What's new
Overview
This deep dive takes stock of recent developments in cyber and operational resilience, including current supervisory risk watch points, the direction of policy and guidance as well as evolving supervisory practices.
What's new
European Securities and Markets Authority sets 2027 delivery agenda for expanded supervision, simplification and T+1 settlement
The European Securities and Markets Authority’s 2027 work program moves major initiatives into delivery, including expanded direct supervision, regulatory simplification and the EU’s Oct. 11, 2027 transition to T+1 settlement. ESMA will advance integrated reporting, investor protection and risk-based supervision while overseeing new entities and strengthening crypto-asset, operational resilience and clearing work. It will also expand its use of data and artificial intelligence in supervision.
Bank for International Settlements paper assesses trusted execution environments for central banks
The Bank for International Settlements has published a paper assessing how trusted execution environments could help central banks process sensitive data without widening access to plaintext records. It identifies applications in collaborative analytics, compliance, digital asset wallets and cyber resilience, but stresses that benefits depend on attestation, strict output controls, auditable governance and layered safeguards. The paper recommends staged adoption and procurement measures addressing software supply chains, revocation, portability and vendor concentration.
France's Financial Markets Authority finds third parties caused 87% of portfolio managers' major DORA incidents in 2025
France's Financial Markets Authority found that third party providers caused 87% of the 31 major DORA incidents confirmed for portfolio management companies in 2025, while cyberattacks accounted for 71%. The incidents disrupted critical investment management, trading, data and compliance functions across firms of all sizes. Reporting arrangements also remain incomplete, with 23% of portfolio managers lacking a DORA-compliant major incident reporting system in a November 2025 self-assessment.
National Bank of the Kyrgyz Republic strengthens interagency cybersecurity coordination for financial infrastructure
The National Bank of the Kyrgyz Republic participated in the first meeting of an interagency commission on information security and cybersecurity. The initiative covers threat assessment, rapid information sharing and stronger coordination to protect financial infrastructure and information systems.
European Securities and Markets Authority announces 2027 digital innovation supervisory priority focused on AI and tokenisation
The European Securities and Markets Authority will begin a digital innovation supervisory priority in 2027, initially focusing on supervised entities’ use of AI and tokenisation. Authorities will map client facing uses, build common supervisory approaches and conduct initial checks on selected firms. The initiative will operate alongside the continuing cyber and operational resilience priority as the ESG disclosures priority closes.
Central Bank of Iceland keeps countercyclical capital buffer at 2.5% as economic slowdown and cyber threats test resilience
The Central Bank of Iceland kept the countercyclical capital buffer at 2.5%, finding that strong banks and low private-sector indebtedness support financial stability. A cooling economy and housing market could increase pressure on construction companies, while AI-enabled cyberattacks require stronger defenses and coordinated incident preparedness. Offline payment card functionality has now been implemented to strengthen payment resilience.
Central Bank of Iceland keeps countercyclical capital buffer at 2.5% as construction and AI cyber risks rise
The Central Bank of Iceland kept the countercyclical capital buffer at 2.5%, with banks remaining highly resilient and profitable. Rising construction exposures and nonperforming loans are increasing systemic risk, though distress is not widespread. Geopolitical uncertainty and AI-enabled cyber threats also require stronger financial infrastructure and fallback arrangements.
Danish Financial Supervisory Authority identifies DORA weaknesses at insurers and pension companies
The Danish Financial Supervisory Authority found that insurers and pension companies are advancing their DORA implementation but still have weaknesses in governance, risk management documentation, skills, operational testing and incident learning. Companies with deficiencies must submit remediation plans, while targeted inspections and inadequate progress may result in supervisory action.
European Supervisory Authorities identify external dependencies, cyber threats and private credit as key EU financial vulnerabilities
The European Supervisory Authorities identified non-EU dependencies, cyber and emerging technology threats, and private credit as key vulnerabilities, while assessing the EU financial system as resilient overall. They called for stronger crisis preparedness, monitoring and stress testing of external and private credit exposures, and early action on risks from artificial intelligence and quantum computing.
Danish Financial Supervisory Authority sets 2030 technology agenda for AI, quantum risks, tokenization and innovation
The Danish Financial Supervisory Authority has set a technology agenda through 2030 covering AI, quantum technology, tokenization and financial innovation. It will assess emerging risks, clarify existing requirements and consider expanding its FT Lab regulatory sandbox, with the aim of supporting innovation without adding unnecessary rules or weakening financial stability and customer protections.
Reserve Bank of Australia finds continuing ASX shortfalls in four risk areas, upgrades two operational risk ratings
The Reserve Bank of Australia found that ASX’s clearing and settlement facilities still partly observed standards covering governance, comprehensive risk management, credit risk and operational risk. It upgraded ASX Clear and ASX Settlement from not observed to partly observed for operational risk after specific CHESS improvements, but said this did not indicate broader progress in ASX’s operational risk management.
UK's Financial Conduct Authority finalizes working capital guidance, consults on sustainability reporting and outlines cyber disclosure expectations
The UK's Financial Conduct Authority finalized guidance allowing certain uncommitted facilities in working capital calculations where directors judge them available throughout the working capital period, with appropriate disclosure. It is also consulting on comply or explain expectations for listed companies under UK sustainability reporting rules applying from accounting periods beginning January 1, 2027. Issuers should assess cyber incidents case by case under the UK Market Abuse Regulation, promptly disclose inside information unless delay conditions are met, and monitor confidentiality and impacts continuously.
