on harmonized IT system integrity framework
The Canadian Securities Administrators has proposed a harmonized national framework for the IT systems of key market infrastructure entities. It would consolidate existing requirements and covers marketplaces, clearing agencies, trade repositories, information processors and matching service utilities, while seeking input on international alignment and emerging technologies.
European Central Bank President Lagarde urges systemwide action on AI risks to trading, cyber resilience and model access
European Central Bank President and ESRB Chair Christine Lagarde urged systemwide monitoring of AI risks to trading, cyber resilience and access to frontier models. She called for updated cyber defences, coordinated response plans and stronger European AI capabilities to reduce dependence on externally controlled technology.
Swedish Financial Supervisory Authority to update Fidac DORA incident reporting and add overdue report reminders
The Swedish Financial Supervisory Authority will update DORA incident reporting in Fidac on Oct. 19, including a redesigned form and automated reminders for overdue interim or final reports. The update also separates affected entity data into a dedicated table, adds reference code filtering and introduces a revised JSON schema.
Bank for International Settlements’ Basel Committee approves machine-readable Pillar 3 standard and G-SIB window-dressing revisions
The Bank for International Settlements’ Basel Committee approved a final machine-readable Pillar 3 standard, G-SIB assessment results and revisions to curb year-end window dressing. It will consult on stronger Pillar 2 guidance for interest rate risk and the treatment of European banking union exposures in the G-SIB framework. Updates on the cryptoasset standard review, liquidity principles and final Pillar 3 requirements are expected by the end of 2026.
Australia's Council of Financial Regulators flags rising bond yields and AI-related cyber threats
Australia's Council of Financial Regulators said rising longer-term bond yields warrant close monitoring, although markets remain orderly and the domestic financial system is well placed to manage shocks. It urged financial institutions to strengthen resilience and flagged increasingly complex cyber threats from frontier artificial intelligence. The Council may meet more frequently if needed.
Reserve Bank of Australia finds financial system resilient but warns global and operational vulnerabilities are mounting
The Reserve Bank of Australia assessed the financial system as resilient, with most borrowers able to withstand weaker conditions and banks capable of continuing to lend during a severe downturn. The main risks stem from global market vulnerabilities, geopolitical tensions and operational threats linked to AI, cyberattacks and concentrated service providers. Financial institutions should strengthen operational recovery, crisis testing and liquidity risk management while maintaining prudent lending standards.
Argentina's National Securities Commission outlines cyberfraud prevention priorities and coordination efforts
Argentina's National Securities Commission Vice President Sonia Salvatierra outlined the regulator’s cyberfraud prevention priorities, including stronger supervision, transparency, investor protection and financial education. She emphasized coordination with the Financial Intelligence Unit, the Central Bank of Argentina and the private sector.
Executives’ Meeting of East Asia-Pacific Central Banks assesses AI shocks, financial stability risks and central bank adoption
The Executives’ Meeting of East Asia-Pacific Central Banks assessed how AI could generate interacting economic and financial shocks, including labor disruption, asset price corrections, rising leverage and concentration among technology providers. About half of member central banks used AI for general tasks as of 2025, with some expanding into specialized functions. The note emphasizes human oversight, strong governance, systemwide supervision and regional cooperation.
European Banking Authority sets 2027 agenda for banking reforms, supervisory convergence and digital oversight
The European Banking Authority’s 2027 programme prioritizes completing banking reforms, strengthening supervisory convergence and embedding its DORA, MiCA and EMIR responsibilities. It will run a streamlined EU-wide stress test with 55% fewer data points and a climate risk module, while advancing integrated reporting and data sharing. Preparatory work will also begin for the first EU-wide crisis simulation exercise in 2028.
Financial Stability Board Americas group examines stablecoin risks, emerging technology and crisis preparedness
The Financial Stability Board’s Americas regional group assessed financial stability risks from geopolitical uncertainty, extreme weather, capital flows and exchange rates. Members also discussed global stablecoin arrangements, AI and quantum computing risks, and preparedness for cyber incidents and third-party outages.
US Federal Reserve Board Vice Chair Bowman urges community banks to strengthen cyber defenses as AI expands threats
Federal Reserve Board Vice Chair for Supervision Michelle W. Bowman urged community banks to reinforce cyber hygiene as AI makes attacks faster and more sophisticated. She emphasized core controls, employee training, incident response testing and active oversight by boards and senior management. AI can also strengthen defenses, but banks should deploy it with sound risk management.
Dutch Authority for the Financial Markets identifies four priorities to strengthen asset managers’ ICT recovery
The Dutch Authority for the Financial Markets found that large institutional asset managers have the foundations for ICT recovery in place but need better alignment across critical functions, recovery objectives, providers and testing. It identified four priorities covering consistent classification, function-level recovery objectives, provider agreements and testing against extreme disruption scenarios.
Agency for Regulation and Development of the Financial Market of the Republic of Kazakhstan plans cyber exercise covering banks with about 90% of sector assets
Kazakhstan’s financial regulator plans a full-scale supervisory cyber exercise in 2027 involving major banks with about 90% of sector assets. It will assess their ability to withstand cyberattacks and restore information systems after incidents, building on an earlier pilot.
Taiwan Financial Supervisory Commission identifies common control deficiencies across 10 financial sectors
The Taiwan Financial Supervisory Commission identified common deficiencies across 10 financial sectors in fraud and money-laundering controls, customer protection, related-party governance and cyber security. Institutions should strengthen customer checks and transaction monitoring, product sales controls, related-party documentation, privileged-access management and application security testing.
Swedish Financial Supervisory Authority launches review of financial firms’ defenses against AI enabled cyberthreats
The Swedish Financial Supervisory Authority has launched an on-site review of how financial firms address cyberthreats from advanced AI models. It will assess whether firms identify emerging risks and adapt their measures to prevent, detect and manage increasingly automated attacks.
Bank of Ghana emphasizes operational resilience and safeguards as banks pursue digital innovation
Bank of Ghana Second Deputy Governor Matilda Asante-Asiedu urged banks to pair digital innovation with operational resilience, cybersecurity and effective controls. She said systemically important Absa Bank Ghana must maintain adequate capital, strong liquidity, regulatory compliance and responsible conduct.
Hong Kong Securities and Futures Commission urges brokers to strengthen cyber resilience and anti-scam controls
The Hong Kong Securities and Futures Commission urged brokers to strengthen cyber resilience and controls protecting clients’ assets from technology-enabled scams. More than 600 participants joined regulators, police and industry representatives to discuss emerging threats and prevention measures, against a backdrop of HKD 3.58 billion in online investment scam losses last year.