European Central Bank Banking Supervision calls for board oversight of bank digital strategies and stronger risk safeguards
European Central Bank Supervisory Board Chair Claudia Buch called for board oversight, multiyear investment and strong risk controls as banks expand their use of artificial intelligence, cloud services and tokenisation. Supervision will focus on common cyber, outsourcing and data vulnerabilities while holding banks accountable for automated decisions. Buch also backed integrated European markets and interoperable public infrastructure without weakening prudential standards.
Central Bank of the Dominican Republic launches consultation on solvency ratio changes for operational risk capital
The Central Bank of the Dominican Republic is consulting on changes to the prudential capital adequacy rules that would incorporate operational risk capital into the solvency ratio formula. The amendments would align the framework with the revised Regulation on Operational Risk and apply from April 12, 2027.
National Bank of the Kyrgyz Republic joins interagency cybersecurity coordination to protect financial infrastructure
The National Bank of the Kyrgyz Republic joined the first meeting of an interagency commission on information security and cybersecurity. The work covers threat assessment, rapid information sharing and stronger coordination to protect financial infrastructure and information systems.
European Banking Authority finalizes DORA-aligned non-ICT third-party risk Guidelines with two-year transition
The European Banking Authority has finalized DORA-aligned Guidelines for managing third-party risk involving non-ICT services, replacing its narrower 2019 outsourcing framework. Stricter governance, contracting, monitoring and exit requirements focus on arrangements supporting critical or important functions. Financial entities have a two-year transitional period to review and document those existing arrangements.
Central Bank of the Bahamas advances analysis of gaming links to banks and cyber preparedness plans
The Central Bank of the Bahamas reported progress on financial stability analysis of links between gaming flows and banks. The Financial Stability Council also agreed to develop sectorwide cyber preparedness plans focused on incident reporting, management and harmonized regulatory guidance. Its 2025 assessment found resilience across banks, securities and insurance, while identifying geopolitical tensions and oil prices as external risks.
De Nederlandsche Bank outlines three defenses against explosive ATM attacks after 19 incidents in first half of 2026
De Nederlandsche Bank outlined three defenses against explosive ATM attacks: stronger machines, banknote neutralization and refusal of stained notes. The Netherlands recorded 19 attacks in the first half of 2026. Indelible ink and synthetic DNA can make stolen cash unusable and help investigators trace it to a specific ATM.
Finnish Financial Supervisory Authority reports strong sector solvency and highlights operational and cyber risks
The Finnish Financial Supervisory Authority found that financial sector solvency remained strong in the first half of 2026, despite operational, cyber, geopolitical and trade policy risks. Banks maintained ample capital and stable liquidity, while pension and insurance sectors recorded high solvency ratios. Strong investment markets lifted pension assets, fund capital and the results of management companies and investment firms.
Australian Competition and Consumer Commission conditionally authorises superannuation cyber and financial crime information sharing for five years
The Australian Competition and Consumer Commission has conditionally authorised collective negotiation and threat information sharing through superannuation industry cyber and financial crime platforms until Oct. 9, 2031. The association must give the ACCC ongoing platform access and permit it to share information, while commercially sensitive business information remains outside the authorisation. The approval takes effect on Oct. 9, 2026, if it is not referred for review.
Portuguese Securities Commission launches consultation on DORA reporting procedures
The Portuguese Securities Commission is consulting on procedures for DORA reporting by entities under its prudential supervision, covering severe technology incidents, significant cyberthreats and third party technology contracts. Contract registers would be due annually by Feb. 28, while planned contracts supporting critical or important functions would require 30 days’ notice, rising to 60 days for specified market infrastructures.
Financial Supervisory Authority of Norway publishes DORA and bank supervision findings, flags governance and property risks
The Financial Supervisory Authority of Norway has published supervisory findings showing that banks remain profitable and well capitalized but face property, market and operational risks. Under DORA, firms have made substantial implementation progress, although ICT governance, operationalization of policies and third-party oversight remain weak. Inspections of smaller banks also found shortcomings in credit controls, documentation, distressed exposure monitoring and concentration risk management.
Central Bank of Bahrain chairs GCC governors meeting on payments, banking oversight and cybersecurity cooperation
The Central Bank of Bahrain chaired a GCC central bank governors meeting focused on regional cooperation in payments, banking oversight and financial technology. The governors also discussed cybersecurity information sharing and efforts to combat money laundering and terrorist financing.
Financial Stability Board convenes public-private roundtable on strengthening operational resilience
The Financial Stability Board convened public and private sector representatives to consider practical ways to strengthen preparedness for significant operational disruptions. Discussions focused on trust, lessons from incidents and exercises, effective collaboration and interoperability across sectors and jurisdictions.
Federal Deposit Insurance Corporation, Federal Reserve Board, National Credit Union Administration and Office of the Comptroller of the Currency propose tailored third-party risk guidance
Four federal regulators have proposed replacing existing third-party risk guidance with a nonbinding framework that tailors oversight to the magnitude and likelihood of risks posed by each relationship. The proposal emphasizes proportionate due diligence, contracting, monitoring, residual risk acceptance and governance. Separate guidance sharpens scrutiny of core providers serving community banks, including their transparency, contract practices, technology and operational resilience.